Friday, May 24, 2024

Don’t Get Googled by Hackers!

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

An exploit in the world’s most popular search engine’s toolbar could leave users vulnerable to malicious users.

Including and prior to Google’s version 1.1.58 of its toolbar, users are at risk from hackers who can execute the following tasks:
control all visual configuration options; hijack the toolbar and reroute searches; execute arbitrary commands; read local files; tap
to key presses in the toolbar’s search box; enable features with privacy implications; clear the toolbar’s history; uninstall the

Google boasts that its toolbar “increases your ability to find information from anywhere on the web and takes only seconds to

The company who discovered the flaws, Israel’s GreyMagic Software, detailed the vulnerabilities a malicious user may exploit as such:

  • Control all visual configuration options — The method of registering changes in options to the Google toolbar is very
    insecure. The toolbar is using a special URL to inflict the changes. However, it doesn’t let the changes occur if the current
    document is outside of or the special res:// protocol
  • When typing to the Google toolbar, the currently loaded document still receives all the keyboard events. This flaw is trivial
    to exploit, by setting a simple “onkeydown” event handler in the document level and waiting for input
  • Enable features with privacy implications — the toolbar comes with two features that have privacy implications; these are the
    “PageRank” feature and the “Category” feature
  • Clear the toolbar’s history — the toolbar has an option to save searches made by it
  • Hijack the toolbar and reroute searches — to search, the toolbar uses a special option called “GoogleHome”. An attacker can
    change the value of the “GoogleHome” option and then change the URL. Once executed, Web searches would be routed through the
    attacker’s web site. The attacker would be able to log the searches and identify users. The attacker will then be able to brand the
    user and offer him services according to the searches made. After logging the search information, the attacker can simply forward
    the request to Google to remove any suspicions the user may have
  • Execute arbitrary commands — The toolbar command mechanism exposes a very dangerous feature; the script passed to the command
    will run in the same context as the current document. The toolbar command mechanism accepts two kinds of URLs,
    any URL in the domain and any res:// URL

Google has responded to the suggestions of GreyMagic, and quickly furnished a fixed version, which began distributing on Wednesday
using the auto-update feature in the Google toolbar.

To see exploit demonstrations, please visit here.

Subscribe to Data Insider

Learn the latest news and best practices about data science, big data analytics, artificial intelligence, data security, and more.

Similar articles

Get the Free Newsletter!

Subscribe to Data Insider for top news, trends & analysis

Latest Articles