eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Google Inc. said on Thursday it fixed a flaw in its site that could allow outsiders to launch phishing attacks based on Googles familiar interface, and is working on a second fix for another similar vulnerability.
The flaw, which was discovered and posted to Symantec Corp.s Bugtraq security site on Tuesday. The bulletin demonstrated the ability of hackers using JavaScript to modify and enter their own content within Googles site in order to obtain personal information, including credit card numbers.
“Its not going to trick people going to Google.com, but if you can get someone to open your site, which looks like Googles site, its really quite clever,” said Paul Mutton, an Internet services developer for Netcraft Ltd., a security and analyst firm based in Bath, England. “The user sees a URL address that starts with Google, and appears to be a Google Web site. Because its their domain, people wouldnt question what theyre seeing.”
In addition, hackers could also use the flaw to monitor the searches individuals make from both the simulated Google search as well as the new Google Desktop, which was announced last week. Because Desktop searches personal computers, the security breech could be considered more serious.
Jim Ley said he originally discovered the scripting vulnerability more than two years ago, and warned on his site that he isnt convinced Googles initial fix goes far enough in preventing other attacks.
“This may mean there are remaining vectors to attack, either with different script methods, or by playing with charsets [character sets] that bypass the filtering,” he said.
Netcraft researchers also informed Google on Wednesday of a similar, “more serious phishing vulnerability which would allow an attacker to inject their own content using the Google Web site.”
For its part, Google said it fixed the initial vulnerability on Wednesday and all Google.com users were protected. But the company was alerted of the other flaw and is currently addressing that issue.
“The [original] vulnerability we were made aware of has been fixed,” said a Google spokesman. “There was a second one that we are now working on and will be fixed shortly.”
Google did not provide an exact time frame, but according to Netcrafts Mutton, Google expected to have the second flaw fixed by Friday.
Be sure to add our eWEEK.com Security news feed to your RSS newsreader or My Yahoo page