I spy your PC: Researchers find new ways to steal data

Researchers have developed two new techniques for stealing data from computers that use some unlikely hacking tools: cameras and telescopes.

In two separate pieces of research, teams at the University of California, Santa Barbara, and Saarland University in Saarbrucken, Germany, describe attacks that seem ripped from the pages of spy novels. In Saarbrucken, the researchers have read computer screens from their tiny reflections on everyday objects such as glasses, teapots and even the human eye. The Santa Barbara team has worked out a way to analyze a video of hands typing on a keyboard in order to guess what was being written.

Computer security research tends to focus on the software and hardware inside the PC, but this kind of "side-channel" research, which dates back at least 45 years, looks at the physical environment. Side-channel work in the U.S. was kicked off in 1962 when the National Security Agency discovered strange surveillance equipment in the concrete ceiling of a U.S. Department of State communications room in Japan and began studying how radiation emitted by communication components could be intercepted.

Much of this work has been top secret, such as the NSA's Tempest program. But side-channel hacking has been in the public eye too.

In fact, if you've seen the movie Sneakers, then the University of California's work will have a familiar ring. That's because a minor plot point in this 1992 Robert Redford film about a group of security geeks was the inspiration for their work.

In the movie, Redford's character, Marty Bishop, tries to steal a password by watching video of his victim, mathematician Gunter Janek, as he enters his password into a computer. "Oh, this is good," Redford says, "He's going to type in his password, and we're going to get a clear shot"
Redford's character never does get his password, but the UC researchers' Clear Shot tool may give others a fighting chance, according to Marco Cova, a graduate student at the school.

Clear Shot can analyze video of hand movements on a computer keyboard and transcribe them into text. It's far from perfect -- Cova says the software is accurate about 40% of the time -- but it's good enough for someone to get the gist of what was being typed.

The software also suggests alternative words that may have been typed, and more often than not, the real word is in the top five suggestions provided by Clear Shot, Cova said.

Clear Shot works with an everyday webcam, but the Saarland University team has taken thing up a notch, training telescopes on a variety of targets that just might happen to catch a computer monitor's reflection: teapots, glasses, bottles, spoons and even the human eye.

The researchers came up with this idea during a lunchtime walk about nine months ago, said Michael Backes, a professor at Saarland's computer science department. Noticing that there were a lot of computers to be seen in campus windows, the researchers got to thinking. "It started as a fun project," he said. "We thought it would be kind of cute if we could look at what these people are working on."

It turned out that they could get some amazingly clear pictures. All it took was a $500 telescope trained on a reflective object in front of the monitor. For example, a teapot yielded readable images of 12-point Word documents from a distance of 5 meters (16 feet). From 10 meters, the researchers were able to read 18-point fonts. With a $27,500 Dobson telescope, they could get the same quality of images at 30 meters.

Backes said he has already demonstrated his work for a government agency, one that he declined to name. "It was convincing to these people," he said.

That's because even though the reflections are tiny, the images are much clearer than people expect. Often, first-time viewers think they're looking at the computer screen itself rather than a reflection, Backes said.

One of his favorite targets is a round teapot. Looking at a spoon or a pair of glasses, you might not get a good view of the monitor, but a spherical teapot makes a perfect target. "If you place a sphere close by, you will always see the monitor," he said. "This helps; you don't have to be lucky."

The Saarland researchers are now working out new image-analysis algorithms and training astronomical cameras on their subjects in hopes of getting better images from even more difficult surfaces such as the human eye. They've even aimed their telescopes and cameras at a white wall and have picked up readable reflections from a monitor 2 meters from the wall.

Does Backes think that we should really be concerned about this kind of high-tech snooping? Maybe, just because it's so cheap and easy to do. He said he could see some people shelling out the $500 for a telescope just to try it out on their neighbors.

So how to protect yourself from the telescopic snooper? Easy. "Closing your curtains is maybe the best thing you can do," he said.

Mass SQL injection attack hits Chinese Web sites

The attack has implanted malware on thousands of Web sites

Web sites across China and Taiwan are being hit by a mass SQL injection attack that has implanted malware in thousands of Web sites, according to a security company in Taiwan.

