Search engine flytrap (dusgusting) patent applied for

A patent search expert has just informed us of a quite abusive patent application filed, the sole purpose thereof is for attracting search engine (read:Google) hits. The patent offices might want to come up with a rule to cancel such fecal matter. The Patent search expert's observation: "Truly disgusting." If you look at this patent you'll see it's designed to be a magnet for hits when using keyword searches. 1376 pages of gibberish. Unless this gets removed many of us are going to be seeing this day after day after day. WO07081519A2: GENIUS ADAPTIVE DESIGN (World Intellectual Property Organization number) 2007-07-19 Abstract: Explore interesting inventions inside, conceived by our genius idea generator. Discover history's most effective method in conceiving novel uses for existing electronic technology. License huge domains of intellectual property from the invention directory our system helped develop. The searcher can find one of our interesting inventions in this patent application via our LicenseItToday.com, etc. Call our California Headquarters 1-707-428-5000. View invention ideas, plus 100+ variations adapted for end user target markets. LicenseItToday.com fills out exclusive international license agreements valid up to December 2026. It saves time and money creative LP. over any other documented creative thinking process. Licensees seek outputted patents using our or their pat attorneys. Royalties can start when profits begin. Or you can buy the affordable I.P. rights. Proof is in trying it out. Discover amazing inventions inside today.

Just when you thought Google Docs were safe...

Just when you thought you were were safe from Google Desktop exploit, An interesting cross-site scripting (XSS) vulnerability found in the Google Spreadsheets service would have allowed attackers to gain unauthorised access to other Google services, including Gmail and Google Docs.

The vulnerability was discovered by security engineer Billy Rios , and takes advantage of nuances in the way Internet Explorer handles Content-Types for webpages.

When a spreadsheet is saved and downloaded in CSV format, the Content-Type is set to "text/plain", thereby instructing the client's browser that the document should be treated as plain text. However, if HTML tags are entered into the first cell of the spreadsheet, Internet Explorer detects these tags near the start of the CSV document and instead deduces that it should be treated as HTML. This essentially allowed arbitrary HTML webpages to be served from spreadsheets.google.com, which in turn allowed JavaScript to be executed in the context of the spreadsheets.google.com site. A remote attacker could exploit this weakness by stealing the user's session cookies and hijacking their session.

Rios points out that Google cookies are valid for all google.com sub domains. This means that when a user logs in to Gmail, the Gmail cookie is also valid for other Google services, such as Google Code, Google Docs, Google Spreadsheets, and more. Cross-site scripting vulnerabilities in any of these sub domains can allow an attacker to hijack a user's session and access other Google services as if they were that user.

Google has fixed the vulnerability discovered by Rios and there have been no reports of the vulnerability being exploited by attackers.

Google Desktop Exploitability

(As I published on Shvoong): It was a matter of time before someone
realized that Google Desktop has provided an opening into a PC through
which a hacker can get an easy entry. Mattan Gillon, an Israeli hacker,
performed an act of public service by exposing the flaw on his blog.

Exploiting a bug in Microsoft Internet Explorer's processing Cascading
Style Sheets (CSS). The CSS format is commonly used to give a Web
site page a consistent look and navigation properties, and attackers can
target the process by which IE
parses CSS while running Google Desktop. Gillon explains how browsers
usually turn off domain crossing. A specific web
page can direct a browser to another domain, though it may not retrieve
the contents of the page nor run any of its objects. This restriction
feature serves to preclude a site owner using JavaScript from spying on
a user. Additionally, if a user is already logged
on to a web service such as Yahoo, Hotmail or Gmail, a malicious web
page could be used to run a malicious operation in the user account.
This operation can be an opening of an email and the subsequent sending
it to a third party. In IE, these security features are easily broken
when the browser encounters a CSS import.

Mattan Gillon called this attack CSSXSS, or Cascading Style Sheets Cross-Site
Scripting. Using the IE browser's weakness of being fooled by curly
brackets strategically placed in a decoy site's code, and getting hold
of Google Desktop's key found in the application code, a hacker can
easily gain an entry into the target PC already running the Google
Desktop service.For this IE weakness to be
exploited, web surfers must first be tricked into visiting a malicious
Web site. They can protect themselves, however, if they turn off Active
Scripting in the IE's Internet Options menu, Gillon says.