Slashdot Log In
Zero Day Hole In Google Desktop
Posted by
Zonk
on Fri Jun 01, 2007 04:47 PM
from the please-stop-the-internet-from-leaking dept.
from the please-stop-the-internet-from-leaking dept.
40by40 writes "A Web application security specialist has figured out a way to launch man-in-the-middle attacks against a computer with a fully patched Google Desktop installed. With knowledge of the Google Desktop security model (a combination of one-time tokens, iFrames and JavaScript), hacker Robert Hansen figured out a way to sit between a target launching a Google search query and manipulate the search results to take control of other programs on the desktop. From the article: 'This should drive home the point that deep integration between the desktop and the web is not a good idea, without tremendous thought put into the security model. As Google's site is unencrypted, and they place their content that can run executables on their site, it can be subverted by an attacker," Hansen warns. Hansen's advisory comes just days after a Chris Soghoian's exposé of a similar man-in-the-middle attack scenario against a remote vulnerability in the upgrade mechanism used by a number of commercial Firefox extensions.'"
Related Stories
[+]
IT: Hijacking Firefox Via Insecure Add-Ons 87 comments
An anonymous reader writes "Many makers of extensions or add-ons for Firefox are introducing ways for bad guys to hijack the Web browser, new research suggests. A great many add-ons are updated over insecure (non https://) connections, providing an avenue for attackers to replace the extension with an evil update. Google's add-ons are particularly vulnerable, because they update automatically without notifying the user. From the story: '[I]f an attacker were to hijack a public Wi-Fi hot spot at a coffeehouse or bookstore — a fairly trivial attack given the myriad free, point-and-click hacking tools available today — he could also intercept this update process and replace a Firefox add-on with a malicious one.'" Here is security researcher Chris Soghoian's description of the vulnerability and a video of a simulated takeover.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Google operating system? (Score:2, Interesting)
Re:Google operating system? (Score:4, Funny)
Parent
Re:Google operating system? (Score:5, Funny)
You need to change this to read: "feed a cat". Google will feed your cat up until the index change after which it will start feeding another cat. To be grammatically precise: "a cat" will be fed. There is just no guarantee that it will be "the cat."
Parent
Re:Google operating system? (Score:5, Interesting)
No offense to Linux, but I think that would offend Google's sense of style. Unix-style OSes are great when you need low-level access to the hardware (e.g. GoogleFS), but don't infer any sort of inherent advantage in the desktop arena. In fact, the classic Unix design is very desktop unfriendly, which is why all kinds of user-friendly packages like automounter have been created.
Given the number of Ph.D. brainiacs Google has their hands on, I would expect them to create a new OS from the ground up that is more focused on the issues of dealing with the web and network in general. e.g. If it can be coded to avoid buffer overflow situations, that would be a great start. Greater focus on caching services and integrated URL handling might also be things you would see more of. Unicode everything rather than dealing with different text formats. (Incoming formats would need to be converted before they could be used.) Overall minimalist design. i.e. Don't include anything that isn't absolutely necessary to getting the job done. (Compare: The number of features on Google homepage to the number of features on the average Linux desktop.)
I will happily eat crow if Google ever produces a Linux desktop, but gut instinct says that they won't. So don't get your hopes up.
Parent
Re: (Score:2)
Re:Google operating system? (Score:4, Interesting)
Your point is pretty vacuous. The user-friendly packages already exist, and as OS X and Ubuntu (as a Linux example) show, can be used to great effect.
But you're right. Google won't produce a Linux desktop. They'll probably use a BSD variant, should they ever produce a desktop at all.
Parent
armchair OS designer's reading list (Score:4, Informative)
Although extreme hubris might combine with extreme resources (both dollars and talent) at Google to lead to the creation of an entirely new OS from the ground up, there may not be any need for that. The UNIX wheel is relatively round these days, particularly considering the Mac OS X / OSX example. Better yet, UNIX is nicely modular. If anyone devises a clever way to "avoid buffer overflow situations" it seems likely, on the basis of past evidence concerning technology development and adoption within UNIX systems in general, that it would be easier to integrate that language and compiler, or whatever technology it happens to be, into a UNIX operating system than it would be to create a fully capable system on top of it from whole cloth.
Since you seem genuinely interested in the topic, here are some reasonable books on operating system design which you might enjoy.
