A flaw in Google’s desktop search program was revealed on Monday by a team of computer researchers. They showed it could be used to capture valuable personal information from a remote user’s computer.
Google Desktop Search (GDS) lets users quickly hunt for files and documents stored on their computer using a web browser. After installation, the program runs in the background – indexing documents, emails, instant messaging conversations and web browser history – so that searches bring up results almost instantly.
Dan Wallach at Rice University in Texas, US, and two students, Seth Nielson and Seth Fogarty, discovered the flaw shortly after the application was released on 14 October 2004. They developed demonstration code to exploit the flaw and steal search results via a web page.
A query entered into Google on a computer running the desktop search program automatically adds results from the computer itself to results from the web. The researchers suspected that the way GDS integrates these results could prove a potential weak spot.
By analysing packets of information sent across a network, the team realised they could fool the application into handing over desktop search results to a remote user via the internet.
They wrote a java applet – a small program that runs within a browser – to exploit the glitch through a malicious website. The victim would first need to be lured to the website, perhaps through the use of spam email messages.
Once there the applet pretends to make a connection to www.google.com, which in turn allows the remote hacker to perform a search of everything on the user’s computer accessible through the GDS. This might include personal or financial information.
Wallach notes that the applet does not need to exploit a software bug in order to work. “The Java program is completely legit,” he told New Scientist. The trick simply exploited an oversight in GDS’s security.
The trick is more a proof of concept than a real threat as Google was notified of the vulnerability in November and began updating desktop programs remotely on 10 December. The company said in a statement that it had “since fixed the problem so that all current and future users are secure”.
Bruce Schneier, a US computer security expert, said the flaw is potentially serious but no different to those found in many different applications every day. “Like any piece of commercial software, it’s huge and complex,” he told New Scientist.
Schneier adds that the automatic update process used by Google to repair installed applications might itself prove a security weak spot, but was better than relying on users to update software for themselves. “Security is always a trade-off,” he says.
But Wallach says the flaw highlights the importance of testing an application thoroughly before releasing it. “Whenever you try to do something new and clever, you run the risk of enabling some sort of security attack,” he warns. “The challenge for any organisation is to study carefully their own products for these kinds of issues before they get out of the door.”
Concerns have previously been raised over the security implications of Google’s powerful desktop search tool. Some pundits were alarmed that previously visited web pages protected by encryption or passwords can be viewed using the search tool, although this feature can be switched off.
On 14 December, US research firm Gartner warned customers not to use the tool on computers that might contain valuable business information until it has been tested more thoroughly.
More on these topics: