Apparently not. Read Google's Response: 2010.01.14: Google Security Team informs me, that uploaded files will be now scanned for malware. Google Gadgets will be not updated.
On Tue, Jan 19, 2010 at 7:11 AM, dramacrat <yirim...@gmail.com> wrote: > This is the stupidest advisory I have read on this list in at least two > months. > > 2010/1/19 NSO Research <nso-resea...@sotiriu.de> > > _________________________________________ >> Security Advisory NSOADV-2010-002 >> _________________________________________ >> _________________________________________ >> >> >> Title: Google Wave Design Bugs >> Severity: Low >> Advisory ID: NSOADV-2010-002 >> Found Date: 16.11.2009 >> Date Reported: 18.11.2009 >> Release Date: 19.01.2010 >> Author: Nikolas Sotiriu (lofi) >> Mail: nso-research at sotiriu.de >> URL: http://sotiriu.de/adv/NSOADV-2010-002.txt >> Vendor: Google (http://www.google.com/) >> Affected Products: Google Wave Preview (Date: =< 14.01.2010) >> Not Affected Component: Google Wave Preview (Date: >= 14.01.2010) >> Remote Exploitable: Yes >> Local Exploitable: No >> Patch Status: partially patched >> Discovered by: Nikolas Sotiriu >> Disclosure Policy: http://sotiriu.de/policy.html >> Thanks to: Thierry Zoller: For the permission to use his >> Policy >> >> >> >> Background: >> =========== >> >> Google Wave is an online tool for real-time communication and >> collaboration. A wave can be both a conversation and a document where >> people can discuss and work together using richly formatted text, >> photos, videos, maps, and more. >> >> (Product description from Google Website) >> >> >> >> Description: >> ============ >> >> All this possible attacks are the result of playing 4 hours with Google >> Wave. I didn't check all the funny stuff, which is possible with the Wave. >> >> >> >> 1. Gadget phishing attack: >> -------------------------- >> >> The Google Wave Gadget API can be used for phishing attacks. >> >> An attacker can build his own phishing Gadget, share it with his Google >> Wave contacts an hopefully get the login credentials from a user. >> >> This behavior is normal. The Problem is, that this "bug" makes it easier >> to steal logins. >> >> >> 2. Virus spreading attack: >> -------------------------- >> >> Uploads Files are not scanned for malicious code. >> >> An attacker could upload his malware to a wave and share it to his >> Google Wave contacts. >> >> >> >> Proof of Concept : >> ================== >> >> A proof of concept gadget can be found here: >> http://sotiriu.de/demos/phgadget.xml >> >> >> >> Solution: >> ========= >> >> 1. No changes made here. >> Workaround: Don't trust Waves. >> >> 2. Google builds in AV scanning. >> >> >> >> Disclosure Timeline (YYYY/MM/DD): >> ================================= >> >> 2009.11.16: Vulnerability found >> 2009.11.17: Sent PoC, Advisory, Disclosure policy and planned disclosure >> date (2009.12.03) to Vendor >> 2009.11.23: Vendor response >> 2009.12.01: Ask for a status update, because the planned release date is >> 2009.12.03. >> 2009.12.03: Google Security Team asks for 2 more week to patch. >> 2009.12.03: Changed release date to 2009.12.17. >> 2009.12.15: Ask for a status update, because the planned release date is >> 2009.12.17. => No Response >> 2009.12.21: Ask for a status update. >> 2009.12.29: Google Security Team informs me, that there are no changes >> made before 2010.01.03. >> 2010.01.14: Google Security Team informs me, that uploaded files will be >> now scanned for malware. Google Gadgets will be not updated. >> 2010.01.19: Release of this Advisory >> >> >> >> >> >> >> >> >> >> >> >> >> _______________________________________________ >> Full-Disclosure - We believe in it. >> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >> Hosted and sponsored by Secunia - http://secunia.com/ >> > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/