Hackers and security experts made public a vulnerability in Google's search appliances that is putting hundreds of major organizations such as the U.S. Food and Drug Administration, Stanford University and the National Hockey League open to phishing attacks.
The fault exposes websites that use Google Search Appliance and Google Mini devices.
It is a cross-site scripting (XSS) error in the systems' Unicode Transformation Format (UTF) character encoding that makes it likely for hackers to create nasty links that appear to point to trusted sites.
First discovered on a hacker website and reported by an anonymous researcher known as Maluc, the flaw makes it easy to generate credible and significant phishing attacks.
John Herron, who runs NIST.org, reported the issue to US-CERT (U.S. Computer Emergency Readiness Team), which told Google of the problem.
Google replied that it released a fix on Monday, but only a few of those exposed have used the workaround.
Organizations that use either appliance are highly encouraged to contact Google if they have not yet heard from the company.
