Jump to content

Build Theme!
  • Infected?


Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 92231 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Google's Desktop Search

  • Please log in to reply
1 reply to this topic

#1 New Raider

New Raider

    Authentic Member

  • Banned
  • PipPip
  • 40 posts

Posted 14 October 2004 - 12:50 PM

Google hacks are for real!

Posted by binary_w0lf on 2004/8/7 10:23:54 (58 reads)

Google hacks are for real, regardless of what some uber-hackers may think or say. They can produce passwords, user IDs, credit card numbers, Social Security numbers, bank account numbers and routing codes, and more. They can also be used to troll for vulnerabilities. One quick example: using one of the simplest Google advanced operators in combination with another operator, I quickly found a number of Microsoft IIS 6.0 Authentication Manager pages exposed to the Internet on Army, Navy, state, and federal agency sites. In fact, finding the sites proved to be much easier than alerting them to the vulnerability.

of the slides in Google hacking guru Johnny Long's presentation at the recent Black Hat Briefings used the following search criteria to locate IIS 6.0 Authentication Management pages: inurl:iisadmpwd. I ran that query adding first .mil, and later .gov, to restrict the results to those top-level domains. That's all it took to locate one Army site, two Navy sites, one from the National Institutes of Health, another from the Treasury, and two others from Argonne National Lab.

Is it really a vulnerability just because you can see the pages?

I asked Russ Cooper of NTBugtraq fame that very question. Cooper noted, "The box may be secured, yet that page is exposed for some particular reason. It's not likely; it's more likely that it is an unsecured IIS box. If you are able to get that page, that means that that port is not being restricted. And that port should definitely be restricted."

According to both SecurityFocus and InfoHacking.com, there are multiple vulnerabilities with IIS 6.0 Web-based administration beyond the obvious ability to attempt brute-force password cracks.

A Microsoft spokesperson told NewsForge:

The administration pages you referred to are the password change scripts. These pages are not enabled with IIS 6.0 by default, and enabling this functionality requires additional configuration on the part of the machine administrator. Even when enabled, administrators have the option to choose a secure URL. Microsoft has tested the code extensively for cross-site script vulnerabilities and is not aware of any existing XSS issues.
Brute force attacks are not unique to Microsoft's password change scripts; they're common to any Web-based login application including many Web-based mail systems, e-commerce Web sites and intranet applications. In this specific instance, the account lock-out policy, which locks an account after a specified number of unsuccessful login attempts, is the most straightforward mitigation strategy.

Reporting the vulnerability

After finding the sites mentioned above, I spent considerable time and effort trying to get someone to pay attention to them. Over the past two days I've spoken to the Navy, the National Security Agency, the office of an Undersecretary of the Army, the Department of Defense, and others closer to the actual sites involved. As a result of these calls, the Army site is no longer visible in Google search results, the most vulnerable Navy page has been taken down or moved, and the NIH page -- which it turns out was connected to a test machine -- is also gone. Argonne National Lab told me that its page was deliberately exposed to the Internet, although I noticed afterwards that it has begun protecting the site with a JavaScript warning banner.

It turns out I was going about the process of vulnerability notification all wrong. I should have gone to the United States Computer Emergency Readiness Team to report them.

The US-CERT home page provides an email address for reporting vulnerabilities. If you use it, you will receive more detailed instructions on how to complete this form.

More on Google hacking

As Johnny Long promised during Black Hat and Defcon, he made the latest version of his slide presentation on Google hacking available on his site this week. Unfortunately, it looks as if his site got defaced in response.


Register to Remove

#2 New Raider

New Raider

    Authentic Member

  • Banned
  • PipPip
  • 40 posts

Posted 14 October 2004 - 01:06 PM

Google Unveils Desktop Search, Takes on Microsoft

23 minutes ago

By Lisa Baertlein

MOUNTAIN VIEW, Calif. (Reuters) - Google Inc. (Nasdaq:GOOG - news) on Thursday rolled out a preliminary version of its new desktop search tool, making the first move against its major competitors in the race to provide tools for finding information buried in computer hard drives.

The Google Desktop offering takes direct aim at Microsoft Corp. (Nasdaq:MSFT - news), which bought a desktop search business in July, as well as current and expected desktop product releases from other companies such as Apple Computer Inc. (Nasdaq:AAPL - news), Ask Jeeves Inc. (Nasdaq:ASKJ - news) and Time Warner Inc.'s (NYSE:TWX - news) AOL.

Microsoft, the world's biggest software maker, Yahoo Inc. (Nasdaq:YHOO - news) and Google are all going head-to-head in the Web search market to tap into the advertising revenue generated by ads displayed alongside search results.

Google Desktop allows users to search e-mail in Microsoft Outlook and Outlook Express, chat threads in AOL Instant Messenger, as well as Web pages viewed in Microsoft's Internet Explorer. It also helps users search plain text, Microsoft Word, Excel and PowerPoint files, among other things.

Click on headline for more.

Related Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users