Slashdot Mirror
Google Plugs Hole That Lets You Remove Any Website
blowdart writes "Google today disabled their webmaster tools after it was discovered that anyone could use the tool to remove any site from the google index. The exploit was pretty simple, all anyone had to do was to have a google webmasters tool account and edit a query string parameter on a valid removal to point to a domain they didn't own!"
this hole was open long enough for someone to remove Expert Exchange & all the other BS...
/. was already removed from the internet. That's why no one is commenting.
Come to think of it, how did I get here? Where am I? I'm old.
Absolute power corrupts absolutely. indymedia
http://www.google.com/search?q=picard+facepalm&tbm=isch
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Obligatory XKCD
Time to offend someone
http://www.supersecurewebsoftware.com/adminPages.aspx?admin=true&customeraccountaccess=true&warmfuzzyfeeling=true
Two of my imaginary friends reproduced once
Well, this is pretty bad, though I imagine it probably happened because one webmaster could control multiple domains that look dissimilar, and they forgot to add checks to make sure that the webmaster really controlled the requested one. Oops. Nowhere near as bad as this, which was simple gross, heads-should-roll, incompetence, but still a pretty big mistake. Kinda sad that address bar "hacks" still work in this day and age. Especially at a company like Google.
Looks like the removal isn't permanent, either, just temporary, so take that for what its worth. Still, wow, a malicious user could do serious damage to a lot of websites with this.
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
What if someone used this exploit to remove Google.com? Then my parents couldn't enter 'google' in the white box (Google homepage) to get to 'the internet'!
Agh. I think my head exploded.
"I love animals! Some are cute, others are tasty, what's not to like?" - Betsy Schroeder, Jeopardy contestant
The author of this 'xploit' would have gotten more attention from Google if he tried removing 'google.com' and some other domains that belong to the company.
I think this is the closest one could get to breaking the Internet by 'typing google into google'.
You can't handle the truth.
Stackoverflow still gives you better answers. I see no reason to even get their answers for free.
By the way, google should remove experts exchange, they give the googlebot the answer but try to hide from regular users.
Democracy Now! - your daily, uncensored, corporate-free
.... This hole in Google's code doesn't affect the general availability of your site. It affects whether or not the site is contained in Google's index.
how is babby formed?
An awful lot of sites depend on visitors from search engines. No visitors = no business, so if you can block competing sites from the index (and thus from results), your business will be hurt badly.
I understand that. :) The way AC phrased it gives me the impression that they're referring to general availability of the site to the open Internet, not indexability.
how is babby formed?
One wonders if Google can trace anyone who has previously used this technique to remove competitors from the index.
It would be fascinating to see just who has been a bad boy.
------ The best brain training is now totally free : )
With the security hole plugged, people who wish to remove their erroneous information online will need to use paid service such as Reputation Defender. I bet how much did RD paid to Google to get this fixed?
Twitter: @dainsanefh
The whole point of URLs is to allow people to Locate a Resource. The whole point of the query string is to have a way to communicate data through a GET request, that way people can access it later. However, I am a firm believer that if you are not going to access something in the future then it shouldn't be in the query string of a get request. One time actions like this or session cookies should not be placed in a query string. POST it to reduce the replayability. Yes, I get that you can still arbitrarily change POST data, but it is more difficult to do then substituting it in the browsers location bar. In addition, it makes a website easier to navigate and send to your friends as all the unnecessary stuff (i.e. parts of the URL not needed to actually navigate to the page) is removed from the URL.
I've read interesting article (Testing at the speed and scale of Google) about continuing integration system used by Google and a blog entry by a former Google employee which claims every line that is checked in at Google gets reviewed. I wonder how this obvious bug got through.
Bye-bye, whitehouse.gov! ;)
Ooops, I see. Probably an attempt to gain some traffic ...
So then if somebody used this exploit to remove sites from Google, does that mean they'll mysteriously disappear from Bing?
=)
/* No Comment */