Hacker group releases automated 'Google hacking' tool
Cult of the Dead Cow says scanning software can find Web site holes via Google searches
Computerworld - The Cult of the Dead Cow hacker group has released an open-source tool designed to enable IT workers to quickly scan their Web sites for security vulnerabilities and at-risk sensitive data, using a collection of specially crafted Google search terms.
The group, which refers to itself as the cDc, acknowledged that the Goolag Scanner tool could also be used by malicious attackers to look for vulnerable Web sites. "We're not stupid," a cDc member who goes by the name "Oxblood Ruffin" said. "We know some bored teenagers and criminals will try to exploit vulnerabilities [using the new tool]."
But such uses are "not something that we or anyone can control," Ruffin added. "What we're trying to do is two things: 1) to provide a very easy and legitimate tool for security professionals to test their own Web sites for vulnerabilities, and 2) to raise awareness about Web security in and of itself."
Goolag Scanner is a Windows-based auditing tool that was built around the concept of "Google hacking," a form of vulnerability research created by a hacker who uses the name "Johnny I Hack Stuff." Google hacking involves the use of certain types of search queries to look for Web site vulnerabilities. More than 1,500 such queries -- or Googledorks, as they and the people who leave their Web sites exposed to them are sometimes known -- have been compiled into a database by Johnny I Hack Stuff over the past few years.
Although the queries are ostensibly supposed to be used by Web administrators to test their sites for data leaks and vulnerabilities, they're also widely used by malicious hackers who are looking for ways to break into sites.
With Goolag Scanner, users can use Googledork queries to run automated vulnerability scans on Web sites, instead of having to copy and paste each search term into a Google search field. According to Ruffin, the tool stores all of the known Googledorks in one file and enables users to add new search terms as they find them.
"Essentially, what we have done with the scanner is created an automated form of Google hacking," he said. "It's like Google hacking on steroids. It operates in a very quick manner."
The new tool also is "very easy to use for everybody, not just security professionals," Ruffin said. "It's probably something that your mother could use without a whole lof of instructions."
Johnny I Hack Stuff previously released a similar tool called Gooscan that also automates the query process, but it runs only on Linux.
Ruffin said that as part of its testing of Goolag Scanner, the cDc ran the tool against commercial, government and military Web sites in North America, Europe and the Middle East, discovering significant security holes in many of them. Most of the scans done in North America were run against government sites "because they are really starting to migrate to the Web," he said.
Information about roughly a dozen "pretty scary holes" that were discovered as part of those scans has been turned over to the proper authorities, Ruffin added.
Goolag Scanner won't find any new kinds of security threats on Web sites, but it does give IT administrators a handier way to look for flaws and leaks that could be exposed via Google searches, said Amichai Shulman, chief technology officer at Imperva Inc., a vendor of firewall and database security software in Foster City, Calif.
The tool's user interface is easy to use, Shulman said, adding that Goolag Scanner could be an eye-opener for company officials and other Web site owners who still need to be convinced about the extent of their exposure to security risks.
And despite the concerns about malicious uses of the tool, Shulman said that he thinks the automated querying offered by Goolag Scanner is unlikely to be of much help to would-be attackers. Over the past few years, Google Inc. has increasingly improved the ability of its software to detect and stop large-scale automated searches, according to Shulman. People who frequently try to run such searches via Goolag Scanner could find their IP addresses being blocked by Google, he said.
Even companies that want to use the tool might need Google's enterprise search software in order to successfully run the scanner against their Web sites without problems, Shulman said.
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- The New Business Case for Video Conferencing: 7 Real-World Benefits Beyond Cost-Savings This whitepaper provides insight into the value of video conferencing in today's business environment, and how organizations are using visual collaboration to find...
- Gartner Magic Quadrant for Client Management Tools The client management tool market is maturing and evolving to adapt to consumerization, desktop virtualization, and an ongoing need to improve efficiency.
- Audit Ready and Asset Optimized: The Solid Promise of an Intelligent Software Asset Management Solution In this paper Frost & Sullivan examines the benefits of enterprise-grade Software Asset Management solutions, and how these solutions serve as the convergence...
- Pragmatic Endpoint Management: Empowering an SMB Workforce in the Age of Mobility Lacking the time for proper training and education, SMB administrators often resort to taking shortcuts to keep their environment running.This paper discusses the...
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Cybercrime and Hacking White Papers | Webcasts