Don't Get Googled by Hackers!

The popular search engine houses a flaw in its toolbar that hackers can use to execute multiple tasks; Google responds with fix.
An exploit in the world's most popular search engine's toolbar could leave users vulnerable to malicious users.

Including and prior to Google's version 1.1.58 of its toolbar, users are at risk from hackers who can execute the following tasks: control all visual configuration options; hijack the toolbar and reroute searches; execute arbitrary commands; read local files; tap to key presses in the toolbar's search box; enable features with privacy implications; clear the toolbar's history; uninstall the toolbar.

Google boasts that its toolbar "increases your ability to find information from anywhere on the web and takes only seconds to install."

The company who discovered the flaws, Israel's GreyMagic Software, detailed the vulnerabilities a malicious user may exploit as such:

  • Control all visual configuration options -- The method of registering changes in options to the Google toolbar is very insecure. The toolbar is using a special URL to inflict the changes. However, it doesn't let the changes occur if the current document is outside of or the special res:// protocol
  • When typing to the Google toolbar, the currently loaded document still receives all the keyboard events. This flaw is trivial to exploit, by setting a simple "onkeydown" event handler in the document level and waiting for input
  • Enable features with privacy implications -- the toolbar comes with two features that have privacy implications; these are the "PageRank" feature and the "Category" feature
  • Clear the toolbar's history -- the toolbar has an option to save searches made by it
  • Hijack the toolbar and reroute searches -- to search, the toolbar uses a special option called "GoogleHome". An attacker can change the value of the "GoogleHome" option and then change the URL. Once executed, Web searches would be routed through the attacker's web site. The attacker would be able to log the searches and identify users. The attacker will then be able to brand the user and offer him services according to the searches made. After logging the search information, the attacker can simply forward the request to Google to remove any suspicions the user may have
  • Execute arbitrary commands -- The toolbar command mechanism exposes a very dangerous feature; the script passed to the command will run in the same context as the current document. The toolbar command mechanism accepts two kinds of URLs, any URL in the domain and any res:// URL

Google has responded to the suggestions of GreyMagic, and quickly furnished a fixed version, which began distributing on Wednesday using the auto-update feature in the Google toolbar.

To see exploit demonstrations, please visit here.

0 Comments (click to add your comment)
Comment and Contribute


(Maximum characters: 1200). You have characters left.