Slashdot Mirror
Google Bots Doing SQL Injection Attacks
ccguy writes "It seems that while Google could really care less about your site and has no real interest in hacking you, their automated bots can be used to do the heavy lifting for an attacker. In this scenario, the bot was crawling Site A. Site A had a number of links embedded that had the SQLi requests to the target site, Site B. Google Bot then went about its business crawling pages and following links like a good boy, and in the process followed the links on Site A to Site B, and began to inadvertently attack Site B."
You don't disallow Bing bots from your robots.txt? I have yet to work at a place that doesn't. It's a well known fact that anything Google indexes, Bing will copy shortly after, so you don't need the extra useless traffic to let another crawler do things EXTREMELY poorly (as evidenced by OP).