Tech Shout!

Security researcher Matan Gillon has published a proof-of-concept flaw that exploit Google Desktop, the search software that runs on a local PC, and Internet Explorer 6.

The prime reason, as always is Microsoft’s lax and inconsistent implementation of Cascading Style Sheets (CSS) in Internet Explorer. A web site can inject code into a page which allows it to execute on a remote machine.

“All an attacker has to do is lure a user to a malicious web page. Thousands of web sites can be exploited and there isn’t a simple solution against this attack at least until IE is fixed. That means millions of IE users are affected by this design flaw,” writes Gillon.

Opera and FireFox users needn’are safe.

However this particular flaw wouldn’t have been possible without careless programming by Google, which amazingly, fails to obey the Google Desktop security model on its own site.

Gillon discovered that on certain pages, such as Google News, it was easy to extract the security key that the local copy of Google Desktop needs to permit queries to be executed.

This feature has been in IE at least since IE 6 came out. In other words it means that Microsoft is again leading the field when it comes to AJAX and Web2.0 products.

The weight of responsibility for this flaw falls on Microsoft. But Google shares some blame too, for failing to take the integrity of your personal data seriously.