Language Selection

English French German Italian Portuguese Spanish

Google now a hacker's tool

Filed under
Security

Somewhere out on the Internet, an Electric Bong may be in danger. The threat: a well-crafted Google query that could allow a hacker to use Google's massive database as a resource for intrusion.

"Electric Bong" was one of a number of household devices that security researcher Johnny Long came across when he found an unprotected Web interface to someone's household electrical network. To the right of each item were two control buttons, one labelled "on," the other, "off."

Long, a researcher with Computer Sciences Corp. and author of the book, "Google Hacking for Penetration Testers," was able to find the Electric Bong simply because Google contains a lot of information that wasn't intended to lie unexposed on the Web. The problem, he said at the Black Hat USA conference in Las Vegas last week, lies not with Google itself but with the fact that users often do not realize what Google's powerful search engine has been able to dig up.

In addition to power systems, Long and other researchers were able to find unsecured Web interfaces that gave them control over a wide variety of devices, including printer networks, PBX (private branch exchange) enterprise phone systems, routers, Web cameras, and of course Web sites themselves. All can be uncovered using Google, Long said.

But the effectiveness of Google as a hacking tool does not end there. It can also be used as a kind of proxy service for hackers, Long said.

Although security software can identify when an attacker is performing reconnaissance work on a company's network, attackers can find network topology information on Google instead of snooping for it on the network they're studying, he said. This makes it harder for the network's administrators to block the attacker. "The target does not see us crawling their sites and getting information," he said.

Often, this kind of information comes in the form of apparently nonsensical information -- something that Long calls "Google Turds." For example, because there is no such thing as a Web site with the URL (Uniform Resource Locator) "nasa," a Google search for the query "site:nasa" should turn up zero results. instead, it turns up what appears to be a list of servers, offering an insight into the structure of Nasa's (the U.S. National Aeronautics and Space Administration's) internal network, Long said.

Combining well-structured Google queries with text processing tools can yield things like SQL (Structured Query Language) passwords and even SQL error information. This could then be used to structure what is known as a SQL injection attack, which can be used to run unauthorized commands on a SQL database. "This is where it becomes Google hacking," he said. "You can do a SQL injection, or you can do a Google query and find the same thing."

Although Google traditionally has not concerned itself with the security implications of its massive data store, the fact that it has been an unwitting participant in some worm attacks has the search engine now rejecting some queries for security reasons, Long said. "Recently, they've stepped into the game."

Source.

More in Tux Machines

Software: VirtualBox, TeX Live Cockpit, Mailspring, Qt, Projects, and Maintainers

  • VirtualBox 5.2.2 Brings Linux 4.14 Fixes, HiDPI UI Improvements
    The Oracle developers behind VM VirtualBox have released a new maintenance build in the VirtualBox 5.2 series that is a bit more exciting than their usual point releases.
  • TeX Live Cockpit
    I have been working quite some time on a new front end for the TeX Live Manager tlmgr. Early versions have leaked into TeX Live, but the last month or two has seen many changes in tlmgr itself, in particular support for JSON output. These changes were mostly driven by the need (or ease) of the new frontend: TLCockpit.
  • Mailspring – A New Open Source Cross-Platform Email Client
    Mailspring is a fork of the now discontinued Nylas Mail client. It does, however, offer a much better performance, and is built with a native C++ sync engine instead of JavaScript. According to the development team, the company is sunsetting further development of Mailspring. Mailspring offers virtually all the best features housed in Nylas Mail, and thanks to its native C++ sync engine it uses fewer dependencies which results in less lag and a reduction in RAM usage by 50% compared to Nylas Mail.
  • Removing Qt 4 from Debian testing (aka Buster): some statistics
    We started filing bugs around September 9. That means roughly 11 weeks, which gives us around 8 packages fixed a week, aka 1.14 packages per day. Not bad at all!
  • Products Over Projects
    However, projects are not the only way of funding and organizing software development. For instance, many companies that sell software as a product or a service do not fund or organize their core product/platform development in the form of projects. Instead, they run product development and support using near-permanent teams for as long as the product is sold in the market. The budget may vary year on year but it is generally sufficient to fund a durable, core development organization continuously for the life of the product. Teams are funded to work on a particular business problem or offering over a period of time; with the nature work being defined by a business problem to address rather than a set of functions to deliver. We call this way of working as “product-mode” and assert that it is not necessary to be building a software product in order to fund and organize software development like this.
  • Why we never thank open source maintainers

    It is true that some of you guys can build a tool in a hackathon, but maintaining a project is a lot more difficult than building a project. Most of the time they are not writing code, but [...]

today's howtos

Tizen News

Mozilla Firefox Quantum

  • Can the new Firefox Quantum regain its web browser market share?
    When Firefox was introduced in 2004, it was designed to be a lean and optimized web browser, based on the bloated code from the Mozilla Suite. Between 2004 and 2009, many considered Firefox to be the best web browser, since it was faster, more secure, offered tabbed browsing and was more customizable through extensions than Microsoft’s Internet Explorer. When Chrome was introduced in 2008, it took many of Firefox’s best ideas and improved on them. Since 2010, Chrome has eaten away at Firefox’s market share, relegating Firefox to a tiny niche of free software enthusiasts and tinkerers who like the customization of its XUL extensions. According to StatCounter, Firefox’s market share of web browsers has fallen from 31.8% in December 2009 to just 6.1% today. Firefox can take comfort in the fact that it is now virtually tied with its former arch-nemesis, Internet Explorer and its variants. All of Microsoft’s browsers only account for 6.2% of current web browsing according to StatCounter. Microsoft has largely been replaced by Google, whose web browsers now controls 56.5% of the market. Even worse, is the fact that the WebKit engine used by Google now represents over 83% of web browsing, so web sites are increasingly focusing on compatibility with just one web engine. While Google and Apple are more supportive of W3C and open standards than Microsoft was in the late 90s, the web is increasingly being monopolized by one web engine and two companies, whose business models are not always based on the best interests of users or their rights.
  • Firefox Nightly Adds CSD Option
    I’ve said it before and I’ll say it again: Firefox 57 is awesome — so awesome that I’m finally using it as my default browser again. But there is one thing it the Linux version of Firefox sorely needs: client-side decoration.