Another Phishing Hole Found in Google

Google Inc. said on Thursday it fixed a flaw in its site that could allow outsiders to launch phishing attacks based on Googles familiar interface, and is working on a second fix for another similar vulnerability.

The flaw, which was discovered and posted to Symantec Corp.s Bugtraq security site on Tuesday. The bulletin demonstrated the ability of hackers using JavaScript to modify and enter their own content within Googles site in order to obtain personal information, including credit card numbers.

"Its not going to trick people going to Google.com, but if you can get someone to open your site, which looks like Googles site, its really quite clever," said Paul Mutton, an Internet services developer for Netcraft Ltd., a security and analyst firm based in Bath, England. "The user sees a URL address that starts with Google, and appears to be a Google Web site. Because its their domain, people wouldnt question what theyre seeing."

/zimages/6/28571.gifRead more here how attackers can inject scripts into a Web site.

In addition, hackers could also use the flaw to monitor the searches individuals make from both the simulated Google search as well as the new Google Desktop, which was announced last week. Because Desktop searches personal computers, the security breech could be considered more serious.

/zimages/6/28571.gifClick here to read about Googles desktop searching solution.

Jim Ley said he originally discovered the scripting vulnerability more than two years ago, and warned on his site that he isnt convinced Googles initial fix goes far enough in preventing other attacks.

"This may mean there are remaining vectors to attack, either with different script methods, or by playing with charsets [character sets] that bypass the filtering," he said.

/zimages/6/28571.gifWhile some Google customers expressed concerns over security with the new Google Desktop search, eWEEK.coms Larry Seltzer isnt worried. Click here to read more.

Netcraft researchers also informed Google on Wednesday of a similar, "more serious phishing vulnerability which would allow an attacker to inject their own content using the Google Web site."

For its part, Google said it fixed the initial vulnerability on Wednesday and all Google.com users were protected. But the company was alerted of the other flaw and is currently addressing that issue.

"The [original] vulnerability we were made aware of has been fixed," said a Google spokesman. "There was a second one that we are now working on and will be fixed shortly."

Google did not provide an exact time frame, but according to Netcrafts Mutton, Google expected to have the second flaw fixed by Friday.

/zimages/6/28571.gifCheck out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.

/zimages/6/77042.gif

Be sure to add our eWEEK.com Security news feed to your RSS newsreader or My Yahoo page