* The implications of Google Desktop Search to your SSL remote access system
Google Desktop Search is a great tool for finding stuff on a PC, but it can also be a threat to SSL remote access security.
The search tool doesn’t have any known exploitable vulnerabilities, but it creates a separate database of material that PCs gather during SSL remote access sessions. Conventional cache-cleaning agents used by many SSL remote access vendors can’t purge this data without purging the entire Google Desktop Search indexed store.
Here are the implications: A remote access user could connect to an SSL remote access box, do some corporate business and logoff knowing that the SSL gear wiped clean all the temporary files, cookies, e-mails, documents, etc., that were stored during the session. Then someone else could come along, logon to the same machine, use the Google tool to search for records of the session and find them because they were stored separately in a cache that the cache-cleaner didn’t wipe out.
One of the benefits of SSL remote access gear is that virtually any PC can be used to access the corporate network, giving remote users the flexibility to use their home PC, a borrowed PC or one in an Internet kiosk or hotel lobby. As more and more people adopt the handy Google Desktop Search tool, the fewer machines can be wiped clean after SSL sessions. This will reduce the flexibility that is a big attraction of SSL.
This problem can be dealt with. Whale Communications, for instance, has a patch that lets customers check whether remote PCs are running Google Desktop Search before allowing them to connect. If they are running it, or if they refuse to allow inspection to determine whether they are running it, the Whale gear can deny access altogether or restrict it to data that isn’t sensitive.
Aventail says its Aventail Secure Desktop, a virtual desktop created for SSL remote sessions and then destroyed when the session ends, prevents Google Desktop Search from storing data from the sessions. The exception is what URLs were accessed.
Other vendors will no doubt follow suit. Google says it has not addressed the problem yet, and a spokesman was unsure whether that was on the product’s roadmap.
