Second Google Desktop Attack Possible, Researchers Say
The troubling thing about the attack Hansen identified, which he calls anti-anti-anti-DNS pinning, is that there is very little that can be done to avoid it, short of eliminating cross-site scripting vulnerabilities on the Web.
"This is really just fundamentally about how browsers work," he said. "If you allow a website to have access to your drive—to modify to change things, to integrate or whatever—you’re relying on that website to be secure."
Hansen and Grossman say that Google is not the only company vulnerable to a growing category of Web-based attacks. For instance, MySpace.com was hit when a fast-moving worm spread through the MySpace community in early December, stealing MySpace log-in credentials and promoting adware websites.
"A lot of these new attack techniques are going to require the browsers to improve," Grossman said. "The users really have very little ability to protect themselves against these attacks," he added. "It’s very bad. Even the experts are afraid to click on each other’s links anymore."
-Robert McMillan, IDG News Service (San Francisco Bureau)
Related Links:
Check out our CIO News Alerts and Tech Informer pages for more updated news coverage.
$firstKeyword
Receive the latest security news as it breaks.