First detected on May 13, the attack is coming from a server farm inside China, which has made no effort to hide its IP addresses, said Wayne Huang, CEO of Armorize Technologies Inc. in Taipei.

"The attack is ongoing," Huang said. "Even if they can't successfully insert malware, they're killing lots of Web sites right now, because they're just brute-forcing every attack surface with SQL injection, and hence causing lots of permanent changes to the victim Web sites."

In a SQL injection attack, an attacker attempts to exploit vulnerabilities in custom Web applications by entering SQL code in an entry field, such as a log-in. If successful, such an attack can give the attacker access to data on the database used by the application and the ability to run malicious code on the Web site.

A screenshot of a Web site belonging to the Mackay Memorial Hospital in Hsinchu, Taiwan, showed that the rendering of the site had been affected and displayed the SQL string injected by the attack, Huang said.

Thousands of Web sites have been hit by the attack, he said, noting that 10,000 servers alone were infected by malware on Friday. Most of the affected servers are in China, while some are located in Taiwan, Huang said. The attackers appear to be using automated queries to Google Inc.'s search engine to identify Web sites vulnerable to the attack, he said.

Among the sites hit by the attack on Friday were SouFun.com, a real estate Web site, and Mycar168.com, a site for automobile enthusiasts. Mass SQL injection attacks have increasingly become a security threat. In January, tens of thousands of PCs were infected by an automated SQL injection attack. That attack exploited a vulnerability in Microsoft Corp.'s SQL Server.

The attackers in the more recent outbreak aren't targeting a specific vulnerability. Instead, they are using an automated SQL injection attack engine that is tailored to attack Web sites using SQL Server, Huang said. The attack uses SQL injection to infect targeted Web sites with malware, which in turn exploits vulnerabilities in the browsers of those who visit the Web sites, he said, calling the attack "very well designed."

The malware injected by the attack comes from 1,000 different servers and targets 10 vulnerabilities in Internet Explorer and related plug-ins that are popular in Asia, Huang said.

The vulnerabilities are MS06-014 (CVE-2006-0003), MS07-017 (CVE-2007-1765), RealPlayer IERPCtl.IERPCtl.1 (CVE-2007-5601), GLCHAT.GLChatCtrl.1 (CVE-2007-5722), MPS.StormPlayer.1 (CVE-2007-4816), QvodInsert.QvodCtrl.1, DPClient.Vod (CVE-2007-6144), BaiduBar.Tool.1 (CVE-2007-4105), VML Exploit (CVE-2006-4868) and PPStream (CVE-2007-4748).

New attack trend pushes POS encryption to the fore

Vendors offer new tools to try to help retailers stop data-in-transit thefts

The relatively scant attention that retailers have paid to securing their point-of-sale systems over the past few years is making the POS setups increasingly attractive targets for cybercrooks who are looking to steal payment card data.

Hoping to help merchants address that situation are a handful of vendors who have begun offering new products aimed at making POS environments a lot harder to crack.

The biggest of those vendors is VeriFone Holdings Inc., which last month released a security tool designed to let merchants encrypt credit and debit card data from the moment a card is swiped at a merchant's PIN entry device all the way to the systems of the company's external payment processor.

VeriFone's VeriShield Protect software is based on patented technology from Semtek Innovative Solutions Corp., which makes appliances for securely decrypting data. VeriFone said that Semtek's technology, called the Hidden Triple Data Encryption Standard, can be used to encrypt personal account numbers and the so-called Track 2 data stored on the magnetic stripe located on the back of payment cards. That information includes card numbers and their expiration dates.

A key feature in VeriShield Protect is that it encrypts payment card data in such a way that the information will still be recognizable as valid card data by other POS applications, said Jeff Wakefield, vice president of marketing at VeriFone. As a result, merchants won't need to tweak or modify their POS systems in any way to accommodate the encryption technology, he claimed. But at the same time, encrypting the card data will render it totally useless to anyone who steals the information, Wakefield said.

A separate device — which could be installed by either a retailer or its payment processor — then would be used to decrypt the data before transactions are processed.Merchants using newer models of VeriFone's PIN entry devices can have the encryption function "injected" into them for less than $50 per device in license and service fees, Wakefield said. He added that the vendor doesn't have a published list price for new PIN devices that support the technology, because per-device prices can vary depending on the individual installation.

