Lord of the Bing. Taking Back Search Engine Hacking From Google and Bing. 18 MAY 2011 TakeDownCon 2011 Dallas, TX

Transcription

1 Lord of the Bing Taking Back Search Engine Hacking From Google and Bing 18 MAY 2011 TakeDownCon 2011 Dallas, TX Presented by: Francis Brown Stach & Liu, LLC

2 Agenda O V E R V I E W Introduction/Background Advanced Attacks Google/Bing Hacking Advanced Defenses Google/Bing Hacking Alerts Other OSINT Attack Techniques Future Directions 2

3 Introduction/ Background G E T T I N G U P T O S P E E D 3

4 Open Source Intelligence S E A R C H I N G P U B L I C S O U R C E S OSINT is a form of intelligence collection management that involves finding, selecting, and acquiring information from publicly available sources and analyzing it to produce actionable intelligence. 4

5 Google/Bing Hacking S E A R C H E N G I N E A T T A C K S 5

6 Google/Bing Hacking S E A R C H E N G I N E A T T A C K S Bing's source leaked! class Bing { public static string Search(string query) { return Google.Search(query); } } 6

7 Attack Targets G O O G L E H A C K I N G D A T A B A S E Advisories and Vulnerabilities (215) Error Messages (58) Files containing juicy info (230) Files containing passwords (135) Files containing usernames (15) Footholds (21) Pages containing login portals (232) Pages containing network or vulnerability data (59) Sensitive Directories (61) Sensitive Online Shopping Info (9) Various Online Devices (201) Vulnerable Files (57) Vulnerable Servers (48) Web Server Detection (72) 7

8 Attack Targets G O O G L E H A C K I N G D A T A B A S E Old School Examples Error Messages filetype:asp + "[ODBC SQL "Warning: mysql_query()" "invalid query Files containing passwords inurl:passlist.txt 8

9 Quick History G O O G L E H A C K I N G R E C A P Dates Event 2004 Google Hacking Database (GHDB) begins May 2004 Foundstone SiteDigger v1 released 2005 Google Hacking v1 released by Johnny Long Jan Foundstone SiteDigger v2 released Feb. 13, 2005 Google Hack Honeypot first release Jan. 10, 2005 MSNPawn v1.0 released Dec. 5, 2006 Google stops issuing Google SOAP API keys 9

10 Quick History G O O G L E H A C K I N G R E C A P Dates Event Mar Bing disables inurl: link: and linkdomain: Nov. 2, 2007 Google Hacking v2 released Mar cdc Goolag - gui tool released Sept. 7, 2009 Google shuts down SOAP Search API Nov Binging tool released Dec. 1, 2009 FoundStone SiteDigger v 3.0 released 2010 Googlag.org disappears 10

11 Advanced Attacks W H A T Y O U S H O U L D K N O W 11

12 Diggity Toolkit S T A C H & L I U T O O L S Google Diggity Uses Google AJAX API Not blocked by Google bot detection Does not violate Terms of Service Can leverage Bing Diggity Uses Bing 2.0 SOAP API Company/Webapp Profiling Enumerate: URLs, IP-to-virtual hosts, etc. Bing Hacking Database (BHDB) Vulnerability search queries in Bing format 12

13 SearchDiggity Updates S T A C H & L I U T O O L S New Features Auto-update for dictionaries Will begin updating google/bing dorks Output formats Now also XLS and HTML exports Help File chm file added New Tool Tabs Bing LinkFromDomain Footprinting Leverages linkfromdomain: directive to identify external links Identify other apps, hosts, domains potentially belonging to target Google Code Search Diggity Identifies code vulnerabilities within open source projects 13

14 N E W G O O G L E H A C K I N G T O O L S DEMO 14

15 Google Diggity D I G G I T Y T O O L K I T 15

16 Bing Diggity D I G G I T Y T O O L K I T 16

17 Auto-Update Feature S L D B U P D A T E S SLDB Updates in Progress Example: SharePoint Google Dictionary GoogleDiggity Dictionary File 17

18 Auto-Update Feature 3 RD P A R T Y I N T E G R A T I O N New maintainers of the GHDB 09 Nov

19 Bing LinkFromDomain D I G G I T Y T O O L K I T 19

20 GoogleScrape Diggity D I G G I T Y T O O L K I T GoogleScrape Diggity Uses Google mobile interface Light-weight, no advertisements Violates Terms of Service Bot detection avoidance Distributed via proxies Spoofs User-agent and Referer headers Random &userip= value Across Google servers 20

21 Bing Hack Database A T T A C K Q U E R I E S BHDB Bing Hacking Data Base First ever Bing hacking database Bing hacking limitations Disabled inurl:, link: and linkdomain: directives in March 2007 No support for ext:, allintitle:, allinurl: Example - Bing vulnerability search: GHDB query "allintitle:netscape FastTrack Server Home Page" BHDB version intitle: Netscape FastTrack Server Home Page" Limited filetype: functionality Only 12 extensions supported 21

22 BaiduDiggity C H I N A S E A R C H E N G I N E COMING SOON! 22

23 BaiduDiggity C H I N A S E A R C H E N G I N E Fighting back 23

24 Traditional Defenses G O O G L E H A C K I N G D E F E N S E S Google Hack yourself organization Employ tools and techniques used by hackers Remove info leaks from Google cache Using Google Webmaster Tools Regularly update your robots.txt. Or robots meta tags for individual page exclusion Data Loss Prevention/Extrusion Prevention Systems Free Tools: OpenDLP, Senf Policy and Legal Restrictions 24

