An exploit in the world’s most popular search engine’s toolbar could leave users vulnerable to malicious users.
Including and prior to Google’s version 1.1.58 of its toolbar, users are at risk from hackers who can execute the following tasks:
control all visual configuration options; hijack the toolbar and reroute searches; execute arbitrary commands; read local files; tap
to key presses in the toolbar’s search box; enable features with privacy implications; clear the toolbar’s history; uninstall the
toolbar.
Google boasts that its toolbar “increases your ability to find information from anywhere on the web and takes only seconds to
install.”
The company who discovered the flaws, Israel’s GreyMagic Software, detailed the vulnerabilities a malicious user may exploit as such:
- Control all visual configuration options — The method of registering changes in options to the Google toolbar is very
insecure. The toolbar is using a special URL to inflict the changes. However, it doesn’t let the changes occur if the current
document is outside of google.com or the special res:// protocol - When typing to the Google toolbar, the currently loaded document still receives all the keyboard events. This flaw is trivial
to exploit, by setting a simple “onkeydown” event handler in the document level and waiting for input - Enable features with privacy implications — the toolbar comes with two features that have privacy implications; these are the
“PageRank” feature and the “Category” feature - Clear the toolbar’s history — the toolbar has an option to save searches made by it
- Hijack the toolbar and reroute searches — to search, the toolbar uses a special option called “GoogleHome”. An attacker can
change the value of the “GoogleHome” option and then change the URL. Once executed, Web searches would be routed through the
attacker’s web site. The attacker would be able to log the searches and identify users. The attacker will then be able to brand the
user and offer him services according to the searches made. After logging the search information, the attacker can simply forward
the request to Google to remove any suspicions the user may have - Execute arbitrary commands — The toolbar command mechanism exposes a very dangerous feature; the script passed to the command
will run in the same context as the current document. The toolbar command mechanism accepts two kinds of URLs,
any URL in the google.com domain and any res:// URL
Google has responded to the suggestions of GreyMagic, and quickly furnished a fixed version, which began distributing on Wednesday
using the auto-update feature in the Google toolbar.
To see exploit demonstrations, please visit here.
