The ICC Profile TagData Overflow attack from Google
Question to Google
To: Google (via web form)
From: google@g***wyrd.com
Subject: ICC Profile TagData Overflow attack from cdp.google.com(64.233.183.89)
Date: Sat, 17 Sep 2005 17:33:35 -0000
Hi there,
Norton 2005 thinks its blocked an attack from a Google IP address. I was looking at my LiveJournal friends page which contains the Googleblog and the latest posts from Google Earth. Machine also runs Google toolbar, accelerator, desktop 2, google talk and Google deskbar. What can I say!
I'm a fan boy.
Here are the details:
Details: Attempted Intrusion "ICC Profile TagData Overflow" against your machine was detected and blocked.
Intruder: cdp.google.com(64.233.183.89)(http(80)).
Risk Level: High.
Protocol: TCP.
Attacked IP: localhost.
Attacked Port: 2495.
You can get detailed information about this attack at Symantec Security Response.
--
Details: Intrusion detected and blocked. All communication with
cdp.google.com(64.233.183.89) will be blocked for 30 minutes.
You can get detailed information about this attack at Symantec Security Response.
Google's reply
From: help@g**gle.com
Sent: 23 September 2005 18:53
To: google@g***wyrd.com
Subject: Re: [#34060645] ICC Profile TagData Overflow attack from cdp.google.com(64.233.183.89)
Thank you for your note. The URL you've referenced is related to the Google Web Accelerator. If your machine received this request, it was likely related to an auto-update attempt to a newer version:
http://webaccelerator.google.com/support.html#using2
If we may be of further assistance please let us know.
Regards,
The Google Team