Net exposure Sogou browser security vulnerability sogou response is unclear

On November 5th, a message about "Sogou browser was exposed with obvious loopholes and tens of millions of users’ privacy was leaked in batches" began to spread to major media from the Kafan Forum.

According to the news, after logging in to Sogou browser with qq account, users will be able to find thousands of user names, accounts and passwords of unfamiliar users on many websites. There are inexplicably a lot of web pages in the user’s browser favorites that the user has not stored before. After opening the corresponding favorite web pages, even the browser will automatically fill in the user name and password and conduct electronic transactions directly.

For the first time, browser security vulnerabilities leaked privacy incidents, and sogou urgently needed to give users an explanation.

Some related technicians found files such as "HistoryUrl3_base" and "FormData3.dat" in the local browser of Sogou browser, which could not obtain the corresponding information without using professional software. After the Sogou browser synchronized the user’s stored account password and the webpage in the favorites to the cloud, the synchronized data was synchronized to other users’ computers, resulting in the disclosure of a large number of users’ private data information, which will lead to a large number of users’ property losses in this vulnerability incident.

It is understood that the recent Sogou browser security breach leaked user privacy security incidents for the first time in history, and a large number of user privacy data leaked and distributed incidents caused by browser security breaches. As a historical precedent, the security vulnerability incident of Sogou browser will attract more users’ attention. sogou needs to speed up the process of fixing product vulnerabilities and give users an early account of this matter.

New sogou made a good start. The biggest impact of Sogou browser security incident was sogou search

Since the news that sogou will be acquired by 360 on May 10th this year, it has been more than four months since the news that "Tencent acquired 36.5% shares in sogou" was confirmed, and the acquisition of sogou came to an end temporarily.

On November 3rd, sogou released the unaudited financial report for the third quarter of sogou as of September 30th, 2013. According to the report, the total revenue of New sogou in the first quarter of 2013 (the first quarter after sogou was acquired by Tencent with a 36.5% stake) was US$ 57 million, up 53% year-on-year, which set a good start for the development of New sogou.

And CNZZ, a traffic statistics agency, shows in the report that sogou search occupied 12.06% of the whole domestic search market on October 26th, reaching a new high.

After the browser is the most important Internet portal, Sogou browser, as the first event that a large number of user data are leaked due to browser security vulnerabilities, will not only have a great impact on its own development. As another sogou search business that can get more data from users and is more qualified to be an Internet portal, it will probably change the rapid development of Tencent after its shareholding, resulting in a small-scale share reduction.

Therefore, the security incident of Sogou browser is not only related to the future development of Sogou browser, but also will affect the development of sogou search-based sogou. (According to the vulnerability test of Dagong. com reporter at 11: 40, the security vulnerability of Sogou browser is no longer there.)

Sogou denied that the rumor of browser security vulnerabilities was ugly. "The poster said that the account was stolen."

After the sogou browser security vulnerability incident was widely spread by the media, which attracted the attention of the industry and even the society, sogou announced yesterday that the technical team of sogou browser started to verify the authenticity of the incident as soon as possible after the "sogou browser security vulnerability" incident was reported online, and confirmed that there was no security vulnerability in sogou browser. As for the reasons for this kind of news, sogou said that its strong development momentum made some competitors launch unfair competition in the name of kidnapping users, and especially said that it would not give up protecting the ultimate rights and interests of users by legal means.

Subsequently, at around 20: 31 yesterday, the k53941 user who had previously posted "Sogou browser broke security holes" on the technical forum card meal also posted that the owner of this user ID had not used it for a long time, and this time, the behavior of repeatedly posting multiple Sogou browser vulnerability posts was caused by the hacker after the ID password was stolen.

In this regard, some netizens expressed doubts. Since this user did not log in to this ID number for several months, why did he log in to this account shortly after the security vulnerability of Sogou browser was exposed? Are there still some unknown things behind it? Can this user also expose the login record of his forum account to improve the credibility of his speech?

Previously, on the platform of Black Cloud Vulnerability, many people in the industry and outside the industry have personally witnessed the seriousness of privacy leakage in view of the privacy leakage of sogou Pinyin. At that time, the announcement given by sogou was that Bing, the search engine, did not abide by the agreement of robots.txt, but it did not claim that its team’s means of protecting the privacy of input method was not enough, and more secure verification methods should be used to protect the privacy of input method users. As a heavyweight product in the legendary three-stage rocket of sogou, sogou input method is a leading product in both PC and mobile Internet. After a product with such a huge number of users has privacy loopholes, this response has aroused the dissatisfaction of many sogou input method users, and also provided opportunities for other input method manufacturers to develop users.

This time, regardless of whether there is a security loophole in Sogou browser, we will not consider whether posting claiming that the account was stolen is a way for sogou to refute rumors. After sogou became a shareholder in Tencent, his performance did show a good development trend. In this security vulnerability incident, the third-party vulnerability platform Wuyun and 360 security guards clearly stated that in a certain period of time, the second vulnerability of Sogou browser did exist. No matter whether the vulnerability incident is an oolong incident or not, sogou should give users a more comprehensive and satisfactory explanation, and try not to blindly find ways to excuse themselves. Users know whether there is a vulnerability, and promise to provide users with a better Sogou browser, and promise that sogou can compensate those users who have really suffered economic losses from Sogou browser as long as relevant certification materials are given. Is it a better way to deal with the incident?

Text/Xiao Qian, Weibo Xiao Moqian, WeChat net1996