Hackers target Google Gadgets

Google logoOne of the biggest problems with the so-called Web 2.0 movement has been its encouragement of oversharing ??” which often means underestimating security risks. Adding doodads of varying quality to a home page can add a lot of pizazz, but can also be fraught with danger, since they can open a door for hackers.

It's a threat even for the biggest Web companies, including Google Inc., whose "gadgets" ??” little programs like calendars or daily photo feeds that users can implant onto their personalized Google home pages ??” are increasingly juicy targets for hackers, two security researchers said Wednesday.

It's not that Google is designing insecure programs.

The issue is that users building their own customized applications, and distributing them through Google, might have evil intentions and try to exploit those programs once they're installed on users' pages. Many users are inclined to inherently trust what they download from Google.

Robert Hansen, chief executive of security consultant SecTheory, and Tom Stracener, senior security analyst with security testing software maker Cenzic Inc., demonstrated an attack Wednesday at the Black Hat hacker conference in Las Vegas in which they used a malicious gadget to break into a person's Web browser and read their searches in real time.

Malicious gadgets ??” if a user were to download one of them ??” could be used in a variety of other attacks, including one where one gadget steals information from another, a valuable attack against gadgets that store personal user information, Hansen and Stracener said.

"How do you know it's a legitimate gadget?" Hansen asked. "Because someone uploaded it? There's no moderation, there's no way to guarantee it won't turn bad."

Google isn't alone.

The company is fighting a common problem facing social-networking Web sites and other sites that encourage users to spruce up their pages with little knickknacks that reach out to the outside world to deliver pictures or other content. The applications run code on the page that can be used for good or evil.

Google disputes Hansen's characterization of its vetting process for gadgets.

The company said in a statement that it scans all gadgets regularly for malicious code, and in the "very rare" instance in which one is found, it's immediately blacklisted.

Google added that since November 2007 no new "inline" gadgets ??” which have access to user account information ??” have been created. And the authors of existing "inline" gadgets can't modify them further.

The company defended its program and said gadgets are created by developers from around the world and "provide a convenient way for users to view information collected from around the Web in one place."

Source: Yahoo

Tags: Google, hackers

Comments
Add comment

Your name:
Sign in with:
or
Your comment:


Enter code:

E-mail (not required)
E-mail will not be disclosed to the third party


Last news

 
Consumer group recommends iPhone 8 over anniversary model
 
LTE connections wherever you go and instant waking should come to regular PCs, too
 
That fiction is slowly becoming a reality
 
The Snapdragon 845 octa-core SoC includes the Snapdragon X20 LTE modem
 
Human moderators can help make YouTube a safer place for everyone
 
Google says Progressive Web Apps are the future of app-like webpages
 
All 2018 models to sport the 'notch'
 
The biggest exchange in South Korea, where the BTC/KRW pair is at $14,700 now
The Samsung Galaxy A5 (2017) Review
The evolution of the successful smartphone, now with a waterproof body and USB Type-C
February 7, 2017 /
Samsung Galaxy TabPro S - a tablet with the Windows-keyboard
The first Windows-tablet with the 12-inch display Super AMOLED
June 7, 2016 /
Keyboards for iOS
Ten iOS keyboards review
July 18, 2015 /
Samsung E1200 Mobile Phone Review
A cheap phone with a good screen
March 8, 2015 / 4
Creative Sound Blaster Z sound card review
Good sound for those who are not satisfied with the onboard solution
September 25, 2014 / 2
Samsung Galaxy Gear: Smartwatch at High Price
The first smartwatch from Samsung - almost a smartphone with a small body
December 19, 2013 /
 
 

News Archive

 
 
SuMoTuWeThFrSa
     12
3456789
10111213141516
17181920212223
24252627282930
31      




Poll

Do you use microSD card with your phone?
or leave your own version in comments (4)