Lord of the Bing Taking Back Search Engine Hacking From Google and - - PowerPoint PPT Presentation

▶
lord of the bing
SMART_READER_LITE
LIVE PREVIEW

Lord of the Bing Taking Back Search Engine Hacking From Google and - - PowerPoint PPT Presentation

Apr 11, 2023 241 likes •786 views

Lord of the Bing Taking Back Search Engine Hacking From Google and Bing 29 July 2010 Presented by: Francis Brown and Rob Ragan Stach & Liu, LLC www.stachliu.com Agenda O V E R V I E W Introduction Advanced Attacks

slide-1
SLIDE 1

Lord of the Bing

Taking Back Search Engine Hacking From Google and Bing

29 July 2010

Presented by: Francis Brown and Rob Ragan Stach & Liu, LLC www.stachliu.com

slide-2
SLIDE 2

Agenda

  • Introduction
  • Advanced Attacks
  • Google/Bing Hacking
  • Other OSINT Attack Techniques
  • Advanced Defenses
  • Future Directions

O V E R V I E W

slide-3
SLIDE 3

Goals

  • To understand Google Hacking
  • Attacks and defenses
  • Advanced tools and techniques
  • To think differently about

exposures caused by publicly available sources

  • To blow your mind!

D E S I R E D O U T C O M E

slide-4
SLIDE 4

Introduction/ Background

G E T T I N G U P T O S P E E D

slide-5
SLIDE 5

Open Source Intelligence

  • S E A R C H I N G P U B L I C S O U R C E

S

OSINT – is a form of intelligence collection management that involves finding, selecting, and acquiring information from publicly available sources and analyzing it to produce actionable intelligence.

slide-6
SLIDE 6

Quick History

  • G O O G L E H A C K I N G R E C A P
slide-7
SLIDE 7

Quick History

  • G O O G L E H A C K I N G R E C A P
slide-8
SLIDE 8

Threat Areas

W H A T Y O U S H O U L D K N O W

slide-9
SLIDE 9

Google/Bing Hacking

S E A R C H E N G I N E A T T A C K S

  • Our favorites are Google and Bing
  • Crawl and Index
  • Cache and RSS are forever
  • Query modifiers
  • site:target.com
  • related:target.com
  • filetype:xls
  • ip:69.63.184.142
slide-10
SLIDE 10

Attack Targets

  • Advisories and Vulnerabilities

(215)

  • Error Messages (58)
  • Files containing juicy info (230)
  • Files containing passwords (135)
  • Files containing usernames (15)
  • Footholds (21)
  • Pages containing login portals

(232)

G O O G L E H A C K I N G D A T A B A S E

  • Pages containing network or

vulnerability data (59)

  • Sensitive Directories (61)
  • Sensitive Online Shopping Info

(9)

  • Various Online Devices (201)
  • Vulnerable Files (57)
  • Vulnerable Servers (48)
  • Web Server Detection (72)
slide-11
SLIDE 11

Attack Targets

  • Examples

Error Messages

  • filetype:asp + "[ODBC SQL“
  • "Warning: mysql_query()" "invalid query“

Files containing passwords

  • inurl:passlist.txt

G O O G L E H A C K I N G D A T A B A S E

slide-12
SLIDE 12

Google Hacking Toolkit

  • SiteDigger v3.0
  • Uses Google AJAX API
  • Not blocked by Google
  • But restricted to 64 results/query
  • Limited search result set compared

to the web interface

  • Binging
  • Uses Microsoft Bing search engine
  • Limited domain/ip profiling utils

S T A T E O F T H E A R T

slide-13
SLIDE 13

Google Hacking Toolkit

  • F O U N D S T O N E S I T E D I G G E

R

slide-14
SLIDE 14

Google Hacking Toolkit

  • B I N G I N G
slide-15
SLIDE 15

New Toolkit

  • GoogleDiggity
  • Uses Google AJAX API
  • Not blocked by Google bot detection
  • Can Leverage

BingDiggity

  • Company/Webapp Profiling
  • Enumerate: URLs, IP-to-virtual hosts, etc.
  • Bing Hacking Database (BHDB)
  • Regexs in Bing format

S T A C H & L I U T O O L S

slide-16
SLIDE 16

DEMO

N E W G O O G L E H A C K I N G T O O L S

slide-17
SLIDE 17

New Toolkit

  • G O O G L E D I G G I T Y
slide-18
SLIDE 18

New Toolkit

  • B I N G D I G G I T Y
slide-19
SLIDE 19

New Hack Databases

  • SLDB - Stach & Liu Data Base
  • New Google/Bing hacking searches in active development by S&L

team

SLDB Examples – “Pastebin.com Disclosures”

