'Google hacking': Everything you want someone to know , and more

By William Jackson,
GCN

| July 29, 2005

The functionality that has made Google a top search engine also can be used to reveal sensitive personal data, vulnerable servers and other details about network architecture.

"We keep that catalog closely held," Long said. "We don't want bad guys writing tools."But he acknowledged that Google hacking tools already are out there. Some viruses, such as MyDoom, have used searches from infected systems to gather additional e-mail addresses to spread itself.There also are a handful of bugs in the search engine that can be exploited, Long said. "By and large, these things aren't security-related. They are bugs that we stumbled on."One such bug he calls a "Google turd": the results sometimes returned for a malformed query that should have been rejected by the search engine. Sometimes the results are typos and mistakes within a site that can reveal information to a hacker.Because Google hacking often involves legitimate queries, little has been done to thwart the technique at the search engine's end. But that might be changing, Long said."I think we're seeing Google trying to block some searches" known to have been used in automated Google hacks, he said. "We're seeing that for the first time this year."The primary defense against Google hacking is awareness on the part of the Web resources owner."It's all about policies," Long said. Enterprises must have strong, enforceable policies about what data is made accessible, and someone has to be made accountable for the information that appears on a Web site.Long, who describes himself as a clean-living family guy who just happens to like hacking stuff, says he is a white hat rather than a black hat hacker."The reason I do this talk is to raise awareness," he said. "I'm trying to walk a fine line between teaching people how to do this and raising awareness."

LAS VEGAS'The ability to type in a detailed query and perform a focused search of Web resources has made Google one of the most successful dot-com companies in the world.

But those tools also can be used to reveal data never meant to see the light of day, including credit card information, password lists, vulnerable servers and other details of network architecture.

The technique is called 'Google hacking.' 'It's the process of using the Google search engine for digging up sensitive information from a Web site," said Johnny Long, a security researcher and penetration tester for Computer Sciences Corp. in El Segundo, Calif.

Google hacking is a catchy name, but it does not have to be done with Google, Long said. 'You can do this stuff with any search engine,' although Google does have some advantages because of its rich features.

It is not a new trick, but it is one that continues to produce interesting'and sometimes embarrassing'data with little effort. Long wrote the book on the subject, titled Google Hacking for Penetration Testers.

At the risk of becoming known as the Google Guy, a title he dislikes, he returned to the Black Hat Briefings security conference this week to demonstrate techniques and results.

The practice has been around for years. Government became acutely aware of it in the wake of Sept. 11, 2001, Long said. It is one of the reasons agencies began scrubbing Web sites of sensitive data following the attacks.

"Just about every major cyberoffensive that has been recorded has started with something like a search engine" to gather publicly available data, Long said.

Gathering data through a search engine does not tip off your target that reconnaissance is being done. Information such as names, addresses, passwords, e-mail addresses and server names can be assembled to build a picture of a target system before launching an attack.

"If your target is a government, it's a lot more realistic to consider a death by a thousand cuts rather than an assault of the front gates," Long said. "It's classic asymmetrical warfare."

The primary difference between Google hacking and doing a Google search is the frame of mind, according to Long. "It's bringing a hacker's mind-set to the search," he said. "It boils down to the results you are searching for. Generally, we're using the search engine for exactly what it was intended for."

A Google hacker might, for instance, ignore the content of the links returned in a search and focus instead on the names of the servers that responded. Or, through a properly constructed query, access a list of Social Security numbers along with the names and addresses of their holders.

Long has compiled a catalog of more than 1,300 such queries that are used by legitimate developers of penetration-testing tools. Queries can return hits containing:

Security logs from firewalls, honeypots and intrusion detection and prevention systems that can reveal a wealth of details on vulnerabilities

Lists of networked devices such as printers and cameras and

Servers operating with default configurations, which could include default passwords.

NEXT STORY: 'Did you hear...'

This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. / Do Not Sell My Personal Information

Accept Cookies