One of the biggest problems with the so-called Web 2.0 movement has been its encouragement of oversharing – which often means underestimating security risks. Adding doodads of varying quality to a home page helps a lot but can also be dangerous as they opens a door for hackers.
It’s a threat even for the biggest Web companies, including Google Inc, whose gadgets (little programs like calendars or daily photo feeds that users can implant onto their personalized Google home pages) are increasingly juicy targets for hackers.
It’s not that Google is designing insecure programs. The issue is that users building their own customized applications, and distributing them through Google, might have evil intentions and try to exploit those programs once they’re installed on users’ pages. Many users are inclined to inherently trust what they download from Google.
Robert Hansen, chief executive of security consultant SecTheory, and Tom Stracener, senior security analyst with security testing software maker Cenzic Inc., demonstrated an attack on Wednesday at the Black Hat hacker conference in Las Vegas in which they used a malicious gadget to break into a person’s Web browser and read their searches in real time.
Malicious gadgets, if a user were to download one of them, could be used in a variety of other attacks, including one where one gadget steals information from another, a valuable attack against gadgets that store personal user information, Hansen and Stracener said.
Google isn’t alone. The company is fighting a common problem facing social-networking Web sites and other sites that encourage users to spruce up their pages with little knickknacks that reach out to the outside world to deliver pictures or other content. The applications run code on the page that can be used for good or evil.
Google disputes Hansen’s characterization of its vetting process for gadgets. The company says that it scans all gadgets regularly for malicious code, and in the “very rare” case one is found and it’s immediately blacklisted.
The company defended its program by saying gadgets are created by developers from around the world and provide a convenient way for users to view information collected from around the Web in one place.
