Re: [WEB SECURITY] Overtaking Google Desktop

["Debasis Mohanty" <debasis.mohanty.listmails () gmail com>]

> > it becomes a matter of time before another vector of exploit (either 
> > through the browser or web application) allows similar access.

There are already plenty out there for exploiting GDS, just that they are
not disclosed. 

I found a similar one nearly a year ago where one can retrieve the
"salt_value" by exploitation of any one of these combinations - 

- XSS + IE exploit

- Third Party plugins for GDS

- DOM access to 'Desktop' link in the google.com page

- IFrame + Regular Expressions

And there are many such tricks to retrieve the salt. 

It's quite some time I last played with GDS and am not sure of its present
design changes; initially the "salt value" remains unique to the user's
machine and do not change for any local search. The trick I used is - 

a. send a link with payload to the victim 

b. the malicious link on load, tries to make a random search query to
google.com using keywords link "password", "mails" etc ..etc... 

c. In the search result, all the links related to local drive gets appended
carries the unique gds salt

d. use JavaScript + Regular Expressions to either query those links or pass
it back to the attacker through some kind of FORM POST or via mail (using
ASP CDONT etc) 

e. <after this, it opens lot of scope for the attacker to attack the system>


I've not seen the latest GDS but it seems from your report, they have
changed the salt value usage during the search. 


Anyway - good work & a neat report. 


Regards,
-d



-----Original Message-----
From: Yair Amit [mailto:yairam_ng () watchfire com] 
Sent: Thursday, February 22, 2007 3:17 PM
To: websecurity () webappsec org
Subject: RE: [WEB SECURITY] Overtaking Google Desktop

In November of 2005, Matan Gillon discovered a vulnerability in Internet
Explorer in the way it handled the CSS import directive
(http://www.hacker.co.il/security/ie/css_import.html). He proved the
danger of the IE vulnerability by attacking Google Desktop.  

This proof of concept proved a powerful demonstration of the browser
exploit and was successful for the same reason that our research into
Google Desktop's security was successful - because a link is maintained
between the public web site and the local web server. If Google had
disabled this link, or given the user the option to remove the link,
they would not have been vulnerable. Matan Gillon should receive credit
for recognizing the danger of this intersection.

We firmly believe that the integration between public web server and the
local web server is a very dangerous thing. While Google have put a
band-aid on the immediate issue, it becomes a matter of time before
another vector of exploit (either through the browser or web
application) allows similar access.

Best regards,
        Yair Amit
        Security Team
        Watchfire (Israel) Ltd.

-----Original Message-----
From: Yair Amit [mailto:yairam_ng () watchfire com] 
Sent: Wednesday, February 21, 2007 4:12 PM
To: websecurity () webappsec org
Subject: [WEB SECURITY] Overtaking Google Desktop

Hello,

A new research from Watchfire has revealed a serious vulnerability in
Google Desktop.

The attack, which is fully presented in a new Watchfire research paper
released today (available at
http://www.watchfire.com/resources/Overtaking-Google-Desktop.pdf), can
allow a malicious individual to achieve not only remote, persistent
access to sensitive data, but in some cases full system control as well.

Google Desktop is a popular freeware desktop search tool which offers
powerful indexing abilities along with an easy to use interface.
In many cases, Google Desktop manages highly sensitive information.
Therefore, the impact of a security breach in it is far-reaching.

Google Desktop contains several protection mechanisms to secure its
indexed data against remote intruders.

In this paper, we present a step-by-step attack flow that circumvents
Google Desktop's protection mechanisms and allows a malicious attack to
take place against Google Desktop users.

The attack is composed of web-application security flaws found in Google
Desktop along with exploitation of Google Desktop's tight integration
with the Google.com website.

The paper shows that it is possible to achieve a remote and persistent
access to sensitive data on attacked systems.
In addition, under certain conditions, it is also possible to covertly
inject and execute malicious applications on attacked systems, using
Google Desktop's own features. 

The full paper can be found in the following link:
http://www.watchfire.com/resources/Overtaking-Google-Desktop.pdf
A demonstration of the attack flow can be found at the same page or at
the following link:
http://download.watchfire.com/googledesktopdemo/index.htm

Note:
-----
The Google Desktop security flaw was coordinated with the Google
Security Team. 
Google has been responsive and recently issued a patch which mitigates
the risk of the attack.
We highly recommend all Google Desktop users to make sure they have an
updated version installed on their system.

This vulnerability was discovered by me with the cooperation of Danny
Allan and Adi Sharabani.

Best regards,
            Yair Amit
            Security Team
            Watchfire (Israel) Ltd.

------------------------------------------------------------------------
----
Join us on IRC: irc.freenode.net #webappsec

The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]


----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

The Web Security Mailing List: 
http://www.webappsec.org/lists/websecurity/

The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/