  • site:pastebin.com "-----BEGIN RSA PRIVATE KEY-----“
  • MasterCard site:pastebin.com

S T A C H & L I U R E G E X S

slide-20
SLIDE 20

New Hack Databases

  • BHDB – Bing Hacking Data Base
  • Subset of larger SLDB effort. First

ever Bing vulnerability database

  • Past Bing/MSN hacking tools were

limited to only basic footprinting techniques, with no actual vulnerability identification

  • Bing has limitations that make it

difficult to create vuln search regexs for it

  • E.g. Bing disabled the link:,

linkdomain: and inurl: directives to combat search hacking in March ’07

S T A C H & L I U R E G E X S

  • Example - Bing vulnerability search:
  • “mySQL error with query“
slide-21
SLIDE 21

Defenses

G O O G L E / B I N G H A C K I N G D E F E N S E S

  • “Google Hack yourself” organization
  • Employ tools and techniques used by hackers
  • Remove vuln disclosures from Google cache
  • Policy and Legal Restrictions
  • Regularly update your robots.txt.
  • Or robots meta tags for individual page exclusion
  • Data Loss Prevention/Extrusion Prevention Systems
  • Free Tools: OpenDLP, Senf
  • Social Sentry
  • Service to monitor employee FaceBook and Twitter for $2-$8 per employee

(MySpace, YouTube, and LinkedIn support by summer)

slide-22
SLIDE 22

Google Apps Explosion

S O M A N Y A P P L I C A T I O N S T O A B U S E

slide-23
SLIDE 23

Google PhoneBook

S P E A R P H I S H I N G

slide-24
SLIDE 24

Google Code Search

V U L N S I N O P E N S O U R C E C O D E

  • Regex search for vulnerabilities in public code
  • Example: SQL Injection in ASP querystring
  • select.*from.*request\.QUERYSTRING
slide-25
SLIDE 25

DEMO

G O O G L E C O D E S E A R C H H A C K I N G

slide-26
SLIDE 26

SHODAN

H A C K E R S E A R C H E N G I N E

  • SHODAN Computer Search Engine
  • Scans and probes the Internet for open HTTP

ports and indexes the headers returned in the response

  • Profile a target without directly probing their

systems

  • Discover specific network appliances
  • Easily find vulnerable systems!
slide-27
SLIDE 27

Target NAS Appliances

slide-28
SLIDE 28

Target SCADA

C R I T I C A L I N F R A S T R U C T U R E S E C U R I T Y

  • Supervisory control and data acquisition
slide-29
SLIDE 29

Target SCADA

C R I T I C A L I N F R A S T R U C T U R E S E C U R I T Y

  • SHODAN: Target Acquired!
slide-30
SLIDE 30

Maltego

I N T E L L I G E N C E G A T H E R I N G T O O L

slide-31
SLIDE 31

Maltego

I N T E L L I G E N C E G A T H E R I N G T O O L

  • Maltego can be used to determine the

relationships and real world links between:

  • People
  • Social networks
  • Companies
  • Organizations
  • Web sites
  • Domains
  • DNS Names
  • Netblocks
  • IP Addresses
  • Phrases
  • Affiliations
  • Documents and

files

slide-32
SLIDE 32

Black Hat SEO

  • Why use real news events?
  • Black hats make their own fake news
  • Faux celebrity sex tape anyone?
  • Send to college students
  • It works!
  • Other scammers imitate what works

S E A R C H E N G I N E O P T I M I Z A T I O N

slide-33
SLIDE 33

Google Trends

B L A C K H A T S E O R E C O N

slide-34
SLIDE 34

Defenses

B L A C K H A T S E O D E F E N S E S

  • Web Browser Malware Filters:
  • Google SafeBrowsing plugin
  • Microsoft SmartScreen Filter
  • Yahoo Search Scan
  • No-script and Ad-block browser plugins
  • Install software security updates
  • Sandbox Software
  • Sandboxie (www.sandboxie.com)
  • Stick to reputable sites!
  • Google results aren’t safe.
slide-35
SLIDE 35

