Google Patches Vulnerability in Desktop Search Tool

Google has issued a patch for a serious vulnerability involving Google Desktop that would have allowed attackers to steal personal information and possibly take control of a system remotely.

Researchers at Watchfire found the product was susceptible to cross-site scripting attacks that hijack the Google Web interface in order to jump from the Internet to the desktop Web environment. The attack works by getting users to click on a link that loads malicious JavaScript.

Resource Library:

Google Desktop serves as a fast search mechanism for documents, e-mails, instant messaging transcripts, archived Web pages and other data on PCs. A Google executive once described it as "the photographic memory of your computer." An attacker with control of Google Desktop can search for virtually anything on the computer, including Office documents, e-mails, media files and Web history cache.

Dan Allan, director of security research at Watchfire, said the tight integration between desktop and Web-based applications can be dangerous.

"There is no greater repository for sensitive information from credit card numbers to personal information than Google Desktop, which caches all of the information on your computer," he said. "Google desktop provides…a very high profile target for the malicious individual."

Watchfire reported the vulnerability to Google last month. "A fix was developed quickly and users are being automatically updated with the patch," said Google spokesperson Barry Schnitt. "In addition, we have another layer of security checks to the latest version of Google Desktop to protect users from similar vulnerabilities in the future. We have received no reports that this vulnerability was exploited."

Allan urged users to make sure they have the most up-to-date version of Google Desktop. However, he contends that another one could emerge because of the link between the Google Desktop and Web data, and suggests integration between public Web and desktop applications either be disabled completely or be left up to users.

Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.