Feeds

The Google attack engine

Wanna own a government router?

  • alert
  • submit to reddit

Protecting against web application threats using SSL

Exclusive Some clever empiricist appears to have been abusing Google to attack Web servers, switches and routers in a novel way, by crafting search terms to include known exploits. Such a search will occasionally yield active Web pages used by administrators. On top of that, a number of them have already been cached. It's reasonable to surmise that a hacker has been using Google not merely to search for vulnerabilities, but as a proxy to hide behind while executing attacks.

SecurityFocus researcher Ryan Russell discovered a wealth of such pages quite by accident, while working on improved rules for Snort, a popular open-source IDS (Intrusion Detection System).

"I was using Google to check how common a particular string is on the Web, to gauge how often a rule might cause a false-positive. Part of the process of deciding how often the rule might cause a false positive is deciding how common the string is that the rule searches for," Russell explains.

So while searching Google for a vulnerability in Cisco IOS Web Server, Russell followed a link and found himself in a switch belonging to a US .gov site.

The malicious use of search engines is nothing new, as we reported in a story back in June of 2000; but this does bring it to new levels of finesse. The significant thing here is that the cache can be used to cover one's tracks, assuming there are no graphics to be fetched.

Cruise control?
So how did all this stuff get indexed in the first place? Did Google's mighty spiders do it all automatically, or did someone deliberately add the URLs?

Google offers "an advanced search feature that allows you to look for sites that link to a particular URL. When I looked for the URLs that are exploit attempts, there were no links to them. This either means they were submitted manually to Google, or possibly that the page that used to link to them has changed, and Google has already re-indexed it," Russell says.

"The simplest explanation is that they just went to Google's submit URL page, and typed it in."

On Monday we invited Google to comment, but they've not yet replied. We wondered if they might be able to prevent at least some of these abuses, perhaps by filtering according to rules similar to those in Snort. After all, if they can purge 95 per cent of the porn you'd expect to encounter in their images search, they ought to be able to filter a fair number of HTTP exploits as well.

We sent them a rather long list of potentially exploitable search terms based on Russell's queries. "As I continued to work the rule-set, I kept finding more. Some of them might be innocent. Many clearly aren't. Some succeed, some don't," he notes.

But there are a lot. And we don't doubt that we've only scratched the surface. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.