Google search cache spawns SSL fear

It's proving tougher than anticipated to protect SSL VPNs from the voracious caching machine housed inside Google Desktop Search.

The search tool, which is in beta, still manages to store and leave in the open certain SSL VPN data despite the best efforts of tools to curb the search engine's activity.

Customers are concerned that SSL VPN data might be cached and indexed by Google Desktop Search on a machine that is out of corporate control, such as an employee's home PC or one borrowed by an employee visiting a business associate. "It would be a horrible thing to think that there was a trail being left behind of what went on in what we regarded as secure SSL VPNs," says Jim Abshire, manager of operations and systems development at Herr Foods in Nottingham, Pa., which uses Netilla SSL VPN gear.

To address concerns, for instance, SSL VPN vendors that sell versions of Sygate's Virtual Desktop software touted it as a way to quarantine and encrypt SSL VPN sessions. But they discovered during tests with Network World last week that Google Desktop Search could still grab the content of Word documents and cache it in readable form.

Since then, Sygate says it has developed a fix for the bug that it plans to distribute tomorrow. It also has sought the help of Google to create a foolproof way for SSL VPN sessions to vanish from hard drives without a trace. Google says it is considering the request.

Sygate says solving the problem is important. "This is our No. 1 priority. We're not working on anything else," says Gargi Mitra, a senior product manager.

Versions of Sygate's Virtual Desktop are sold by SSL VPN vendors Array Networks, Aventail, Juniper and Netilla, which together accounted for more than 67% of all SSL VPN gateways sold last year, according to In-Stat MDR.

While it seems Sygate has shored up its defenses against Google's relentless caching, other similar search software might yet prove troublesome to Virtual Desktop, according to Joel Snyder, senior partner of Opus One and a member of Network World's Lab alliance. The problem is that these search engines can hook directly into applications to cache their activity. If the Virtual Desktop doesn't recognize these hooks, the search tools can avoid Virtual Desktop encryption. "The next application to come along that hooks Internet Explorer or Word or whatever will have the same issue," he says.

Other desktop search tools are made by Blinkx, Copernic Technologies, ISYS Search Software and X1 Technologies. Yahoo and Microsoft are working on their own versions.