Sep
29
2010

Google Instant Expands – Adds Keyboard Navigation

Google Instant is expanding. The company has just announced new features and wider availability of the search-as-you-type feature.

Let’s start with the latter; Google says Instant is expanding in two ways:

Google Instant On Vertical Search Properties: In addition to being available on Google.com searches, Instant Search is now functioning on “many” of the vertical search options in Google’s left navigation column, like Videos, News, and Blogs.

Google Instant In New Countries: Instant Search is now available to signed-in users in 12 new countries: Austria, Belgium, Canada, Czech Republic, Ireland, Mexico, Netherlands, Poland, Slovakia, Slovenia, Switzerland and Ukraine.

Finally, when using Google Instant, there are new keyboard navigation options. You can use the up and down arrows on your keyboard to navigate through the search suggestions (pretty sure that’s always been the case) and through the search results, too. This video shows how it works.

Sep
21
2010

Twitter Hacked – onMouseover Bug

XSS (Cross Site Scripting) vulnerability hits twitter.com.

The flaw used simple JavaScript function to call onMouseOver which created an event when the mouse is passed over an area of text. The user was then redirected to a third party site without the users consent.

Twitter’s @safety account tweeted Tuesday morning, “We’ve identified and are patching a XSS attack; as always, please message @safety if you have info regarding such an exploit.”

As of 10:00AM EST twitter issued this statement “This should now be fully patched and is no longer exploitable.”

Mashable estimates that the security flaw “has been widely exploited on thousands of Twitter accounts.”  TechCrunch reports the onMouseover exploit may have spread to as many as 40,000 tweets in just 10 minutes.

Have you seen it? How has it affected you? Let us know below.

Sep
14
2010

Stack-based buffer overflow – Adobe Reader and Acrobat 9.3.4

A Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.3.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart Independent Glyphlets (SING) table in a TTF font.

This still unpatched vulnerability is actively being exploited in the wild. Exploits do not require JavaScript to be enabled within Adobe Reader and do not require write access to any directory.  Confirmed exploits against Adobe Reader 9.1.0, 9.3.0, 9.3.4 running on Windows XP, Windows Vista and Windows 7 have been reported.

Here is the exploit code in the PDF that’s circulating in the wild:

Shell Code for CVE-2010-2883

A Metasploit module is included in the most recent version. Adobe claims to be working on a fix, lets see how long…

Sep
08
2010

Tracking Google Instant Partial Queries in Google Analytics

My previous post describes Google Instant and the new search results user interface. Now that folks have had several hours to play certain realizations begin to set in. What does this mean for Search Engine Optimization? What does this mean for my traffic?

All good questions in this post I will address the first question which came to my mind. What about Analytics? How do I track Google Instant partial queries? Now that Google is presenting real time or instant results, there is a high chance that the query string that gets passed to Google Analytics is incomplete or rather partial because the link was displayed before the user even completed typing the query!

For example an instant query result for “weather” may only be passing along “w” as the query parameter to Analytics since Google displays the link to weather after just typing “w”. To understand what a user needed to type to find the result they were looking for an additional parameter is being used in the result set. The parameter is “oq=” which will give you the information you are looking for.

To track Partial Queries, and their position in Google Instant, you will need to create a new profile along with a new filter in your Google Analytics Report. It is pretty straight forward; below is a sample filter you can use to start tracking.

  1. Create a new Filter name: “New Instant Ranking Filter”
  2. Set Filter type: “Custom filter – Advanced”
  3. Field A -> Extract A: Referral, ^https?://www\.google\.(co.uk|com)/(?!custom|m/).*[?#&]cd=([^&]+).*&q=([^&]+).*&oq=([^&]+)
  4. Field B -> Extract B: Medium:^organic$
  5. Output To -> User Defined: $A5 (position: $A3)

You may have to play a little with the filter for you specific requirement but this should give you a good start.

Let me know if you have any other suggestion or comments.

Sep
08
2010

Google Instant – New Search Enhancement

Google LogoThe big anticipated announcement from Google this morning is “Google Instant”.

Google is moving away from the traditional HTML based results to a more robust AJAX based application for delivering ‘real’ time search results. Marissa Mayer noted that Google has already made approximately 500 changes to search ranking and user interface (UI) in 2010.

It takes a user on average 9 seconds to enter a search query followed by a few hundred milliseconds on Google’s Servers to render a search result. The user then averages about 15 seconds looking at the results. Google Instant claims to save user 2-5 seconds per query, which in turn will save 11 aggregate hours per second.

Google will display characters in black that they have typed followed by shifting grey predicted characters as the user continues to type. Why even keep the search button at this point? Well it forces Google to search for exactly what you’ve typed, without predicting how you’ll finish that search.

Instant will begin rolling out to Google domains in the US, UK, France, Germany, Italy, Spain and Russia who use the following browsers: Chrome v5/6, Firefox v3, Safari v5 for Mac and Internet Explorer v8.

For more information from Google you can visit their brief description over at:

 http://www.google.com/instant