Google fixes Web site security bug
Vulnerability could have exposed some users to account hijacks, phishing scams and other attacks, security firm says.
The flaw, known as a cross-site scripting vulnerability, existed on the Web site for Google's AdWords advertising program and a customer training site, according to security company Finjan Software, which discovered the problem.
Attackers could have exploited the flaw to hijack Google accounts, launch phishing scams or even download malicious code onto users' computers, according to Finjan. Phishing scams are designed to trick people into giving up sensitive information such as usernames, passwords, credit card details and Social Security numbers.
Finjan informed Google of the bug late last month, and the problem was fixed within 30 hours, said Limor Elbaz, a vice president at Finjan, which is headquartered in San Jose, Calif. "Google's responsiveness was very good," she said.
Google confirmed that it was alerted "a little while ago" and fixed the flaw. "No user data was compromised, and we applaud Finjan for following industry best practices for vulnerability disclosure," a Google representative said in an e-mailed statement.
The security problem existed because forms on Google's Web site did not validate and filter data entered into certain fields. This allowed an attacker to inject extra content and scripts that would run on the user's computer, according to Finjan. To take advantage of the flaw, an attacker would have to craft a special Web link and trick the user to follow it.
"The dangerous thing in the case of Google is that the link would look like an innocent Google link," Elbaz said.
Cross-site scripting flaws are found regularly. Earlier this year, Finjan spotted a similar bug in Microsoft's Xbox 360 Web site. The company earlier identified holes in Yahoo's Web-based e-mail service.
Finjan, which sells products to protect corporate systems against Web-based attacks, has tools to scan Web sites for vulnerabilities. The company regularly puts popular Web sites to the test. "We do this to encourage vendors to improve their products," Elbaz said.
With the cross-site scripting flaw fixed, Google's Web site is now deemed secure by Finjan. "We found that the rest of the Web site is not vulnerable, at least to the cross-site scripting vulnerabilities," Elbaz said. "We will keep following the site."
Earlier this year, a security flaw in Google's e-mail service, Gmail, was identified and fixed. The flaw could have allowed attackers to hijack Gmail users' in-boxes.