Researchers extend Firesheep to exploit Google Search data leak !!!!

[INDRANIL]

A pair of security researchers have created their own version of the notorious Firesheep plugin to expose a data leak in the world's favourite search engine.

The proof-of-concept plugin exploits the use of unencrypted cookies by Google's Web History feature.

Although you need to be logged in to make use of Web History it does not require an encrypted (HTTPS) connection. This flaw can allow attackers to find out what you've been searching for, who your social contacts are and who's in your Gmail address book.

The new variant of Firesheep allows hackers to easily exploit the flaw if they are sharing the same WiFi hotspot as you.

For researchers Vincent Toubiana and Vincent Verdot the choice to adapt Firesheep must have been obvious. The original Firesheep was released last October by a security researcher fed up with what he saw as the failure of big websites such as Twitter and Facebook to protect their users. Whilst his efforts weren't greeted with a chorus of approval they do appear to have had the desired effect.

The good news is that this latest exploit does not allow attackers to take over users' Google Accounts. However, it does expose private data. In the researchers' own words:

"while the direct access to users’ data is subject to a strict security policy, using personalized services (which may leak this same personal information) is not"

Anyone thinking that search histories are innocuous need only cast their mind back to 2006.The supposedly anonymised searches included names, addresses and social security numbers amongst other things. In some cases users' search histories built up to create mosaic-like pictures of their lives.

P.S - If you don't use Web Search History or you've never heard of it you may want to visit your search history page and disable it. Stay safe .

More & Source .

[Raymond]

I disabled Google Web Search History long ago when I found out there is such thing.
It's pretty scary looking back at what you search, and Google keeping a copy of that.

[hellnoire]

And people wonder why I use Scroogle...

[linked]

And people wonder why I use Scroogle...

Exactly! Scroogle is the best!

I don't understand how people can feel comfortable by keeping all their search histories with Google. I have disabled it when Google started implementing it.

[hellnoire]

Exactly! Scroogle is the best!

I don't understand how people can feel comfortable by keeping all their search histories with Google. I have disabled it when Google started implementing it.

Only thing I use Google for these days is Google Maps. And even then, that's under proxy and using a close location but not my exact one.

I prefer to keep my private thoughts private. If Google can't respect that, well, goodbye Google, there are other fish out there.