Meanwhile, the decryption appliances, which are made by Semtek and sold by VeriFone, can cost from $50,000 to upward of a million dollars for high-throughput, fully redundant systems. Larger retailers that want to exercise direct control over all aspects of their payment card transaction process might invest in such systems themselves, Wakefield said. But, he added, most small and midsize merchants will likely look to their payment processors to handle the decryption component.

Another company targeting the POS security market is Merchant Warehouse, a credit card processing firm that provides services to about 50,000 retailers, most of them small or midsize. The company offers a product called MerchantWare, which like VeriFone's technology is designed to enable merchants to encrypt card data from the beginning to the end of the sales and payment process.

Although VeriShield Protect is focused on the PIN pad devices that are used by customers themselves to swipe their cards, Merchant Warehouse CEO Henry Helgson said that MerchantWare is aimed more at POS systems in which cards need to be handed over to a cashier.MerchantWare is based on technology from MagTek Inc., a rival of Semtek. Like VeriShield Protect, MagTek's product also encrypts data at the card reader. But integrating the technology into existing environments does require "minimal" updates to a company's POS software, Helgson said.

With MerchantWare, merchants never have to store any payment card data on their systems, according to Helgson. Instead, a retailer that needs to access payment transaction data to handle issues such as chargebacks or payment disputes would log into a MerchantWare payment gateway to get at the information.Helgson said that the recent disclosures of several data-in-transit thefts are helping to generate interest in technologies such as MerchantWare. "This is our way of getting new customers," he said. "We expect huge demand for this.

Also offering capabilities similar to MerchantWare is payment processor Element Payment Service Inc., which is using MagTek's technology to provide bundled encryption services to retailers, said Gartner Inc. analyst Avivah Litan. It's surprising, she added, that more vendors haven't already come out with similar products that can help retailers encrypt payment card data while it is inside their networks.

Currently, under the Payment Card Industry Data Security Standard mandated by the major credit card companies, merchants are required only to ensure that any payment card data being transmitted over a public network is encrypted. The lack of a rule requiring that data be encrypted while it is transmitted internally has been exploited in at least three major data breaches disclosed in the past few months.

The biggest of the breaches took place at Hannaford Bros. Co., a supermarket chain based in Scarborough, Maine. In March, Hannaford said that malware planted on the POS servers at nearly 300 grocery stores had been used to steal unencrypted payment card data on more than 4 million customers. Last month, Hannaford officials said that the grocer planned to spend "millions" of dollars on IT security upgrades in the wake of the breach.

Similar incidents have also been reported by Okemo Mountain Resort, a ski area in Ludlow, Vt., and by Dallas-based restaurant chain Dave & Buster's Inc., which said last week that credit and debit card numbers were stolen from 11 of its restaurants during 2007 by hackers who allegedly gained remote access to POS servers and then installed packet-sniffing software on them.
Such breaches highlight the need for companies to pay more attention to encrypting payment card data within their own network boundaries, Litan said. But thus far, she added, adoption of the available encryption technologies has been slow because many retailers appear unconvinced that encryption can be introduced at the POS level without requiring major changes. For instance, one concern is that encrypting data will make it harder for retailers to handle issues such as chargebacks.

"Most merchants are passive about this because their systems rely on card numbers for chargebacks," Litan said. "They need to be convinced that their systems need to change." In addition, many retailers have spent a lot of money, time and effort complying with the existing PCI requirements and are reluctant to implement even more security controls, she said.

10 essential (and free!) security downloads for Windows

Stay safe from prying eyes and bad guys

To use an Internet-connected computer is to be insecure and place your privacy in danger. Spyware, viruses, Trojans and assorted malware are everywhere on the Net, trying to hop onto your PC and cause damage. Snoopers want to get at your personal information for nefarious purposes, such as identity theft.

Operating systems of all kinds are under assault, but the prime target is Windows, because the vast majority of PCs worldwide use that operating system. If you use Windows, hackers have you in their cross hairs.

Luckily, there's plenty of free software for Windows that can help protect your privacy and security. I'm not talking about anemic, underpowered applications. I'm talking about industrial-strength tools that can do everything that expensive security software does.With all the free stuff out there, which software should you choose? I've selected 10 of my favorite programs that can protect your privacy and security. Download and install them, and you'll be far safer against all the nastiness out there.

