Google Blogoscoped

Forum

Injecting spam into Google Web History via I'm Feeling Lucky queries

/pd [PersonRank 10]

Saturday, April 19, 2008
16 years ago4,131 views

I got this off FD list. not sure if attacks vectors are confirmed.
Reproducing full thread content.. (As FD URL sometimes change!)

Google Web History is vulnerable to a CSRF-like attack that allows an
attacker to inject some entries into the user's search history. If you
are logged in to your Google account and have Web History enabled,
clicking on a malicious link will result in a Google search being
logged to your search history without your consent.

The malicious link can look something like this: <a
href="http://www.google.com/search?q=ENLARGE+YOUR+WHATEVER+NOW+uniquePageId+site:example.com&amp;btnI=I'm+Feeling+Lucky">
compelling vista exploits, free beer and cat pictures</a>

It will perform an I'm Feeling Lucky search on your behalf that will
immediately redirect you to a specific example.com page prepared by
the attacker in advance. For the attack to work, the page should be
indexed by Google and should match the query keywords ("enlarge",
"your" and so on). To ensure that the link always leads to a specific
page, the attacker can include the same unique word ("uniquePageId")
in the text of the destination page and in the search query. Besides
these requirements, the destination page can have any content.

To spam you with numerous Web History entries the attacker needs to
vary the search queries embedded into his links.

References

* Google Web History <https://www.google.com/history/>
* About I'm Feeling Lucky <http://www.google.com/help/features.html#lucky>

Via [Alexander Konovalenko]

[correct spelling mistake in title – /pd]

Forum home

Advertisement

 
Blog  |  Forum     more >> Archive | Feed | Google's blogs | About
Advertisement

 

This site unofficially covers Google™ and more with some rights reserved. Join our forum!