Slashdot Mirror
The "Google Hack" Honeypot
An anonymous reader writes "On the heels of Google Hacking for Penetration Testers, and Johnny Long's talks at Blackhat/Defcon over the weekend, comes the "Google Hack" Honeypot, a honeypot designed to lure in malicious search engine activity. They had a second release of their tools on monday, according to their site."
Comment removed based on user account deletion
Wait, they used their tools for penetration testing? And a honeypot? I am going to search google images for penetration, honeypot and tool and see if I can add anything to the discussion
And All I Ask is a Tall Ship And a Star to Steer Her By
Why do I feel so damn inadequate reading this article?
;-)
Because when you read "honey pot" you immediately thought of catching hackers instead of what you should have thought of.
Sad isn't it?
No, this serves to find out how people are using Google to attempt to take control of your stuff (site, servers, etc). By learning more about the methods of attack, we can figure out how to prevent these attacks.
It's the usual hacking cycle brought to the search engine scene. Malicious hackers find ways to penetrate, and this will try to find a way to stop it. When it's stopped, the hackers will just move on to another way. Later, rinse, repeat.
From what I can gather, SquirrelMail 1.4.4 contains a vunerability enabling you to do nasty things. By adding honeypot sites, it makes real sites to hack slightly more difficult if you're trying to find them via Google.
Google hacking is the process of reconnaisance with a target, through the use of google.
What this means, is that an attacker has a target, he can use google to find information/vulnerabilities of this target without actually ever touching the target at all, thereby giving no warning.
It's a much "safer" way of reconnaisance than directly going to a page and attempting trial and error attacks... The attacked has no idea there is any reconnaisance taking place, yet the attacker is finding more and more information about exploiting their target.
"HONEYPOTS"
Honeypots are designed to be in a controlled vulnerable state. You set up a server with known vulernabilities and put it in a controlled area of your network. Depending on the software used, there are various levels of interaction the honeypot will allow. Complicated honeypots can replicate a large network, recording all activities of the attacker and keeping their interest for longer. Simple honeypots only allow basic actions, and the attacker will become bored more quickly and you will get less information./P.
Overclockers
OK, simply:
Tool creates fake web pages that look like vulnerable Web apps.
Google indexes fake pages.
Bad Guy searches Google for likely victims.
Google returns indexes of pages created by tool.
Bad Guy follows links.
Tool logs Bad Guy's IP and other information.
No Profit for Bad Guy.
Good Guys watch Bad Guy try to |-|@><0r the page, and log everything his does.
Good Guys contact Law Enforcement, present evidence.
Good Guys contact Bad Guy's ISP, present evidence.
(now, there are 2 possible outcomes - the ideal and the real.)
Ideal outcome
Law Enforcement goes after Bad Guy.
Bad Guy's ISP shuts Bad Guy down.
Bad Guy gets caught, convicted, and spends several years playing "Hide The Sausage" with his new friend Benjamin Dover the Serial Sodomist.
Real outcome
Law Enforcement ignores evidence as no money was lost.
Bad Guy's ISP ignores evidence as there is no Law Enforcement involvement, and Good Guys are not ISP's customers.
Bad Guy is distracted for a while and doesn't get to |-|@><0r as many systems.
www.eFax.com are spammers
try this search in Google: intitle:index.of "parent directory" *.mp3 This will turn out all mp3s out there on webservers that have directorylisting mistakenly turned on now you can change this to any file type, or any other specific filter that you are looking for. Thats "Google Hacks" in my books.. The honeypot would be to check for those kinds of searches and figure out how to counter them.