1.Secunia Personal Software Inspector
Some of the biggest security holes in your PC aren't directly related to Windows — instead, they're in the applications you run. As often as not, that's how hackers and crackers can get into your PC. For example, in the recent "Pwn to Own" hacker challenge, it was application vulnerabilities, not Windows Vista itself, that allowed hackers to crack Vista.

The best way to protect yourself from this problem is to keep your applications updated with vendor-issued patches. But you don't want to spend your life cruising the Web, looking for updates for every app you use.

Instead, get this freebie that does it for you. As a security vendor, Secunia keeps track of software vulnerabilities and available patches. The company's Personal Software Inspector (PSI) scans your PC, downloads a current vulnerabilities file, and alerts you to any software on your machine that is missing security patches. It also warns you if any software is out of date and no longer supported by the vendor. Out-of-date software no longer gets security patches, and so may be more vulnerable to hackers.When you get a list of insecure software, you can get more details about each piece of software, open the folder where the software resides, or download a patch. Click the + sign next to the software, and you'll get even more details about it, often including links to any tools for uninstalling the software. You also have the choice of having Secunia constantly monitor your software use and notify you when patches are available.

Secunia says that some programs require tedious or confusing patching procedures, so by default it starts in a mode that shows you only "easy-to-patch" programs. It's a much better bet to have Personal Software Inspector tell you about all applications that need patches, not just ones that are easy to patch. To make the change, select Settings and uncheck the box next to "Show only 'Easy-to-Patch' programs."

Note that Secunia PSI is free for home use, but requires payment for business use.

2.SendShield (beta)
Microsoft Office documents often include data that can compromise your privacy or that you don't want others to see, such as hidden text or cells, document revision history, names of document authors and reviewers, and so on. When you send someone a document, they can easily see that information by viewing the version history and the document's properties, and in other ways.It can be time-consuming and impractical to remember to review every document you send out via e-mail to make sure it doesn't contain privacy-compromising information. Instead, get Unedged Software's SendShield.

Whenever you send PowerPoint, Excel or Word documents via Outlook, it examines them to see if they have any of private information. It then details what it finds and lets you remove the information with a single click. It deletes the information only from the copy of the file you send via e-mail, not the original on your hard disk. You can also have the documents turned into PDFs and sent that way instead of as Office documents.

SendShield is in beta, and for now is free. However, when it gets out of beta, there is a chance that it will become for-pay software. (The company provided no details on timing or pricing.)

3.Avast Antivirus
Many for-pay antivirus programs, such as Symantec's Norton AntiVirus, are system hogs, taking up far too much RAM and system resources, which slows down your PC unnecessarily. Not only that, but you have to pay an annual fee for using them.

There's a better way: Get the Avast Antivirus software from ALWIL Software. It's lightweight and takes up barely any RAM or system resources, it's simple to use, and it'll do everything you need by providing live, resident protection as well as scanning.The software uses a shield metaphor for its multiple types of protection. There's an antivirus shield, one that protects against Web-based threats, another for e-mail protection and so on. You can customize the sensitivity of each shield.

Avast includes automated updates of virus definitions. The independent testing site AV-comparatives.org rates its effectiveness as Advanced+, the top level. I've been using the program for well over a year and a half, and it's caught every threat that's come my way.
Note that Avast is free for home use, but requires payment for business use.

4.HijackThis
Everybody should be using spyware-detection tools such as Lavasoft Ad-Aware or Spybot Search & Destroy — preferably both. But some malware is so nasty that it escapes detection from any spyware scanners — and can't be removed by them, either.
So what can you do if your PC is acting strange and you suspect that you've been victimized by malware? Try downloading and using Trend Micro's HijackThis, and with the help of experts, you may be able to track down the source of the problem and then fix it.

The program examines your settings and the Windows registry, particularly those sections that are most likely to be vulnerable, and then saves all those settings in a log file. Those settings are the key to finding out if you've been infected. Experts can analyze the log, and from what they find, determine whether there's a spyware infection.

Where do you find the experts? The program lets you upload your log file to the HijackThis Web site, where others will examine it, let you know if there are any likely infections and tell you how to rid yourself of them. There are plenty of other discussion areas on the Internet that will do the same; a Google search will turn up plenty of them.

