Use Google's indexing capabilities to identify vulnerabilities
Posted on 28 July 2011.
Next week at Black Hat, Stach & Liu researchers Francis Brown and Rob Ragan will show how the power of Google’s indexing capabilities can be harnessed to identify vulnerabilities - particularly SQL injection flaws - that can be used to take over millions of websites that are at risk.

By searching for the right string of information, an attacker can find massive amounts of sensitive data and extract it with a few simple exploits.


Over the past year, Stach & Liu has built what may be the world's single largest repository of live vulnerabilities on the web – in fact, over 3,000 new vulnerable websites are added per day to this database via real-time RSS feed updates from both Google and Bing.

After a year of collecting this research, Brown and Ragan are returning to Black Hat to give the security community the defensive tools they’ve been asking for to help solve this problem.

Brown and Ragan will also show how Google hacking was used in several other recent, high profile attacks:
  • Late last month, the entire user database of Groupon’s Indian subsidiary, Sosasta.com, was accidentally published to the Internet and indexed by Google, exposing the email addresses and clear text passwords of the site’s 300,000 users.
  • In the spring, the Liza Moon virus affected more than four million websites, injecting malicious SQL codes into popular websites and redirecting users to sites that deliver malware.
  • A similar mass SQLi attack last year compromised thousands of websites, including The Jerusalem Post and The Wall Street Journal.
Last year, Brown and Ragan revolutionized the way Google and Bing hacking is done in an under-hyped Black Hat presentation called “Lord of the Bing.” That presentation only scratched the surface of what’s truly possible with Google hacking.

“Since our Black Hat talk a year ago, our team has worked diligently to develop and deliver this full arsenal of defensive Google and Bing hacking tools that can take in millions of vulnerabilities and identify when your websites are vulnerable to attack,” said Francis Brown, Managing Partner at Stach & Liu. “Google has made it incredibly easy to find these types of vulnerabilities through their indexing and that has left many sites at risk. To put it in perspective, if Groupon.com had been using our tools, they would have gotten an alert via iPhone or Droid apps and found the vulnerability before anyone else did.”





Spotlight

How to talk infosec with kids

Posted on 17 September 2014.  |  It's never too early to talk infosec with kids: you simply need the right story. In fact, as cyber professionals it’s our duty to teach ALL the kids in our life about technology. If we are to make an impact, we must remember that children needed to be taught about technology on their terms.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Sep 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //