Feeds

The Google attack engine

Wanna own a government router?

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Exclusive Some clever empiricist appears to have been abusing Google to attack Web servers, switches and routers in a novel way, by crafting search terms to include known exploits. Such a search will occasionally yield active Web pages used by administrators. On top of that, a number of them have already been cached. It's reasonable to surmise that a hacker has been using Google not merely to search for vulnerabilities, but as a proxy to hide behind while executing attacks.

SecurityFocus researcher Ryan Russell discovered a wealth of such pages quite by accident, while working on improved rules for Snort, a popular open-source IDS (Intrusion Detection System).

"I was using Google to check how common a particular string is on the Web, to gauge how often a rule might cause a false-positive. Part of the process of deciding how often the rule might cause a false positive is deciding how common the string is that the rule searches for," Russell explains.

So while searching Google for a vulnerability in Cisco IOS Web Server, Russell followed a link and found himself in a switch belonging to a US .gov site.

The malicious use of search engines is nothing new, as we reported in a story back in June of 2000; but this does bring it to new levels of finesse. The significant thing here is that the cache can be used to cover one's tracks, assuming there are no graphics to be fetched.

Cruise control?
So how did all this stuff get indexed in the first place? Did Google's mighty spiders do it all automatically, or did someone deliberately add the URLs?

Google offers "an advanced search feature that allows you to look for sites that link to a particular URL. When I looked for the URLs that are exploit attempts, there were no links to them. This either means they were submitted manually to Google, or possibly that the page that used to link to them has changed, and Google has already re-indexed it," Russell says.

"The simplest explanation is that they just went to Google's submit URL page, and typed it in."

On Monday we invited Google to comment, but they've not yet replied. We wondered if they might be able to prevent at least some of these abuses, perhaps by filtering according to rules similar to those in Snort. After all, if they can purge 95 per cent of the porn you'd expect to encounter in their images search, they ought to be able to filter a fair number of HTTP exploits as well.

We sent them a rather long list of potentially exploitable search terms based on Russell's queries. "As I continued to work the rule-set, I kept finding more. Some of them might be innocent. Many clearly aren't. Some succeed, some don't," he notes.

But there are a lot. And we don't doubt that we've only scratched the surface. ®

Beginner's guide to SSL certificates

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.