The software will also delete suspicious items, and it includes other useful tools, such as one that will generate a log of all programs that run on start-up. Keep in mind that if you're not an expert, you shouldn't try to use this program on your own. Think of it as a last resort when standard anti-malware tools fail.

5.SpywareBlaster
Of course, the best way to protect yourself against spyware is to make sure that it doesn't install in the first place. That's where SpywareBlaster from Javacool Software comes in. It stops the installation of ActiveX-based spyware, browser hijackers and other malware, and can also block spyware cookies. It includes extras as well, such as disabling Flash running in Internet Explorer. And it also lets you create a system snapshot, so that if at some later point you get infected with spyware, you can always revert to a clean system.Note that if you don't use Internet Explorer, there's no need to install this software, because Firefox, Opera and Safari don't use ActiveX.

6.F-Secure BlackLight Rootkit Eliminator
Rootkits are the most nefarious of all malware, giving hackers access to your entire PC without your knowledge. They use special techniques to hide themselves from many antivirus and anti-malware programs, which makes detecting and killing them exceedingly difficult. Because of that, just using antivirus software isn't enough. Instead, you need a specialized rootkit detector and killer.

That's exactly what F-Secure's BlackLight Rootkit Eliminator does. It scans your PC for hidden processes, folders and files, then reports on what it finds. If your PC is clean, it will tell you so. If it finds anything hidden, it tells you that as well and lets you clean it up. Double-click any entry, and you'll get more information about it, such as the file location, a description and company information. To kill a rootkit you've discovered, you have a choice of renaming or deleting the file using BlackLight's built-in tools. It's a good idea to first rename suspicious files, which gives them a .ren extension and prevents them from executing. Next, do a Google search for the file names to see whether they really are malware. Rootkits often hide legitimate files and processes, such as Explorer.exe, so make sure not to get rid of any legitimate ones. If you confirm that files are malware, then delete them.

Warning: Only very experienced users should attempt to clean their PC with this software, because if you rename or delete valid files, you can cause serious problems. If you're at all unsure about what you're doing, you might want to try a different free anti-rootkit tool called RootAlyzer, from the same folks who bring you Spybot Search & Destroy. It checks your PC for rootkits but doesn't offer tools for deleting them. (Note that RootAlyzer is still in the preview stage.)

7.NoScript
JavaScript, Java, plug-ins and other code found on Web pages can do serious damage to your PC. They can deliver interactivity and other useful features, but they can also be used to wreak a great deal of havoc. To keep yourself safe on unfamiliar Web sites, you'll want to turn them off, but doing so means that you'll lose some of the nifty features on some of your favorite Web sites.

The answer? A great Firefox extension called NoScript, which not only blocks scripts, plug-ins and various types of code, but also protects against cross-site scripting attacks. It lets you block scripts, plug-ins, and code on a site-by-site basis. You can control it to an exceptional degree, including whether to block scripts on sites on a one-time basis or permanently.

8.Comodo Firewall Pro
The firewall that ships with Windows XP or Vista simply isn't good enough to keep you safe — you need better protection. There are plenty of free firewalls out there, but my favorite is Comodo Firewall Pro, which provides top-notch protection from both inbound and outbound threats. It offers other types of protection as well, including what it calls Defense+, which keeps you safe in several ways, including locking down certain files and folders so that they can't be altered.Note that this firewall is more aggressive than many in asking whether you should allow connections. So when you first run it, expect to see a good many pop-ups asking whether you want to let through a particular application. To help cut down on the pop-ups, run its Clean PC mode, which lets you scan your PC for applications and then register them as safe so that you're not inundated with quite so many pop-ups. In addition, there's an "install mode" that disables certain types of pop-ups for 15 minutes, allowing you to easily install new software.

Another very good free firewall is Online Armor. Computerworld editor in chief Scot Finnie prefers its paid version to any other firewall. The free version is excellent as well, with one shortcoming: To install a new version, you first have to uninstall the old version, then install the new one.

9.McAfee SiteAdvisor
The Web is filled with sites that harbor adware, spyware or worse. It can be almost impossible to know ahead of time whether you've visiting such a site. Making matters worse is that many of these sites also have legitimate information and software for download.

