Google.com Vulnerability that bypasses anti-virus
- Thread starter wittaj
- Start date
bigredfish
Known around here
Still not exactly sure how the user gets hit?
I don’t use Google, other than a Gmail account I rarely use and gets almost zero mail.
I rarely use chrome except to access my Gmail account
I don’t use any checkout service or wallet
I don’t use Google, other than a Gmail account I rarely use and gets almost zero mail.
I rarely use chrome except to access my Gmail account
I don’t use any checkout service or wallet
lulu5kamz
Known around here
- Sep 14, 2015
- 1,205
- 4,007
Here are details from the security company that discovered this.
cside.dev
Weaponized Google OAuth Triggers Malicious WebSocket
An attacker is using ‘Google.com’ to deliver and execute their own code in a weaponized Google OAuth attack.
cside.dev
bigredfish
Known around here
I'm not seeing that?
Just use Google to search and BAM your infected?
I dont think its that simple
*Note I dont use Google at all. I use Bing for search. I avoid Google like the plague
I would think if you use the google search and then CLICK on the search results. I search for ipcamtalk, it gives me ipcamtalk.com but the virus is injected into that clickable search result.
Kind of a man in the middle attack.
Kind of a man in the middle attack.
bigredfish
Known around here
It could happen to any search engine or any site really.
I alluded to this in this thread where someone was so worked up about the Dahua plug-in and I suggested that they are uncomfortable with that yet blindly accept hitting in a login button that could be compromised and why we shouldn't let our cameras on our network. I said in that thread:
"How do we know that by typing in your username and password and hitting the "login" button that you are not behind the scenes granting that firmware access to an exploited vulnerability of the web browser or blindly allowing it to bypass anti-virus software and infect your computer, similar to mistakenly hitting a malware link on a legit website that infects your computer. Hitting that login or Save or Refresh button could be the same as clicking on an ad on a porno site that infects your computer."
This vulnerability is even worse than I suggested in that it can be generated just be which search engine someone uses and won't be long before someone figures out a way to exploit typing in a website directly instead of using a search engine.
Sometimes even the best precautions can still be exploited.