Google has closed a security hole in its newly launched Chinese language Input Method Editor (IME) software, Pinyin, after Internet Security firm, Rising, announced that the software brings potential risks to Windows Vista users.

Google launched Pinyin IME software, on Wednesday, which enables the user to enter Chinese characters by typing their Pinyin equivalents on a standard QWERTY keyboard where the software uses the input to draws on a dictionary of words and names to anticipate which characters the user may be looking for, and proposes possible matches.

On Friday, Rising said Google’s Pinyin IME presented serious security threat to Microsoft Windows Vista users.

The company warned Vista users not to use the software until Microsoft launches a patch or Google releases a more reliable version, as hackers could exploit a flaw to take control of a user’s computers. However, Windows XP, Windows 2000 and Windows 98 users can use the software, Rising said.

Google spokeswoman Cui Jin in an e-mail responded and said “We had found this problem and have solved it during the product upgrade on Friday.”

Even if Google has closed its software security hole, Rising said Microsoft also bears responsibility for the vulnerability, noting that software released by other companies could recreate the same vulnerability.

Microsoft said it hasn’t received any reports on the loophole while the timetable for releasing the patch was not available.

This development came amidst question over the origins of a dictionary used on Google’s Pinyin IME, as users of this application have reported that the software features many similarities to the dictionary used by Sohu’s Sogou search engine.

The similarities between the two dictionaries prompted Sohu to send a letter to Google’s Beijing office, giving the company three days to stop downloads of the software, issue an apology, and discuss compensation.

Wang Xiaochuan, Sohu’s vice president of technology and head of the company’s research and development center said “We were surprised to find that Google was using Sohu’s dictionary. We have never made this dictionary public or licensed anybody to use it.”

Cui did not mention any response about Sohu’s letter.

However, Google acknowledged on Sunday that their IME software was developed using a “non-Google database”, but stopped short of saying where the database came from.

---

Related:

Microsoft: Ignore Google in Vista antitrust case

Google says Vista’s built-in search violates Government rulings

Apple sneaks MobileMe app to Windows XP and Vista users

Software for securely deleting files in Vista

Microsoft cuts price of Vista in China

Entry was posted on Sunday, April 8th, 2007 at 11:42 pm under Security, Vista.  Print This Post

Read more entries by Ruben Francia.