Feeds

The Google attack engine

Wanna own a government router?

  • alert
  • submit to reddit

Securing Web Applications Made Simple and Scalable

Exclusive Some clever empiricist appears to have been abusing Google to attack Web servers, switches and routers in a novel way, by crafting search terms to include known exploits. Such a search will occasionally yield active Web pages used by administrators. On top of that, a number of them have already been cached. It's reasonable to surmise that a hacker has been using Google not merely to search for vulnerabilities, but as a proxy to hide behind while executing attacks.

SecurityFocus researcher Ryan Russell discovered a wealth of such pages quite by accident, while working on improved rules for Snort, a popular open-source IDS (Intrusion Detection System).

"I was using Google to check how common a particular string is on the Web, to gauge how often a rule might cause a false-positive. Part of the process of deciding how often the rule might cause a false positive is deciding how common the string is that the rule searches for," Russell explains.

So while searching Google for a vulnerability in Cisco IOS Web Server, Russell followed a link and found himself in a switch belonging to a US .gov site.

The malicious use of search engines is nothing new, as we reported in a story back in June of 2000; but this does bring it to new levels of finesse. The significant thing here is that the cache can be used to cover one's tracks, assuming there are no graphics to be fetched.

Cruise control?
So how did all this stuff get indexed in the first place? Did Google's mighty spiders do it all automatically, or did someone deliberately add the URLs?

Google offers "an advanced search feature that allows you to look for sites that link to a particular URL. When I looked for the URLs that are exploit attempts, there were no links to them. This either means they were submitted manually to Google, or possibly that the page that used to link to them has changed, and Google has already re-indexed it," Russell says.

"The simplest explanation is that they just went to Google's submit URL page, and typed it in."

On Monday we invited Google to comment, but they've not yet replied. We wondered if they might be able to prevent at least some of these abuses, perhaps by filtering according to rules similar to those in Snort. After all, if they can purge 95 per cent of the porn you'd expect to encounter in their images search, they ought to be able to filter a fair number of HTTP exploits as well.

We sent them a rather long list of potentially exploitable search terms based on Russell's queries. "As I continued to work the rule-set, I kept finding more. Some of them might be innocent. Many clearly aren't. Some succeed, some don't," he notes.

But there are a lot. And we don't doubt that we've only scratched the surface. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.