Language Selection

English French German Italian Portuguese Spanish

Google now a hacker's tool

Filed under
Security

Somewhere out on the Internet, an Electric Bong may be in danger. The threat: a well-crafted Google query that could allow a hacker to use Google's massive database as a resource for intrusion.

"Electric Bong" was one of a number of household devices that security researcher Johnny Long came across when he found an unprotected Web interface to someone's household electrical network. To the right of each item were two control buttons, one labelled "on," the other, "off."

Long, a researcher with Computer Sciences Corp. and author of the book, "Google Hacking for Penetration Testers," was able to find the Electric Bong simply because Google contains a lot of information that wasn't intended to lie unexposed on the Web. The problem, he said at the Black Hat USA conference in Las Vegas last week, lies not with Google itself but with the fact that users often do not realize what Google's powerful search engine has been able to dig up.

In addition to power systems, Long and other researchers were able to find unsecured Web interfaces that gave them control over a wide variety of devices, including printer networks, PBX (private branch exchange) enterprise phone systems, routers, Web cameras, and of course Web sites themselves. All can be uncovered using Google, Long said.

But the effectiveness of Google as a hacking tool does not end there. It can also be used as a kind of proxy service for hackers, Long said.

Although security software can identify when an attacker is performing reconnaissance work on a company's network, attackers can find network topology information on Google instead of snooping for it on the network they're studying, he said. This makes it harder for the network's administrators to block the attacker. "The target does not see us crawling their sites and getting information," he said.

Often, this kind of information comes in the form of apparently nonsensical information -- something that Long calls "Google Turds." For example, because there is no such thing as a Web site with the URL (Uniform Resource Locator) "nasa," a Google search for the query "site:nasa" should turn up zero results. instead, it turns up what appears to be a list of servers, offering an insight into the structure of Nasa's (the U.S. National Aeronautics and Space Administration's) internal network, Long said.

Combining well-structured Google queries with text processing tools can yield things like SQL (Structured Query Language) passwords and even SQL error information. This could then be used to structure what is known as a SQL injection attack, which can be used to run unauthorized commands on a SQL database. "This is where it becomes Google hacking," he said. "You can do a SQL injection, or you can do a Google query and find the same thing."

Although Google traditionally has not concerned itself with the security implications of its massive data store, the fact that it has been an unwitting participant in some worm attacks has the search engine now rejecting some queries for security reasons, Long said. "Recently, they've stepped into the game."

Source.

More in Tux Machines

Kernel Space/Linux

Debian Handheld Pre-orders, GNOME Scores RH Servers

From (some of) the folks that brought you Pandora comes new Linux gaming handheld Pyra. Pre-orders are now being taken. The Free Software Foundation filed a comment with the U.S. Copyright Office calling for an end to JavaScript requirements on government websites. Red Hat recently donated two servers to the GNOME project and Nick Heath examined a draft of the Munich Open Source report. Douglas DeMaio posted of Tumbleweed updates and vulnerabilities in ImageMagick have webmasters scrambling. Read more

Leftovers: Ubuntu

  • Canonical Makes It Easy for Users to Install Snaps via Ubuntu Software
    We published earlier an update to an article published last week about the fact that there was a nasty bug present in the GNOME Software application that made it impossible for Ubuntu 16.04 LTS (Xenial Xerus) users to install third-party .deb packages. On May 4, 2016, Canonical finally pushed the patched version of the GNOME Software app, which is called Ubuntu Software in the newly released Ubuntu 16.04 LTS operating system, allowing users to install various applications distributed in the .deb file format and obtained from third-party sources with a simple double mouse click on the file.
  • You Can Now Install Third-Party Debs via GNOME Software in Ubuntu 16.04 LTS
    We told you last week that there's a pretty nasty bug in the GNOME Software application, a graphical package manager from the GNOME Stack, that does not allow Ubuntu 16.04 LTS users to install third-party .deb files.
  • Ubuntu Make 16.05 Lands on Ubuntu 16.04 LTS, Brings Android Studio and SDK Fixes
    Ubuntu Make developer Didier Roche announced the release of Ubuntu Make 16.05, a new maintenance release of his open-source CLI tool that lets developers install various third-party SDKs and IDEs.

No one should have to use proprietary software to communicate with their government

The Free Software Foundation (FSF) submitted a comment to the U.S. Copyright Office calling for a method to submit comments that do not require the use of proprietary JavaScript. Proprietary JavaScript is a threat to all users on the Web. When minified, the code can hide all sorts of nasty items, like spyware and other security risks. Savvy users can protect themselves by blocking scripts in their browser, or by installing the LibreJS browser extension and avoiding sites that require proprietary JavaScript in order to function. But some sites are harder to avoid than others. This is particularly the case when the site is required for citizens to communicate or interact with their own government. If no free alternative means are provided, then users can be blocked from participating in the democratic process. Read more