(Associated Press via NewsEdge) A potentially devastating hole in Google Inc.'s prevalent desktop search product could have exposed personal files on users' computers to data thieves.
Google fixed the defect within weeks of being informed about it and says it has no evidence the vulnerability was exploited.
The flaw was uncovered late last year by Watchfire, a security-analysis provider. While the vulnerability exists in roughly 80% of Web applications, this problem appeared far more extreme 'given the sensitive nature of what Google Desktop is doing,' said Danny Allan, a researcher at Watchfire.
Google's free desktop product, first released in 2004, has millions of users and remains popular. Internet tracker Hitwise says visits to http://desktop.google.com tripled in January.
The system lets users set Google's indexing and searching capabilities loose on their own computers in addition to the Web. The service offers a fast, easy way to find documents, emails, instant-messaging transcripts, archived Web pages and other tidbits socked away on PCs.
A Google executive once described it as 'the photographic memory of your computer.'
The Watchfire researchers discovered, however, that the setup was open to something known as a cross-site scripting attack, which lets an attacker place malicious code on a Google Desktop user's computer. The PC could be infected a number of ways, including an infected email attachment.
From that instant, a hacker would have had free reign to use Google Desktop to search the victim's machine, or multiple compromised machines at once, and possibly to take full control of the computer, according to Watchfire.
© 2007 The Associated Press
© 2007 Dialog, a Thomson business. All rights reserved