Slashdot Mirror
Googling Your Way Into Hacking
knifee writes "New scientist is running an article explaining how hackers can use Google's cache to quickly hunt down sensitive pages, for example, by searching the terms "bash history", "temporary" and "password".
Might be worth looking at this tutorial about robots.txt if you think you might be at risk." That's pretty amusing.
For example, one common filename for passwords is "bash history".
/dev/null, just out of habit. The security problem isn't google's fault, it is stupid admin's who don't know what they are doing.
This guy is a security consultant? Come on, what admin in their right mind would enter a password in cleartext on the command line and allow it to be stored in ~/.bash_history? The first thing I do when I log onto a box is link bash_history to
Visualize the world of wine
A quick search for "Password" doesn't yield any "promising" hacking results. It's too common a word.
Colossians 2:8
If something is meant to be private, then why even temporarily put links to it on your publicly visible pages? Additionally, if something really is private, then lock it down in the httpd.conf so that only certain IP addresses can access it. Then, its basically invisible to the rest of the world.
Of course, if there's a bug in your server software all bets are off. Which is why it's better not to put private stuff where it can be seen on a public network.
I would have thought that was pretty obvious.
Just be sure to wear the gold uniform when you beam down -- you know what happens when you wear the red one.
> allows for an admin to see if anyone has compromised security, no?
Only if the compromisors are morons, and have done it "recently".
A non moron would type "HISTFILE=" before exiting a shell he'd been "playing" in.
Do daemons dream of electric sleep()?
Shouldn't that be bash_history, passwd and tmp?
Was this written down by a non-techie from an audio interview?
Regards,
--
*Art
It might be worth it NOT to look at robots.txt -- after all, with robots.txt you effectively disclose to anyone who asks what you don't want to be shown.
/secret/passwd
A robots.txt like this would be invaluable to a hacker, even though it would prevent Google from indexing:
User-agent: *
Disallow:
Regards,
--
*Art
It's supposed to be used to tell bots not to access some parts of your site due to other reasons.
Common reasons would be that you host a site with a forum on a DSL line and don't want google to index all 5000 threads on it. It's also good for dynamic pages, for example it makes no sense to index a generated page that will be out of date tomorrow. It'll be much better to let it index the archive instead.
Using this for security is just stupid though, as it'd contain a list of vulnerable places. Maybe it will make harder for people to find your vulnerabilities from google, but it will help a lot whoever wants to attack you specifically.
Security problems have to be fixed by setting proper permissions and keeping your server up to date, and not by relying on that every spider that comes to your site will be polite enough to follow robots.txt
not all robots download robots.txt. In fact, I'd assume most of the more annoying ones don't, nor do they identify as anything other than MSIE 5.5.
do not read this line twice.
I hope you at least have an .htaccess on the files to put a password on that directory. Hard-to-guess names is good, but making them password protected is better.
/home/*/web folders. They have to be public so the web server can read them. Stupid I know, but all to common. Config.php for most apps will have all the users passwords in plaintext.
Of course on some of the cheaper web hosting companies out there you can just search the
The HTTPD user should be a member of each users group so you don't have to set world rights to your files. Assuming it's just hosting and no other rights are required.
If you want to control the distribution of your work, don't publish it for free in a public place. That is your choice.
Your reference to usenet is laughable but common. Who should determine how long your posts should stay on a news server? Why does it have to stay on a news server? What if I save all messages I read for ever? What if one news server has a 3 year retention but another only has 3 hours? If you don't want your comments to become publicly availalble then don't post them publically. It is really that easy. You don't have to use x-no-archive, but you don't have to post either.
Bad boys rape our young girls but Violet gives willingly.
Actually, that's pretty good, since the Standard for Robot Exclusion was proposed in 1994. I'd say IBM "understood" it several years before most people did.
No, I don't want to explore the Recycle Bin.
And that's why I have a disallow for a trap directory. Accessing it gets you added to a mysql database and you are blocked with iptables.
-- Will program for bandwidth
How long have you been using the Internet, dude? If you put it out there, you should have the reasonable expectation that it's going to stay out there. You can't "unsay" things, even if you change your mind and start to say the opposite. For your own sake, learn this now.
And long before Google, there was Melvil Dewey. So how come this country didn't jail his treasonous copyrighted cataloguing ass back in 1876?
http://www.oclc.org/dewey/
it is not googles responcibility to monitor what other people on the net are doing.
Besides, that sword as 2 sides, if someone intending malace uses google then a law enforcement agency can also use it.
The Kruger Dunning explains most post on