Web application security leader Watchfire, today announced its security researchers have discovered a vulnerability in Google Desktop which could enable a malicious individual to achieve not only remote, persistent access to sensitive data, but in some conditions full system control.
Watchfireâs security researchers have uncovered a new attack methodology that clearly emphasizes the danger of integration between desktop applications and web-based applications as an aperture for a malicious attacker to escalate his/her privileges by crossing from the Web environment to the desktop application environment. This outcome is the combined result of the integration between the Google.com Web site and Google Desktop, and Google Desktop's failure to properly encode output containing malicious or unexpected characters.
In this paper, Watchfire details the methodology of attack and provides a valid use case including a description of the basic technique and some theoretical outcomes. Finally, Watchfire provides fix recommendations that are appropriate for Google Desktop, as well as for many other web-based applications. Google has been responsive and has issued a patch which mitigates the immediate risk of the attack.
âApplication security vulnerabilities need to be taken seriously. As the potential damage of a Cross Site Scripting attack against a desktop application with a Web interface is enormous, Web application security must be comprehensively evaluated and continually monitored,â said Michael Weider, founder and CTO, Watchfire. âIndustry leaders like Google continue to make strides in security but due to the dynamic nature of applications vulnerabilities can surface.â