Just one day after a security researcher showed how Google's Firefox toolbar could be exploited in an online attack, a similar flaw has been discovered in the Google Desktop.
Google hacker Robert Hansen has posted proof of concept details showing how attackers could use Google Desktop to launch software that had already been installed on the victim's computer.
The attack is hard to pull off and could not necessarily be used to install unauthorised software on the victim's PC, but it does illustrate the kind of security issues that arise with web-based applications, said Hansen, who is chief executive of web security consultancy Sectheory.com, and a contributor to the Ha.ckers.org website.
"When you have third parties writing code that interacts with your browser, it inherently breaks the browser security model," he said.
To exploit Hansen's Google Desktop vulnerability, an attacker would first have to launch a successful "man-in-the-middle" attack, somehow placing himself between the victim and Google's servers. This could by done by tricking the victim into logging onto a malicious wireless network, Hansen said.
The steps Hansen took to pull off the attack are complex because of the security features that Google has built into its software, he added. "What I've done is combine a lot of different attacks that Google desperately tries to prevent."
On Wednesday researcher Christopher Soghoian showed how a man-in-the-middle attack could be used to install malicious software on computers that used a variety of popular Firefox add-ons, including the toolbars from Google, Yahoo, and AOL.
Hansen has posted a video showing how this attack could be used to launch Windows HyperTerminal. But it could be used to launch virtually any application that has already been installed on the PC, he said.
This is not the first bug in Google Desktop. In February, engineers at Watchfire showed how a flaw in the programme's Advanced Search Feature could be used to gain access to data or even run unauthorised software on a victim's computer.
Two days after the Watchfire bug was disclosed, Hansen himself showed how attackers could steal information from Google Desktop users using what is called an anti-DNS (Domain Name System) pinning attack.
Google was not immediately available to comment for this story.