http://www.theregister.co.uk/2007/08/21/google_modules_security_debate/
By John Leyden
21st August 2007
Google has crossed swords with an independent security researcher who
claims that the domain used by Google module applications provides a
potential "safe haven" for phishing fraudsters.
Google modules are small web apps (widgets) designed for functions such
as displaying weather forecasts or sports scores on a third-party
website.
Security researcher Robert Hansen warned Google that fraudsters might be
able to create a phishing site on the gmodules domain because a cross
site scripting flaw allows the injection of JavaScript.
Because the gmodules domain (gmodules.com) is trusted by phishing
filters the flaw poses a greater risk than it might on other domains.
In its response, Google said JavaScript is a supported part of Google
modules. Cross-domain protection stops sites on gmodules from been used
to steal Google-specific cookies, it adds. "On further review, it turns
out that this is not a bug, but instead the expected behavior of this
domain," Google's security staffers told Hansen.
Hansen, a critic of Google's security response in general, argues that
the search engine giant has missed the point. He posted a demo of
cross-site scripting of the gmodules domain to illustrate his concern
that Google ought to be worried about risks beyond simple credential
(cookie) theft.
The exchange between Hansen and Google has sparked a lively debate on
the ha.ckers.otg forum with participants weighing in on both sides of
the debate. Some point out that Google has at least mitigated the risk
by running modules from the gmodules domain, while others argue that the
security policies at the ad brokering giant leave a lot to be desired. ®
Received on Wed Aug 22 01:11:01 2007