McAfee SiteAdvisor is a great way to make sure you steer away from those sites. When you do a search in Google or Yahoo, it places a small icon to the right of each search result, indicating whether the site is safe, questionable or known to be harmful. A red X indicates danger, a green check indicates the site is safe, and a yellow exclamation mark indicates that it's questionable. If McAfee hasn't assessed a particular site, it displays a question mark.

Move your mouse over the icon, and you'll get a pop-up with details about the dangers, including whether it has dangerous downloads, whether it links to other dangerous sites, and whether it will send spam if you register at the site.

Click More Info from the pop-up, and you'll get much more information, including a list of the dangerous downloads and malware or adware that infects it, what sites the site links to and more. It even tells you the site's "annoyances," such as what third-party cookies it installs.
The SiteAdvisor software works even when you don't do a search. As you browse the Web, a small icon sits at the bottom of the screen and tells you whether the site is dangerous or not.

10.CCleaner
CCleaner does double duty: Not only does it help protect your privacy, but it also keeps your system clean and running well. To protect your privacy, it removes traces of your Internet history, such as your temporary Internet files, browsing history, autocomplete form history, and cookies. In addition, it cleans Windows' Recent History list. It's great at cleaning your system as well. CCleaner gets rid of many different kinds of unneeded files, such as temporary files, Windows log files, chkdsk file fragments and a lot more. It can also check your Registry and clean it of bad or broken entries and help you stop programs from running on start-up. For anyone who wants to keep their browsing life private — and keep their system clean and running smoothly — this is a must-have download.

Opinion: Top 10 Google flubs, flops and failures

Among all the success stories of the huge and unorthodox Internet company are some that are, uh, not so much

Google Inc. is arguably the most successful Internet company today. But Google didn't get to where it is without takings risks -- some of which have failed spectacularly.

For example, remember the Google Accelerator, which was supposed to speed up Web surfing? (A dubious claim, but least it was free.) But you had to pay to get a Google Answer, and eventually people stopped asking. Google Video did so well that the company finally gave up and shelled out big bucks to buy YouTube LLC. If you can't beat 'em, buy 'em.

Some Google flops lasted no more than a day and then vanished without a trace. Other Google efforts have been left to languish like a neglected orphan inside Google's labyrinth of Web services. Still other dogs were released as betas nearly five years ago and are still trapped in Google Labs with apparently little hope of escaping the test tube.

A Google X-File: Google X
One of the most mysterious of Google's flops was its Google X site, a redesigned Google search home page that was styled after the Mac OS Dock user interface on OS X. On the bottom of the page was written "Roses are red. Violets are blue. OS X rocks. Homage to you." The site, which launched in 2005, lasted one day before being shuttered by Google for no public reason. Google X may have been pulled because of worries that Apple's copyright lawyers might not appreciate the "homage." But Google X has lived on with many Internet users cloning the interface for anyone to use.

Google Catalog: Ready for recycling
Interested in seeing what the latest prices for USB flash-based drives are? Google Catalog's top search result links you to a 2001 Micro Warehouse catalog where a 256MB Trek ThumbDrive Pro will run you $595. Google Catalog has been in a perpetual state of beta since 2002, and currently its most recent catalog offering for a search on "laptops" delivers a Cyberguys Spring 2006 catalog. Google Catalog now works more like the Internet Archive's Wayback Machine than like a place to browse and see before you buy.

Google Video Player is off the air
At one time, Google thought we needed yet another application to download and play videos on our computers. Married to the company's online service Google Video, the Google Video Player's chief advantage was that it could play back video encoded using Google Video File (yet another video file format that Google thought we needed). But it supported video playlists, and it allowed you to skip ahead in a Google Video even if that portion hadn't downloaded yet. It turned out that the Web was already being well served with video players. Critics dinged the Google player for poor organization of video clips, paid content that varied too much in price and its inability to transfer video content to portable devices. In August 2007, Google yanked the player from the Google Video Web site.

Google Web Accelerator: Time saver or waste of time?
Google's Web Accelerator is a combination of something you don't really need and something that may compromise your privacy. The software is still offered by Google and promises to speed up page load times of Web pages by as much as a less-than-stunning 20%.