The Design and Implementation of the 4.4 BSD Operating System [amazon.com]
Design of the UNIX Operating System [amazon.com]
Operating System Design: The Xinu Approach [amazon.com]
UNIX Internals: The New Frontiers [amazon.com]
Mac OS X Internals: A Systems Approach [amazon.com]
Solaris Internals [amazon.com]
The other issues you raise are largely issues of interface design, which the open source community seems to do rather poorly, or at least not as well as it does other things. Google certainly does not need to re-invent the entire operating system wheel to improve URL integration, or provide a "minimalist" desktop interface, for example. They don't even need to strip features, really. Mac OS X, for example, provides enough of a minimalist default interface that novice computer users are comfortable with it. A Linux based OS from Google could take a similar approach, perhaps being even more spartan in the basic features, if that's really a desirable goal (which is another question entirely).
Parent
Re:armchair OS designer's reading list (Score:5, Informative)
That's great. When you graduate beyond armchair reading, perhaps you might consider getting out of your chair and learning about actually designing an Operating System [osdev.org]? It's a very rewarding experience and teaches one about all the wonderful spagetti and legacy problems inherent in designs like Unix. It even shows how the greater resources present in modern computers can be utilized to reduce or eliminate the problems exhibited by previous OSes.
Parent
who disturbs our meditation... (Score:2)
A programmer who is too proud to think about how other people solved the problem they're looking at is much more likely to invent a wheel with some number of road-contact surfaces "n" where n > 1.
UNIX has survived (indeed thrives) as a result of a number of major refactoring efforts, directed not only at improving the internal architecture, but even the underlying abstractions. Consider Mach and the microkernel revolution, which re
Re: (Score:2)
* POSIX is Broken. With a capital B. The mere availability of it creates buffer overflows.
* The wonderful design abstractions of OS X are pulled from another complete redesign: Into ObjectiveC
* Mach is a very, very, very bad production kernel that Apple has had the displeasure of trying to hack into something that works well. Absolutely no one refactored their kernels around the Mach design, because it was slower than molasses running uphill in January. That wasn't a core problem
Re: (Score:2)
A bad metaphor is like a leaky screwdriver. Seriously, there are significant differences between how those two are used. Google's homepage *might* be comparable to something like the Beagle UI, in which case I think Beagle beats Google (slightly) for the minimalism award.
Google operating system? WHY??? (Score:4, Insightful)
Google is about control. They want to control your information for their own profit. They show it again and again. That's how they make money. The more targeted the ads, the more money they can make. The only competitor I think they may have here is Amazon, but that only deals with your book preferences. Google wants your wants so they can sell something from one of their customers.
Thus it is NOT in the interest of Google to make a desktop. They are not in the business of making software like MS or Apple or GNU or even IBM. They are in business to manage information about you and me. Their "free" solutions are just there so you can give them more info about yourself.
Hope that is clear enough.
Parent
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:Google operating system? (Score:4, Funny)
GOoogle Operating System Environment
Gotta teach those penguins a lesson sometime...
Parent
Re:Google operating system? (Score:5, Funny)
Parent
Re: (Score:2)
Nah, it would be too insecure. It's only got one ring...
Re: (Score:2, Insightful)
deep integration is a good idea (Score:5, Insightful)
Re: (Score:2)
Google imitating Microsoft security holes. (Score:5, Insightful)
By now, everybody developing browser components should know that you do not provide functions which can execute arbitrary programs.
Usually, it's Microsoft doing this, with Outlook, IE, Office, etc. launching other applications. This is the source of most of the vulnerabilities involving web browsing. Now we have Google competing to offer similar security holes.
Re:Google imitating Microsoft 's ActiveX (Score:5, Insightful)
Are we all finally realizing that Google writes insecure apps just like ever other software development company that is made up of humans?
Parent
Re:Google imitating Microsoft security holes. (Score:5, Informative)
Firefox offers the exact same mechanism. Firefox extensions can contain (and run) executable code. (See below.)
As the Greasemokey security vulnerability [oreillynet.com] demonstrated, web pages can "script" Firefox extensions.
ActiveX = executable code + scripting from the web browser. Firefox extensions introduce the same risks as ActiveX.
Take for instance FoxyTunes [mozilla.org], which is listed on the Recommended Add-ons [mozilla.org] page. Download the XPI file, rename it to ZIP. Open it in WinZip or whatever. You'll notice several files:
DLL files are executable code on Windows. I'm assuming the *.linux and *.mac are similar. SO files are executable code under Linux, not sure why it has .file after it. I'm sure there are more extensions with executable code, that was just the first I looked at. Look for any extension that integrates with external software - almost always there will be a DLL or EXE.
Parent
Easily solved (Score:5, Informative)
I've always thought that was a scary idea anyway, since my desktop content should be in a clearly-partitioned security domain from Web content.
Re: (Score:2)
A little over blown perhaps? (Score:5, Insightful)
Once you are compromised this way the attack tries to take advantage of cross scripting vulnerabilities in a browser to run code in the compromised machine. I am not sure if there is anything unique to Google Desktop here. Could the same attack take advantage of the numerous ActiveX vulnerabilities?
