vBulletin and Google Web Accelerator security issue

[QuiGonJ]

Just saw this on a Doctor Who board I go to, and it affects anyone using vBulletin board, if not others....


Google are beta testing yet another service, namely the Google Web Accelerator. This application basically caches web sites on Google servers to serve them at a much faster speed.

Unfortunately, it also caches cookie-specific data, which is already presenting numerous problems for people running web sites and forums with individual logins for users. Let's say that Fred Bloggs is a hypothetical registered Outpost Gallifrey member. If he has Web Accelerator installed and doesn't exclude the gallifreyone.com domain from his settings, when he logs into the forums with his ID and password and begins browsing, this information is cached by Google (assuming it hasn't previously been cached). This includes things like private messages.

Let's say Jane Doe is also a registered Outpost Gallifrey Forum member and also has Web Accelerator installed. When she accesses the forums, she's authenticated as a user by Outpost Gallifrey's server, but then Google will decide to cut in and serve up their cached pages (acquired when Fred Bloggs visited). An unfortunate side effect of this is if she decides to browse her private messages, she could instead end up browsing Fred Bloggs' private messages that were cached by Google.

With all this in mind, users running Google Web Accelerator who haven't excluded gallifreyone.com (or whatever site they wish) in their settings should know that pretty much anything they access on the forums (including private messages) is likely to be cached by Google and theoretically served up to someone else. Other users of vBulletin-based forums have been affected, so it's only a matter of time before someone at Outpost Gallifrey notices this happening to them too.

So be careful about using Google Web Accelerator.. that's all I'm sayin. :)

[Dasquian Belargic]

Luckily...Google's Accelerator put on hold http://www.geek.com/news/geeknews/2005May/gee20050512030431.htm



Google has disabled the download of an application offered just one week ago. Web Accelerator (see our previous coverage), a beta application designed to speed up Internet searches, had reached its limit of downloads in less than a week. According to Google, "It is a limited beta, and we reached the capacity of users." There was no warning given, just a message posted on the Web Accelerator webpage:

'Thank you for your interest in Google Web Accelerator. We have currently reached our maximum capacity of users and are actively working to increase the number of users we can support'.

It had been reported that the tool was caching sensitive information that could be accessed later. In Google's words, Accelerator could "receive information such as a person's IP address, computer and connection information, and 'personally identifiable information,' such as an e-mail address." However, Google denied that the reason for putting a hold on Web Accelerator downloads was due to the perceived security risk.

No date was given as to when the downloads would begin again.