Rice professor finds (security) flaw in Google

[rainbow4321]

http://www.mysanantonio.com/sharedcontent/APStories/stories/D8745FHG1.html


A computer scientist and two of his graduate students at Rice University found a security flaw in a search tool distributed by Google, allowing the popular Web site to fix the problem. The glitch could have let an attacker use the Internet to secretly search private data stored on personal computers.

They found last month that an attack Web site could trick the Google program into believing it was communicating with the Google software. Instead, it would retrieve private data from PCs. The searches could have exposed small but important snippets of text from files. "If you, for example, had a file of credit card numbers or Web passwords, I might be able to read that," Wallach said.

Google disclosed the security problem over the weekend. It was contained in a test version of Desktop Search released in October and which can be downloaded for free on the Google site. Google said it has begun distributing a new version of the search tool that repairs the potential security flaw.


The Rice University researchers found the glitch in a feature of the software where search results can be mixed to examine PCs and the Internet at the same time. Wallach said Google's search was the only one vulnerable to this type of attack. Microsoft's version, for example, doesn't try to combine PC and Internet searches

[checks-n-balances]

1. Maybe you should edit title to say "SECURITY flaw" to get more att'n

there may be some DUers who might otherwise overlook your thread - Just IMHO

[GregD]

2. Dan Wallach!

This is one of Avi Rubin's Diebold research team. He have been all over the paperless e-voting stuff.

Dan rocks!

[Squatch]

3. There's a Rice University? What do they study there?

Chemistry 101 - Starches
Civil Engineering 210 - How to build a paddy dike

:shrug:

[Anakin Skywalker]

8. They Study Rice Engineering and Car Pimping

to build better rice cars. :)

[Igel]

9. In Houston.

Moderately prestigious undergrad school. Has grad programs, not all prestigious.

Quite nice. Music school, med school with strong ties to NASA/space science.

[brentspeak]

11. Very prestigious undergrad, from what I hear

Probably the most prestigious private undergrad college in the Southwest.

[DireStrike]

4. I heard about this before.

My OS can search the contents of my computer for me, thank you very much. Google, you just worry about those other computers.

[MasonJar]

5. Could it have been placed there on purpose? I understand

that the Google team are big Pugs.

[Tempest]

6. Old news. It's been fixed

Google released an update with the problem fixed.

This is two days old.

[high density]

7. You didn't need to worry about this unless you were using...

Google Desktop Search. The AP headline is kind of misleading.

[w4rma]

10. Yup. You actually have to have the software INSTALLED on your computer. nt

[Moderator]

12. Duplicate

http://www.democraticunderground.com/discuss/duboard.php?az=show_topic&forum=102&topic_id=1085927