Google imperfection adds brand spoofing hole to Web sites

A security flaw in Google's search appliances could expose Web sites that use the products to information-stealing and brand spoofing attacks.

The Google Search Appliance and Google Mini are used by organizations including banks and universities to add search features to Web sites. A flaw in the way the systems handle certain characters makes it possible to craft a Web link that looks like it points to a trusted site, but when clicked serves up content from a third, potentially malicious site.

Web site owners must be diligent about finding and fixing vulnerabilities, (since) even products supplied by well-known brands possess these extremely common issues. The vulnerability provides cyber crooks a hook for phishing attacks, scams that try to trick people into giving up sensitive information such as credit card data and Social Security numbers. Brand Spoofing scams typically use spam e-mail with a link to a fraudulent Web site.