We hope you have online protection against unclassified malware download because what we are about to inform you is shocking. Google’s market dominance in terms of reach is surely impressive and let’s face it; majority of the world uses Google. But, what was to happen if you were to discover that the only reliable source for most of your information is affected with a bug?
British security researcher, Aidan Woods discovered an issue on Google’s login page that allows clever attackers to automatically download files on the user’s computer when he presses the Sign In button.
The problem is believed to be occurring because Google allows the “continue=[link]” as a parameter in the login page URL that tells the Google server where to redirect the user after authenticating. Google has anticipated that this parameter might cause security issues and has limited its usage only to google.com domains.
However, Woods figured that this would lead drive.google.com or docs.google.com links to get easily passed as valid ‘continue’ parameters inside the login URL. A clever attacker could easily upload malware like this and users who receive such a link would most likely be tricked into thinking it’s the real Google login URL.
Woods says that he attempted to notify Google's security team about the issue, but they closed all of his three bug reports he opened to let them know about the bug.
