Google Public Service Search Makes for Easy Phishing

lisah writes "According to reports at NewsForge this morning, Developer Eric Farraro has discovered a potential hole in Google's Public Search Service that may leave the door wide open for phishing scams. The Public Search Service, designed to allow universities and other non-profit institutions to add Google search capabilities to their websites, provides code that allows website developers to customize the header and footer of the search results page. Handy (and malicious) coders can manipulate the headers and footers to create what looks like a Google sign-in page and then collect the login names and passwords of unsuspecting users." NewsForge and Slashdot are both owned by OSTG.

Re:Not a google issue...

[Anonymous Coward]

It sure is. The header and footer are hosted at google. So the malicious javascript that clears the innerHTML of the page can then be set to look like a different google login prompt, or anything for that matter, and the form data captured and posted to anywhere. Basicaly, it's an issue because the javascript to do the harm exists at google, because the offender can put it there. Google needs to make it so javascript cannot be used in the footer and header that is customized. Quite simple to fix really.

Bottom line, quote: "avoid providing your Google credentials to any Google services with the /u/servicename construction."

Original post

[Infinityis]

Original post [ericfarraro.com]
Site in question [google.com]

It looks like the page has been replaced with a message warning about viruses and spyware. I looked at the page earlier (from Reddit.com) and the login page looked very legit--scary indeed.
If you put in a username and password, he didn't store it but he echoed it back to your browser. Even though he didn't store it, my concern was that the password was still being transmitted via plaintext...

Re:Article notes...

[russ1337]

So how is their exploit any different from a sysadmin changing the DNS table on his server and presenting a page to the internal network that 'looks like google' and even has 'www.google.com/ig' (or a bank, ebay etc)? Isnt this why we have 'trusted websites/verisign etc... ?