Reviewers said that the target audience for Google Web Accelerator, broadband users, already can retrieve Web sites fast enough. And from the start, privacy activists such as Richard Smith accused Google of using Web Accelerator as a market research tool. Smith said, "They'll be looking at what people are doing on the Internet, what they're reading, what they're buying? There's potentially a lot of information just from the click-stream of the URLs people visit."

Question: What happened to Google Answers? Answer: It flopped
For five years, Google Answers allowed anyone to post a question along with a bid price they were willing to pay for a researched answer. A prescreened group of Google Answer researchers would accept the fee (or not) and if they did accept the offer, answer the question.

Along with well-heeled high school and college students, I was a big fan of the site. Answers were usually complete, well researched and well written. But quality isn't always rewarded on the Internet. Google just couldn't compete with Yahoo Answers, a free service that relied not on paying customers, but on a mammoth and loyal Yahoo community. Google's official Google Answers response to the question "What has happened to Answers?" is "There is no answer at this time." Google may not be accepting your questions, but you can still search the database of answers.

Google Coupons: Expires 2006
It almost seems as if Google Coupons is Google's equivalent to a white rhino -- they both exist but few have seen one. Google Coupons is a feature within the Google Local Business Center service that allows companies to create Web-based coupons and display them within Google Maps.

The idea behind Google Coupons is that when you are searching for a local business using Google Maps, a local company can deliver a coupon enticing you to do business with it. The coupon would be displayed next to the Google Map and could be printed out and redeemed.
It's a nifty idea, but as an avid user of Google Maps, in the two years Google Coupons has been available, I've never come across one when using a map. Have you?

Google hangs up on Google Voice Search
From the Google department of way-before-its time came Google Voice Search. The service, which was originally an experiment within Google Labs, was launched in 2003 and worked like this. First, visit the Google Voice Search site. Next, call the phone number on the screen and speak your keyword search query. Then go back to your browser, click on the link on the Google Voice Search site, and bingo, a window with the search results appears.

No wonder this service got nixed. Searching the Web like this is comparable to calling up your brother-in-law to drive across town and brush your teeth for you before you go to bed. On the other hand, this cool technology experiment was a precursor to mobile phone services of today such as ChaCha and Google's own, very handy Google 411 service.

Google Viewer: I'm not seeing it
The idea behind the Google Viewer software program was that you could type in a query, press submit, and then sit back and watch as it loaded actual Web pages that it found. Next, Google Viewer displayed the results to you as a slide show. The program, which PC World reported on in 2002, was eventually abandoned.

The idea of sneaking a peak at a Web page before clicking on the link eventually came to fruition -- it just didn't require a software download to do it. Today, you can preview pages in search results delivered by Ask.com, Powerset and Yahoo, no application required.

eBay users check in, but they don't (Google) Checkout
In June 2007, thousands of eBay loyalists descended on Boston for eBay's annual sellers convention. And in hopes of promoting its new Google Checkout payment system -- which would be competing directly with eBay's PayPal subsidiary -- Google organized a party to be held during the eBay show, inviting eBay sellers to attend. In addition, the Google party was supposed to be a protest against eBay for barring merchants from using Google Checkout.

When eBay got wind of Google's plan, it promptly canceled all of its U.S. ads running on the search engine for more than a week. At the time, eBay was the single largest buyer of search ads on Google.

Google canceled its Boston tea party.

Orkut: The Hoff of social networks
Actor David Hasselhoff is worshipped in Germany, but his talents are less appreciated here in the U.S. The same might be said of the domestically underappreciated Google Orkut. Introduced in 2004, the social networking site is a big hit in Brazil, but in the U.S., Orkut has lagged in popularity behind Facebook and MySpace.

Google Orkut's lack of popularity in the U.S. has been attributed not only to strong competition from the other services, but also to such factors as its early "invite only" policy, a lack of support for blogging tools and an absence of video features.

Failure will you get you everywhere
All employees at Google are supposed to spend 20% of their time working on personal projects of interest. Google says that the policy encourages creativity. And without Google's willingness to take risks and not be afraid of tripping, stumbling and sometimes falling flat on its face, the company might not be what it is today. Perhaps Google's greatness can be measured by its failures as well as its successes.