The flaw exposes websites that use Google Search Appliance and Google Mini devices. It is a cross-site scripting (XSS) error in the systems' Unicode Transformation Format (UTF) character encoding that makes it possible for hackers to create malicious links that appear to point to trusted sites.
First discovered on a hacker website and reported by an anonymous researcher known as Maluc, the flaw makes it easy to create believable and large-scale phishing attacks.
John Herron, who runs NIST.org, reported the problem to US-CERT (U.S. Computer Emergency Readiness Team), which informed Google of the problem.
Google reported that it released a fix on Monday, but only a handful of those affected have used the workaround. Organisations that use either appliance are highly encouraged to contact Google if they have not yet heard from the company.
Click here to email Ericka Chickowski.
Google search device flaw leaves sites open to phishing attacks
By
Ericka Chickowski
on Nov 29, 2006 9:00AM
Hackers and security experts made public a vulnerability in Google's search appliances that is leaving hundreds of major organisations such as the U.S. Food and Drug Administration, Stanford University and the National Hockey League open to phishing attacks.
Got a news tip for our journalists? Share it with us anonymously here.
Partner Content
Promoted Content
Kick the tyres of AI systems using real world data at #BuildWithAI Hack 2021
Promoted Content
Australian data sovereignty and protection concerns increase
Promoted Content
Why simplicity is the winning formula for CX success
Partner Content
Solving the post-COVID digital access control headache
Sponsored Whitepapers
The ultimate guide to customer IAM
Communicating cyber security in a language the Board understands
10 questions to ask before you select a Network Performance Management tool
Innovate faster. Why accelerating change is a CIO's biggest challenge.
Unlock faster time-to-revenue using Adobe digital document processes
