Blog
May 3, 2010
Malicious Google Gadgets in Action
Malicious Google Gadgets in Action Video – by Offensive Security
1 min read
A new report by emgent shows malicious Google Gadgets in action. The real vulnerability lies in the ability of a malicious user to add their own Gadgets on a separate domain space, without Google’s authorization.
The attack variant shown in the movie can be altered to steal cookies, run arbitrary JavaScript on victim machines, and could be further weaponized to create Malicious Google Gadget worms.
When researching this topic, we found references to similar vulnerabilities which date back to 2007, reported by Tom Stracener and Robert Hansen.
Although the Google infrastructure has changed since 2007, it seems that this new variant of attack is still possible. Emgent’s email to Google over a month ago was unanswered. The solution ? Extra vigilance on your side. Check our demo movie.
Cybersecurity leader resources
Sign up for the Secure Leader and get the latest info on industry trends, resources and best practices for security leaders every other week
Latest from OffSec
Enterprise Security
What is Threat Intelligence?
This article explores threat intelligence, its purpose, types, and how organizations can leverage it to enhance cybersecurity.
Sep 27, 2024
9 min read
Insights
Mental Toughness in Cybersecurity: Preparing Teams for High-Pressure Situations
Mental toughness helps cybersecurity teams improve decision-making, collaboration, and resilience, enabling them to perform under constant pressure.
Sep 20, 2024
7 min read
Enterprise Security
The Role of Leadership in Cultivating a Resilient Cybersecurity Team
Learn about the role that leadership plays in cultivating a resilient cybersecurity team.
Sep 13, 2024
5 min read