Pete Finnigan's Oracle Security Weblog

I just found Bruce’s recent weblog entry entitled "Desktop Google Finds Holes" which I found interesting because of my recent thoughts on Information disclosure and leakage in the blog entries An interesting case of information disclosure,An interesting example of information leakage posted to my blog entry and also my own thoughts on google hacking - Information leakage and goole hacking.

Bruce’s new article is very interesting and is based on the new google desktop search (GDS) being able to find security issues in your own desktop computer or at least the computer you install it on. The beta GDA allows you to index your own computer with googles search technology. Bruce points out though that this indexing and searching can cause you to index files you might not want to be indexed such as bank details or private emails or even cached versions of encrypted documents (they are decrypted in the cache). Bruce points out that these are not issues with GDS but with the software that leaves the data lying about.

This is a very good article with a simple message, GDS is not the issue, it simply exposes security issues in other software that are already there. This is worth reading for the Oracle security interested person, for a start its a very good insight into how security impacts other simple software ideas such as searching and it also highlights the issues of critical data that is left lying around in caches, temp files and whatever... there are Oracle analogies, export files, redo logs, archive logs, ad-hoc report output, decrypted data read and spooled to list files.....