Oops… Google in now-fixed anti-phishing gaffe

by Alex Zaharov-Reutt

Wednesday, 24 January 2007

Phishers wanting access to confidential usernames and passwords only needed to visit Google’s anti-phishing blacklist to find relevant information, with honors going to Finjan for discovering the error.

If there’s one company we love to see getting things right, it’s Google, but even they sometimes slip up.

Finjan, an vendor of security services, discovered on January 3, 2007 that “a list of URLs was available and unprotected on Google’s servers and immediately informed Google, which acknowledged receipt of Finjan’s alert about the vulnerability”, with a screenshot from Finjan available so you can see the blacked out areas where confidential user information was originally clearly visible.

This list was available to anyone who wanted to see it, and with many Internet users using the same username and password for all of their accounts, the potential for identity fraud and theft was very real, although no longer following Google’s action to fix the problem.

Finjan blamed Google’s anti-phishing browser extension, but have now reported Google acknowledging both the issue and that the problem has now been resolved by stripping out user information, with Google also claiming to have already notified all affected users. Follow up checks by Finjan confirm that “there is no data leakage on the current Google anti-phishing blacklist.”

According the Yuval Ben-Itzhak, Finjan’s CTO, “Finjan became aware of the problem after examining a publicly available list of URLs provided from Google’s servers. After examining the data provided in these files, Finjan found that sensitive user information was available on the web with no access protection, including emails, usernames, passwords and session tokens that could be used by hackers to compromise users’ privacy.”

Finjan offers a series of common sense tips for home and corporate users to protect themselves from phishing attack, including not sharing your browser, using a range of passwords at different sites, use up-to-date anti-spyware software, and while they don't specifically mention it, consider using an anti-phishing program such as TrustDefender.

Corporate users are advised to upgrade their web security software and practices.

One thing’s for sure: the problem of phishing attacks, pharming attacks and attacks on other vulnerabilities is going to get a lot worse before it gets better. Do whatever you can to make sure you’ve made your computer as bulletproof as possible with a 2007 Internet Security suite, use password generation and storage software such as Roboform, use good anti-phishing software and above all… surf safely!
{moscomment}

Please enable JavaScript in your browser to post your comment!