Bugwatch: Don't fall victim to a Googlehack

Confidential data can all too easily leak through to search engines

Jason Hart, head of security, WhiteHat UK, vnunet.com 05 Aug 2004

Each week vnunet.com asks a different expert to give their views on recent virus and security issues, with advice, warnings and information on the latest threats.

This week Jason Hart, head of security for WhiteHat UK, advises on the dangers posed by search engines' caching of confidential web pages, and the simple measures companies can take to protect themselves.

Internet search engines are deviously clever things. Everyone grew obsessed with them when the web became truly mass market, and today they remain the principal way of navigating through the billions of online places connecting you to the rest of humanity.

The über-search engine has emerged as Google, so much so that it's become ingrained in popular culture. Fans of author and comedian Dave Gorman will be familiar with the Google-inspired craze of 'Googlewhacking', a bizarrely engaging pasttime where you enter two-word combinations into the search bar in a bid to locate a singular web search result, e.g. 'verisimilitude orangeries'.

Very recently I've become aware of another craze, this time among the hacking fraternity: the Googlehack.

System administrators often lack the time, interest or ability to remove confidential information from within the root of their servers, or even know whether or not confidential information is held there.

This oversight means that the average user has the ability to hack into databases and web servers, and to access private information - all thanks to internet search engines.

All search engines are based on a similar technology. They use spider programs to take a snapshot of each page it examines as it crawls the web, caching these as backup in case the original page is unavailable.

The all-encompassing sweep of its crawl means that search engines cache content that should really be private, but once it's cached it becomes public domain information.

Type in the right search command and hey presto, you're on your way to a security breach.

Being a responsible citizen, I'm not about to disclose what any of those search commands might be. However, I can assure any doubters that search engines can be used to sneak past existing infosecurity systems, act as a transparent proxy server and locate information that should only be available to the owner.

They can even find exploitable targets on the web which run certain operating systems and web server software, and harbour specific vulnerabilities and sensitive data in public directories and files.

A well-equipped hacker will use any means possible to try and map out an intended victim's data infrastructure. His first act will be to research any internet-facing resources that the company in question operates.

But he'll save himself a lot of time and bother if he just powers up a search engine and hides behind its perpetual searching and caching resources.

Typing in a site will bring you a list of pages referring to all related internet-facing resources. There might be many thousands of these, but a determined scan of the results could easily uncover host names, IP addresses, employee names, phone numbers, passwords and email addresses.

In some cases, where e-commerce applications are in evidence, this even extends to user account information.

To save time and to drill deeper, the hacker will punch in more commands in order to focus on HTML-style directory listings. This is a directory underneath a document root of a web server lacking an 'index' file. Search engines cache indiscriminately, so it's not uncommon to be able to locate live hyperlinks between public-facing web pages and privately stored files.

Unfortunately, administrators often neglect such directories and do not know about the extra security needed when hyperlinking private files to the public web pages.

This kind of background research can help the hacker identify any default system configurations. If default configurations are being employed, then there's a 90 per cent chance that publicly known default passwords can be used to unlock them.

Search engines are trusted visitors to all websites, and administrators turn a blind eye to the crawling and caching.

My advice is to learn about the simple measures you can take to patch up this vulnerability, and pursue policies that close all the gaps in your IT infrastructure.

See also: