RE: blocking Google Desktop

["Sims, Brian (MED US)" <brian.sims () siemens com>]

Upon launching, Google Desktop made several HTTPS connections to both
www.google.com and desktopservices.google.com.   It used IE's proxy
settings - we have an ISA cache/proxy that does integrated auth.  If it
handled NTLM auth, I'm sure it can do basic proxy auth as well.
However, blocking it on the network-level doesn't do a whole lot of good
for corporations with a large mobile population.   They connect
elsewhere (home, client site, hotel, etc.), and your proprietary data is
still making it to Google.

However, note that the current version is GPO-aware, although there does
not appear to be a setting in the template to disable the "Share Across
Computers" functionality.   This may just be because the template hasn't
been updated since the feature was added or the corresponding registry
key published yet.   However, there are settings for preventing the
indexing of file types altogether.   Enable for every file type, and
should pretty much render it non-functional.

-----Original Message-----
From: full-disclosure-bounces () lists grok org uk
[mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of J.
Patterson Wicks
Sent: Friday, February 10, 2006 3:06 PM
To: full-disclosure () lists grok org uk
Subject: RE: [Full-disclosure] blocking Google Desktop

According to several sources on Google,
(http://www.sharp-ideas.net/hacking_google_desktop_search.php ,
http://www.oreillynet.com/pub/a/network/2004/10/14/google_desktop.html
)the Google Desktop application operates on TCP port 4664.  When it
communicates to the outside Google web servers, does it use the same
port or go over port 80 to avoid firewall rules?  The application is
banned in our environment, but you never know.

-----Original Message-----
From: full-disclosure-bounces () lists grok org uk
[mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Michael
Holstein
Sent: Friday, February 10, 2006 2:37 PM
To: full-disclosure () lists grok org uk
Subject: Re: [Full-disclosure] blocking Google Desktop

> I would also venture to say that they should be publicizing
> information for corporations to be able to block this wholesale
> (google desktop and gmail chat), since we all know there are financial
> institutions where people work, and think nothing of saving customer
> data onto laptops.

Agreed. I'm actually working on testing it now, to figure out how to
write snort sigs to (detect) and/or (block) it -- assuming I can't just
blackhole *desktop.google.com on DNS.

I might just block their ads as well (/pagead/iclk? in URLs) out of
spite for them doing this stupid trick with their desktop product.

FWIW, we're sending out notices that this is NOT to be installed on any
University-owned PC, violators get their machine re-imaged.

Cheers,

Michael Holstein CISSP GCIA
Cleveland State University
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

This e-mail is property of Oxygen Media, LLC.  It is intended only for
the person or entity to which it is addressed and may contain
information that is privileged, confidential, or otherwise protected
from disclosure.  Distribution or copying of this e-mail or the
information contained herein by anyone other than the intended recipient
is prohibited.  If you have received this e-mail in error, please
immediately notify us by sending an e-mail to postmaster () oxygen com and
destroy all electronic and paper copies of this e-mail.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

-------------------------------------------------------------------------------
This message and any included attachments are from Siemens Medical Solutions
USA, Inc. and are intended only for the addressee(s). 
The information contained herein may include trade secrets or privileged or
otherwise confidential information.  Unauthorized review, forwarding, printing,
copying, distributing, or using such information is strictly prohibited and may
be unlawful.  If you received this message in error, or have reason to believe
you are not authorized to receive it, please promptly delete this message and
notify the sender by e-mail with a copy to Central.SecurityOffice () shs siemens com

Thank you
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/