Google Website Optimizer & Goo.gl URL Security Issues

There are two different security issues around Google products over the past 12 hours or so. The first is with Google Website Optimizer where there was the potential of an Cross-Site Scripting (XSS) attack. The second is with people using Goo.gl, Google’s URL shortener, within Twitter to grab your Twitter passwords. While the second one, goo.gl is not really a Google issue, the Google Website Optimizer XSS issue is.

Google sent out an email to Google Website Optimizer users saying:

Dear Website Optimiser user,

We are writing to inform you of a potential security issue with Website Optimiser. By exploiting a vulnerability in the Website Optimiser Control Script, an attacker might be able to execute malicious code on your site using a Cross-Site Scripting (XSS) attack. This attack can only take place if a website or browser has already been compromised by a separate attack. While the immediate probability of this attack is low, we urge you to take action to protect your site.

We have fixed the bug, and all new experiments are not susceptible. However, any experiments you are currently running need to be updated to fix the bug on your site. Additionally, if you have any Website Optimiser scripts from paused or stopped experiments created before 3 December 2010, you will need to remove or update that code as well.

There are two ways to update your code. You can either stop current experiments, remove the old scripts and create a new experiment, or you can update the code on your site directly. We strongly recommend creating a new experiment as it is the simpler method.

The email goes on to give specific examples on how to modify your current experiments to make sure you do not have malicious code on your site.

At the end of the email, Google apologized, saying:

We’re committed to keeping Website Optimiser secure, and we’re deeply sorry for this issue. We will continue to work hard to prevent future vulnerabilities.

Yours sincerely, Trevor Google Website Optimiser Team

For more information on this XSS issue, see Dave Naylor’s blog.

On the Google URL shortener issue, Twitter is taking care of it and I don’t believe Google has anything to do with it. TechCrunch has a comment from a Twitter representative that reads, “We’re aware and have sent out password resets for affected users. We’ll monitor the situation in case of further iterations.”

Postscript: Google has a new post on this issue at the Google Website Optimizer bug.

Related Topics: Channel: Content | Google: Security | Google: URL Shortener | Google: Website Optimizer

Sponsored


About The Author: is Search Engine Land's News Editor and owns RustyBrick, a NY based web consulting firm. He also runs Search Engine Roundtable, a popular search blog on very advanced SEM topics. Barry's personal blog is named Cartoon Barry and he can be followed on Twitter here. For more background information on Barry, see his full bio over here.

Connect with the author via: Email | Twitter | Google+ | LinkedIn



SearchCap:

Get all the top search stories emailed daily!  

Share

Other ways to share:
 

Read before commenting! We welcome constructive comments and allow any that meet our common sense criteria. This means being respectful and polite to others. It means providing helpful information that contributes to a story or discussion. It means leaving links only that substantially add further to a discussion. Comments using foul language, being disrespectful to others or otherwise violating what we believe are common sense standards of discussion will be deleted. Comments may also be removed if they are posted from anonymous accounts. You can read more about our comments policy here.

Comments are closed.

Get Our News, Everywhere!

Daily Email:

Follow Search Engine Land on Twitter @sengineland Like Search Engine Land on Facebook Follow Search Engine Land on Google+ Get the Search Engine Land Feed Connect with Search Engine Land on LinkedIn Check out our Tumblr! See us on Pinterest

 
 

Click to watch SMX conference video

Join us at one of our SMX or MarTech events:

United States

Europe

Australia & China

Learn more about: SMX | MarTech


Free Daily Search News Recap!

SearchCap is a once-per-day newsletter update - sign up below and get the news delivered to you!

 


 

Search Engine Land Periodic Table of SEO Success Factors

Get Your Copy
Read The Full SEO Guide