Another Google attack found

A security vulnerability has been found in Google Desktop, just a day after a similar flaw was found in the Firefox Google toolbar.

Google hacker Robert Hansen has posted a proof of concept showing how attackers could use Google Desktop to launch software that had already been installed on the victim's computer.

The attack is hard to pull off and could not necessarily be used to install unauthorised software on the victim's PC, but it does illustrate the kind of security issues that arise with web-based applications, said Hansen, CEO of web security consultancy Sectheory.com, and a contributor to the Ha.ckers.org web site.

"When you have third parties writing code that interacts with your browser, it inherently breaks the browser security model," he said.

To exploit Hansen's Google Desktop vulnerability, an attacker would first have to launch a successful "man-in-the-middle" attack, somehow placing himself between the victim and Google's servers. This could by done by tricking the victim into logging onto a malicious wireless network, Hansen said.

Once this was done, the hacker could launch Hansen's attack by changing the web pages being delivered to the victim's PC. By returning web pages that have been doctored with new JavaScript code, the victim could be tricked into clicking onto a malicious link, Hansen said.

"When they actually click that mouse button, they're not clicking on the web page, they're clicking on a link to Google Desktop that actually runs code, " he said.

The steps Hansen took to pull off the attack are complex because of the security features that Google has built into its software, he added. "What I've done is combine a lot of different attacks that Google desperately tries to prevent."

On Wednesday researcher Christopher Soghoian showed how a man-in-the-middle attack could be used to install malicious software on computers that used a variety of popular Firefox add-ons, including the toolbars from Google, Yahoo and AOL.

Hansen has posted a video showing how this attack could be used to launch Windows HyperTerminal. But it could be used to launch virtually any application that has already been installed on the PC, he said.

This is not the first bug in Google Desktop. In February, engineers at Watchfire showed how a flaw in the program's Advanced Search Feature could be used to gain access to data or even run unauthorised software on a victim's computer.

Two days after the Watchfire bug was disclosed, Hansen himself showed how attackers could steal information from Google Desktop users using what is called an anti-DNS (Domain Name System) pinning attack.

Google was not immediately available to comment for this story.