|Main Archive Page > Month Archives > full-disclosure-uk archives|
Google Wave is an online tool for real-time communication and collaboration. A wave can be both a conversation and a document where people can discuss and work together using richly formatted text, photos, videos, maps, and more.
(Product description from Google Website)
All this possible attacks are the result of playing 4 hours with Google Wave. I didn't check all the funny stuff, which is possible with the Wave.
The Google Wave Gadget API can be used for phishing attacks.
An attacker can build his own phishing Gadget, share it with his Google Wave contacts an hopefully get the login credentials from a user.
This behavior is normal. The Problem is, that this "bug" makes it easier to steal logins.
2. Virus spreading attack:
Uploads Files are not scanned for malicious code.
An attacker could upload his malware to a wave and share it to his Google Wave contacts.
Proof of Concept :
A proof of concept gadget can be found here: http://sotiriu.de/demos/phgadget.xml
Disclosure Timeline (YYYY/MM/DD):
2009.11.16: Vulnerability found
2009.11.17: Sent PoC, Advisory, Disclosure policy and planned disclosure
date (2009.12.03) to Vendor
2009.11.23: Vendor response
2009.12.01: Ask for a status update, because the planned release date is
2009.12.03: Google Security Team asks for 2 more week to patch.
2009.12.03: Changed release date to 2009.12.17.
2009.12.15: Ask for a status update, because the planned release date is
2009.12.17. => No Response
2009.12.21: Ask for a status update.
2009.12.29: Google Security Team informs me, that there are no changes
made before 2010.01.03.
2010.01.14: Google Security Team informs me, that uploaded files will be
now scanned for malware. Google Gadgets will be not updated. 2010.01.19: Release of this Advisory