Metadata Attacks

D A T A A B O U T D A T A

  • It’s everywhere!
  • In documents (doc, xls, pdf)
  • In images
  • What can be data mined?
  • Usernames, emails
  • File paths
  • Operating systems, software versions
  • Printers
  • Network information
  • Device information
slide-36
SLIDE 36

FOCA

A U T O M E T A D A T A M I N I N G

  • Automated doc search via Google/Bing
  • Specify domains to target
  • Automated download and analysis of docs
slide-37
SLIDE 37

Defenses

M E T A D A T A M I N I N G D E F E N S E S

  • Implement a policy to review files for sensitive

metadata before they’re released

  • Run metadata extraction tools on your resources
  • Utilize metadata cleaning tools
  • Digital Rights Management (DRM) tools
  • Data Loss Prevention (DLP) tools
slide-38
SLIDE 38

Advanced Defenses

P R O T E C T Y O N E C K

slide-39
SLIDE 39

Existing Defenses

“H A C K Y O U R S E L F”

  • Multi-engine results
  • Real-time updates
  • Convenient
  • Historical archived data
  • Multi-domain searching

Tools exist

slide-40
SLIDE 40

Advanced Defenses

N E W H O T S I Z Z L E

Stach & Liu now proudly presents:

  • Google Hacking Alerts
  • Bing Hacking Alerts
slide-41
SLIDE 41

DEMO

A D V A N C E D D E F E N S E T O O L S

slide-42
SLIDE 42

Google Hacking Alerts

A D V A N C E D D E F E N S E S

  • Google Hacking Alerts
  • All GHDB/FSDB regexs using
  • Real-time vuln updates to 1623 hack queries via RSS
  • Organized and available via importable file
slide-43
SLIDE 43

Google Hacking Alerts

A D V A N C E D D E F E N S E S

slide-44
SLIDE 44

Bing Hacking Alerts

A D V A N C E D D E F E N S E S

  • Bing Hacking Alerts
  • Bing searches with regexs from BHDB
  • Leverage ‘&format=rss’ directive to turn into update

feeds

slide-45
SLIDE 45

Alert Client Tools

G O O G L E / B I N G A L E R T C L I E N T S

  • Google/Bing Hacking Alert Thick Clients
  • Take in Google/Bing Alert RSS feeds as input
  • Allow user to set one or more filters to generate alerts

when one of the rss alert entries matches something they are interested in (e.g. “yourcompany.com” in the URL)

  • Three free thick clients being released by Stach & Liu:
  • Windows app
  • iPhone app
  • Droid app
slide-46
SLIDE 46

New Defenses

“G O O G L E / B I N G H A C K A L E R T S”

  • Multi-engine results
  • Real-time updates
  • Convenient
  • Historical archived data
  • Multi-domain searching

Tools exist

slide-47
SLIDE 47

MalwareDiggity

A D V A N C E D D E F E N S E S

  • Malware New Distribution Woes
  • Popular websites targeted, become malware distribution

sites to their own customers

slide-48
SLIDE 48

MalwareDiggity

A D V A N C E D D E F E N S E S

  • MalwareDiggity
  • Uses Bing’s linkfromdomain: directive to identify all off-site

links of the domain(s) you wish to securely monitor

  • Compares to known malware sites/domains
  • Alerts if site is compromised and now distributing malware

MalwareDiggity Alerts

  • Leverages the Bing ‘&format=rss’ directive, to actively monitor new
  • ff-site links of your site as they appear
  • Immediately lets you know if you have been compromised by
  • ne of these large scale malware attacks
slide-49
SLIDE 49

Future Direction

P R E D I C T I O N S

slide-50
SLIDE 50

Predictions

  • Data Explosion
  • More data indexed,

searchable

  • Real-time, streaming

updates

  • Faster, more robust

search interfaces

Google Involvement

  • Filtering of search results
  • Better GH detection and

tool blocking

Renewed Tool Dev

  • Google Ajax API based
  • Bing/Yahoo/other engines
  • Search engine aggregators
  • Google Code and Other Open

Source Repositories

  • MS CodePlex, SourceForge,

…

  • More automation in tools
  • Real-time detection and

exploitation

  • Google worms

F U T U R E D I R E C T I O N S

slide-51
SLIDE 51

Real-time Updates

  • F U T U R E D I R E C T I O N

S

slide-52
SLIDE 52

Questions? Ask us something We’ll try to answer it.

For more info: Email: contact@stachliu.com Stach & Liu, LLC www.stachliu.com

slide-53
SLIDE 53

Thank You