Language Selection

English French German Italian Portuguese Spanish

Google now a hacker's tool

Filed under
Security

Somewhere out on the Internet, an Electric Bong may be in danger. The threat: a well-crafted Google query that could allow a hacker to use Google's massive database as a resource for intrusion.

"Electric Bong" was one of a number of household devices that security researcher Johnny Long came across when he found an unprotected Web interface to someone's household electrical network. To the right of each item were two control buttons, one labelled "on," the other, "off."

Long, a researcher with Computer Sciences Corp. and author of the book, "Google Hacking for Penetration Testers," was able to find the Electric Bong simply because Google contains a lot of information that wasn't intended to lie unexposed on the Web. The problem, he said at the Black Hat USA conference in Las Vegas last week, lies not with Google itself but with the fact that users often do not realize what Google's powerful search engine has been able to dig up.

In addition to power systems, Long and other researchers were able to find unsecured Web interfaces that gave them control over a wide variety of devices, including printer networks, PBX (private branch exchange) enterprise phone systems, routers, Web cameras, and of course Web sites themselves. All can be uncovered using Google, Long said.

But the effectiveness of Google as a hacking tool does not end there. It can also be used as a kind of proxy service for hackers, Long said.

Although security software can identify when an attacker is performing reconnaissance work on a company's network, attackers can find network topology information on Google instead of snooping for it on the network they're studying, he said. This makes it harder for the network's administrators to block the attacker. "The target does not see us crawling their sites and getting information," he said.

Often, this kind of information comes in the form of apparently nonsensical information -- something that Long calls "Google Turds." For example, because there is no such thing as a Web site with the URL (Uniform Resource Locator) "nasa," a Google search for the query "site:nasa" should turn up zero results. instead, it turns up what appears to be a list of servers, offering an insight into the structure of Nasa's (the U.S. National Aeronautics and Space Administration's) internal network, Long said.

Combining well-structured Google queries with text processing tools can yield things like SQL (Structured Query Language) passwords and even SQL error information. This could then be used to structure what is known as a SQL injection attack, which can be used to run unauthorized commands on a SQL database. "This is where it becomes Google hacking," he said. "You can do a SQL injection, or you can do a Google query and find the same thing."

Although Google traditionally has not concerned itself with the security implications of its massive data store, the fact that it has been an unwitting participant in some worm attacks has the search engine now rejecting some queries for security reasons, Long said. "Recently, they've stepped into the game."

Source.

More in Tux Machines

Linux Kernel 4.15 Reached End of Life, Users Urged to Move to Linux 4.16 Now

After a very busy cycle due to the Meltdown and Spectre security vulnerabilities, which were publicly disclosed earlier this year and later discovered to put billions of devices using modern processors at risk of attacks, the Linux 4.15 kernel series was released at the of January heavily redesign against two critical hardware bugs. Now, nearly three months and only eighteen maintenance updates later, the Linux 4.15 kernel series reached end of life and it will no longer receive support. As such, all those using a kernel from the Linux 4.15 branch on their GNU/Linux distributions are urged to upgrade to the latest Linux 4.16 kernel series as soon as possible. Read more

LibreOffice 6.1 Lands Mid August 2018, First Bug Hunting Session Starts April 27

Work on the next big release of the widely-used open-source and cross-platform office suite for GNU/Linux, macOS, and Microsoft Windows operating systems, LibreOffice 6.1, has already begun this week with a focus on revamping the online experience and improving the Writer and Calc components. A first bug hunting session was scheduled for the end of next week, on April 27, 2018, when developers will hack on the first alpha milestone of LibreOffice 6.1, which should be available to download for all supported platforms a few days before the event. During the bug hunting session, devs will try to fix as many bugs as possible. Read more

This Chart Shows How The Radeon RX 580 vs. GeForce GTX 1060 Now Compete Under Linux

It was just last year that open-source RadeonSI/RADV developers were trying to get the Radeon RX 580 "Polaris" GPU to be competitive with the GeForce GTX 1060 as it is under Windows given each GPU's capabilities. We've seen the RX 580 and GTX 1060 dancing under Linux the past few months and yesterday's 20-way GPU comparison with Rise of the Tomb Raider was quite significant -- perhaps most surprising being how well the RX 580 performed. Heck, just one or two years ago it was an accomplishment seeing any official Radeon driver support at-launch for new Linux game releases. So here are some extensive tests looking closer at the GTX 1060 vs. RX 580 battle in this latest Vulkan-powered Linux game port. Read more

Linux 4.9.95

I'm announcing the release of the 4.9.95 kernel. All users of the 4.9 kernel series must upgrade. The updated 4.9.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y and can be browsed at the normal kernel.org git web browser: http://git.kernel.org/?p=linux/kernel/git/stable/linux-st... Read more