25 Traditional Defenses G O O G L E H A C K I N G D E F E N S E S Google Hack yourself organization Employ tools and techniques used by hackers Remove info leaks from Google cache Using Google Webmaster Tools Regularly update your robots.txt. Or robots meta tags for individual page exclusion Data Loss Prevention/Extrusion Prevention Systems Free Tools: OpenDLP, Senf Policy and Legal Restrictions 25

26 Advanced Defenses P R O T E C T Y O N E C K 26

27 Existing Defenses H A C K Y O U R S E L F Tools exist Convenient Real-time updates Multi-engine results Historical archived data Multi-domain searching 27

28 Advanced Defenses N E W H O T S I Z Z L E Stach & Liu now proudly presents: Google Hacking Alerts SharePoint Hacking Alerts 118 dorks Bing Hacking Alerts 28

29 Google Hacking Alerts A D V A N C E D D E F E N S E S Google Hacking Alerts All hacking database queries using Real-time vuln updates to >2400 hack queries via RSS Organized and available via importable file 29

30 Google Hacking Alerts A D V A N C E D D E F E N S E S 30

31 Bing Hacking Alerts A D V A N C E D D E F E N S E S Bing Hacking Alerts Bing searches with regexs from BHDB Leverage &format=rss directive to turn into update feeds Real-time vuln updates to >900 Bing hack queries via RSS 31

32 Bing/Google Alerts L I V E V U L N E R A B I L I T Y F E E D S World s Largest Live Vulnerability Repository Daily updates of ~3000 new hits per day 32

33 Bing/Google Alerts T H I C K C L I E N T S T O O L S Google/Bing Hacking Alert Thick Clients Google/Bing Alerts RSS feeds as input Allow user to set one or more filters e.g. yourcompany.com in the URL Several thick clients being released: Google Desktop Gadget OS independent client Droid app (coming soon) 33

34 A D V A N C E D D E F E N S E T O O L S DEMO 34

35 New Defenses G O O G L E / B I N G H A C K A L E R T S Tools exist Convenient Real-time updates Multi-engine results Historical archived data Multi-domain searching 35

36 Other OSINT Attacks W H A T Y O U S H O U L D K N O W 36

37 Google Apps Explosion S O M A N Y A P P L I C A T I O N S T O A B U S E 37

38 Google Code Search V U L N S I N O P E N S O U R C E C O D E Regex search for vulnerabilities in public code Example: SQL Injection in ASP querystring select.*from.*request\.querystring 38

39 G O O G L E C O D E S E A R C H H A C K I N G DEMO 39

40 Google Code Search V U L N S I N O P E N S O U R C E C O D E 40

41 Google Code Search V U L N S I N O P E N S O U R C E C O D E 41

42 Black Hat SEO S E A R C H E N G I N E O P T I M I Z A T I O N Use popular search topics du jour Pollute results with links to badware Increase chances of a successful attack 42

43 Google Trends B L A C K H A T S E O R E C O N 43

44 Malware Ads B L A C K H A T A D S 44

45 Defenses B L A C K H A T S E O D E F E N S E S Malware Warning Filters Google Safe Browsing Microsoft SmartScreen Filter Yahoo Search Scan Sandbox Software Sandboxie (sandboxie.com) Dell KACE - Secure Browser Office 2010 (Protected Mode) Adobe Reader Sandbox (Protected Mode) No-script and Ad-block browser plugins 45

46 Google Trends O T H E R I N T E R E S T I N G 46

47 Google Trends O T H E R I N T E R E S T I N G 47

48 Google Trends P R E D I C T I N G E L E C T I O N S 48

49 Mass Injection Attacks M A L W A R E G O N E W I L D Malware Distribution Woes Popular websites victimized, become malware distribution sites to their own customers 49

50 Mass Injection Attacks M A L W A R E G O N E W I L D Malware Distribution Woes LizaMoon April2011 Popular websites victimized, become malware distribution sites to their own customers 50

51 Future Direction P R E D I C T I O N S 51

52 Predictions F U T U R E D I R E C T I O N S Data Explosion More data indexed, searchable Real-time, streaming updates Faster, more robust search interfaces Google Involvement Filtering of search results Better GH detection and tool blocking Renewed Tool Dev Google Ajax API based Bing/Yahoo/other engines Search engine aggregators Google Code and Other Open Source Repositories MS CodePlex, SourceForge, More automation in tools Real-time detection and exploitation Google worms 52

53 Real-time Updates F U T U R E D I R E C T I O N S 53

54 Predictions Update G O O G L E R E A L T I M E / I N S T A N T 54

55 Predictions Update S E E M S S T R A N G E L Y F A M I L I A R Google Safe Browsing Alerts for Network Administrators Google s new service which greatly resembles MalwareDiggity Imitation is the sincerest form of flattery 55

56 Youtube Info Leak Y O U T U B E + S E N S I T I V E I N F O D I S C L O S U R E 56

57 Questions? Ask us something We ll try to answer it. For more info: Project: Stach & Liu, LLC

58 Thank You Stach & Liu Google Hacking Diggity Project info: 58