Researcher crosses swords with Google over XSS 'flaw'

Researcher crosses swords with Google over XSS 'flaw'
Researcher crosses swords with Google over XSS 'flaw'

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

Content-Transfer-Encoding: QUOTED-PRINTABLE

By John Leyden
21st August 2007

Google has crossed swords with an independent security researcher who 
claims that the domain used by Google module applications provides a 
potential "safe haven" for phishing fraudsters.

Google modules are small web apps (widgets) designed for functions such 
as displaying weather forecasts or sports scores on a third-party 

Security researcher Robert Hansen warned Google that fraudsters might be 
able to create a phishing site on the gmodules domain because a cross 
site scripting flaw allows the injection of JavaScript.

Because the gmodules domain ( is trusted by phishing 
filters the flaw poses a greater risk than it might on other domains.

In its response, Google said JavaScript is a supported part of Google 
modules. Cross-domain protection stops sites on gmodules from been used 
to steal Google-specific cookies, it adds. "On further review, it turns 
out that this is not a bug, but instead the expected behavior of this 
domain," Google's security staffers told Hansen.

Hansen, a critic of Google's security response in general, argues that 
the search engine giant has missed the point. He posted a demo of 
cross-site scripting of the gmodules domain to illustrate his concern 
that Google ought to be worried about risks beyond simple credential 
(cookie) theft.

The exchange between Hansen and Google has sparked a lively debate on 
the ha.ckers.otg forum with participants weighing in on both sides of 
the debate. Some point out that Google has at least mitigated the risk 
by running modules from the gmodules domain, while others argue that the 
security policies at the ad brokering giant leave a lot to be desired. =C2=AE

Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Attend HITBSecConf2007 - Malaysia 
Taking place September 3-6 2007 featuring seven tracks of technical 
training and a dual-track security conference with keynote speakers 
Lance Spitzner and Mikko Hypponen!  -  Book your seats today! 

Site design & layout copyright © 1986-2015 CodeGods