Language Selection

English French German Italian Portuguese Spanish

Google now a hacker's tool

Filed under

Somewhere out on the Internet, an Electric Bong may be in danger. The threat: a well-crafted Google query that could allow a hacker to use Google's massive database as a resource for intrusion.

"Electric Bong" was one of a number of household devices that security researcher Johnny Long came across when he found an unprotected Web interface to someone's household electrical network. To the right of each item were two control buttons, one labelled "on," the other, "off."

Long, a researcher with Computer Sciences Corp. and author of the book, "Google Hacking for Penetration Testers," was able to find the Electric Bong simply because Google contains a lot of information that wasn't intended to lie unexposed on the Web. The problem, he said at the Black Hat USA conference in Las Vegas last week, lies not with Google itself but with the fact that users often do not realize what Google's powerful search engine has been able to dig up.

In addition to power systems, Long and other researchers were able to find unsecured Web interfaces that gave them control over a wide variety of devices, including printer networks, PBX (private branch exchange) enterprise phone systems, routers, Web cameras, and of course Web sites themselves. All can be uncovered using Google, Long said.

But the effectiveness of Google as a hacking tool does not end there. It can also be used as a kind of proxy service for hackers, Long said.

Although security software can identify when an attacker is performing reconnaissance work on a company's network, attackers can find network topology information on Google instead of snooping for it on the network they're studying, he said. This makes it harder for the network's administrators to block the attacker. "The target does not see us crawling their sites and getting information," he said.

Often, this kind of information comes in the form of apparently nonsensical information -- something that Long calls "Google Turds." For example, because there is no such thing as a Web site with the URL (Uniform Resource Locator) "nasa," a Google search for the query "site:nasa" should turn up zero results. instead, it turns up what appears to be a list of servers, offering an insight into the structure of Nasa's (the U.S. National Aeronautics and Space Administration's) internal network, Long said.

Combining well-structured Google queries with text processing tools can yield things like SQL (Structured Query Language) passwords and even SQL error information. This could then be used to structure what is known as a SQL injection attack, which can be used to run unauthorized commands on a SQL database. "This is where it becomes Google hacking," he said. "You can do a SQL injection, or you can do a Google query and find the same thing."

Although Google traditionally has not concerned itself with the security implications of its massive data store, the fact that it has been an unwitting participant in some worm attacks has the search engine now rejecting some queries for security reasons, Long said. "Recently, they've stepped into the game."


More in Tux Machines

More of That Cow...

Tech Webinar: Knox Tizen Wearable SDK – October 27, 2016

Here is something for our developer community out there who are Interested in the Knox Tizen Wearable SDK. Tomorrow, there is a special Webinar taking place online entitled Build powerful and secure apps on the Samsung Gear S3. Wearables are growing in popularity in the enterprise space and many businesses are seeing the benefit of Integrating a wearable device into their business processes. In the consumer market they are doing well, as only yesterday we reported that Samsung had a Year over Year growth of 9% to currently have 15% of the smartwatch market, whilst the majority of other vendors saw their market share decline. Apple has been severely hit with almost a 72% decline. Read more

Open Source Operating Systems for IoT

Over the past decade, the majority of new open source OS projects have shifted from the mobile market to the Internet of Things. In this fifth article in our IoT series, we look at the many new open source operating systems that target IoT. Our previous posts have examined open source IoT frameworks, as well as Linux- and open source development hardware for IoT and consumer smart home devices. But it all starts with the OS. In addition to exploring new IoT-focused embedded Linux-based distributions, I’ve included a few older lightweight distributions like OpenWrt that have seen renewed uptake in the segment. While the Linux distros are aimed primarily at gateways and hubs, there has been equivalent growth in non-Linux, open source OSes for IoT that can run on microcontroller units (MCUs), and are typically aimed at IoT edge devices. Read more

New Cortex-M chips add ARMv8 and TrustZone

ARM launched its first Cortex-M MCUs with ARMv8-M and TrustZone security: the tiny, low-power Cortex-M23 and faster Cortex-M33. At the ARM TechCon show in Santa Clara, ARM unveiled two new Cortex-M microprocessors that will likely emerge as major Internet of Things workhorses over the coming decade, supplanting most existing Cortex-M designs. The Cortex-M23 and Cortex-M33 are also the first Cortex-M processors with ARMv8-M technology, enabling ARM TrustZone security, among other benefits. The TrustZone support is enabled via a new IoT-oriented CoreLink SIE-200 network-on-chip, which adds IP blocks on top of the AMBA 5 AHB5 interface. ARM also announced a TrustZone CryptoCell-312 technology for creating secure SoCs based on ARMv8-M. Read more