Is the "security expert" trying to get more mileage by listing each exploitable hole of a man-in-the-middle attack as a separate discovery?
Definitely overblown (Score:3, Insightful)
It is not Google's job to provide a secure channel.
I guess when I do a MITM attack to capture login prompts and transparently proxy that is google's problem also?
Or when I resolve DNS queries to my own box, that is likewise google at fault?
Lol.
Re: (Score:2, Insightful)
Re:Definitely overblown (Score:5, Insightful)
Yes, it is. If they're exchanging data between their desktop app and their web service, they need to do encryption and key verification to make sure the pipe isn't compromised. Stuff outside of that (like local keyloggers) is your concern, or someone else's. But between their two endpoints, they need to secure the channel.
Parent
Re:Definitely overblown (Score:5, Insightful)
Or when I resolve DNS queries to my own box, that is likewise google at fault?
Don't be daft, SSL was created to prevent exactly these attacks, so why isn't it being used? Why does the Google toolbar submit all your potentially authority-bearing https urls to their anti-spam service in clear text? As good as Google is in certain areas, they're absolutely horrid when it comes to basic security measures.
Parent
Re: (Score:2)
Because it takes lotsa CPU or dedicated SSL engines to encrypt that many connections.
Re: (Score:2)
Re:A little over blown perhaps? (Score:4, Informative)
Parent
Disable Indexing of Executables? (Score:4, Informative)
Google size issues (Score:4, Interesting)
I wish the Google team all the best in dealing with this issue... but I am scratching my head at the speed with which they are attempting to diversify their offerings.
Google did not become a dominant force overnight. They fought battles, learned lessons, and refined/defined search capabilities for the entire world. Why have they been shooting off in a dozen different directions? Is there any way that even they can stay on top of all the little details considering the number of immature products they are floating?
Anyhow, the next couple of days will go a long way towards showing exactly how far the Google team needs to go before I trust them on my desktop. Here's hoping they prove to have the response time/customer centric attitude that made them my preferred search provider.
Regards.
Thought is not enough (Score:5, Insightful)
"Tremendous thought" is a weaker notion than transparency, public scrutiny, or even rigorous proof, which are really what's required.
Everything else is just hope; hide and seek.
Hopefully Google can learn and set an example here.
installers (Score:5, Insightful)
Did the industry learn nothing? (Score:4, Insightful)
Even MS has done a 180 and with Vista broke all the internal/external links that made XP/ActiveX/IE such a mess. So if MS is smart enough to learn from their mistakes you would thing a company like Google would not go out of their way to emulate the same bad security ideas.
Is it just me, or is Google racing to be the next big evil? Gmail scanning, search data compiling, Firefox reporting, desktop document reporting, and now making really stupid software design decisions?
Re:Did the industry learn nothing? (Score:5, Insightful)
Sometime around 2002ish, Microsoft learned (the hard way) that functionality can NEVER trump security, and they've spent the better part of the past 5 years working on fixing the mistakes they made back in the 1990s (when functionality trumped security). You can see the fruits of that in their most recent offerings (IIS6 has had no exploitable holes in the 4 years it's been available, Vista, for all of its compatibility problems has already been shown to be dramatically better than XP was security-wise).
Until all the vendors "get it" and realize that security should win, stuff like this is going to continue to happen.
Parent
Hanging your guts out (Score:4, Interesting)
business as usual (Score:4, Interesting)
the google engineers aren't magicians. when they develop features, they do so under tight schedule, and make mistakes, especially those hired to code (as opposed to do PR). the only reason there haven't been more problems discovered is likely the fact that they don't distribute much software.
besides, google's main goal isn't promoting security. their primary goal is to hookup lotsa people -- and in their case, that means to deliver applications with lotsa features quickly, because people are hooked on the features, the competition ain't sleeping, and that first-comer advantage matters.
does that remind you of another company? it should, because all of them successful companies ain't that much different at all
A little more encryption? (Score:3, Informative)
Right now, any request to an encrypted Google search URL redirects you to www.google.com.
Re:Logical (Score:5, Insightful)
Parent
Re: (Score:3, Informative)
Yeah for sure, now that Apache runs 60% of the Web, all those crackers are finding tons of exploits for it everyday!
http://search.cert.org/query.html?col=certadv&col= vulnotes&qt=apache&charset=iso-8859-1 [cert.org]
Yes, Apache has a good reputation for security, but like most popular, complex programs, its history is far from exploit-free.
-snarkbot
Re: (Score:3, Funny)
What?
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
FUD FUD FUD (Score:2, Informative)