1 / 14

SEARCH ENGINE ATTACKS to dig Out sensitive information

SEARCH ENGINE ATTACKS to dig Out sensitive information. By Creighton Linza for IT IS 3200. Introduction. Search Engine an information retrieval system that searches its database for matches based on a query Web Crawler a program or script that automatically browses the web. Introduction.

calvin-holcomb
Télécharger la présentation

SEARCH ENGINE ATTACKS to dig Out sensitive information

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. SEARCH ENGINE ATTACKSto dig Out sensitive information By Creighton Linza for IT IS 3200

  2. Introduction • Search Engine • an information retrieval system that searches its database for matches based on a query • Web Crawler • a program or script that automatically browses the web

  3. Introduction • Search Engine Attacks • Passive • Stealth • Have the ability to use the ‘huge memory’ of the internet

  4. Main Issues • Exploits in software used to secure databases • ‘Simple’ Identity theft • Little information required to get the attacker going • Financial threats

  5. Who benefits from this research? • The Good • Security personnel • Individual Users • The Bad • Hackers • Solicitors

  6. Who has worked with this research? • Founders of Search Engine Attacks • Oliver Peek • Kristjan Lepik • What they did • Found press releases in advance • Overall made 7.8 million dollars

  7. Examples of attacks

  8. General Attacks • Search for Passwords • “index of” htpasswd / passwd • filetype:xls + Search Terms • “WS_FTP.LOG” • Web help forums

  9. General Attacks (cont’d) • Google cache • Bad for those who thought their problem was fixed • Google Code Search • Exploitable code • Common files and directories • “index of” “listener.ora”

  10. Database Attacks • Potentially vulnerable web applications searched for via a search engine • Allow for advanced, specific, target-oriented searching • Use exploits to attack holes • ‘Protected’ databases found completely exposed by web crawlers

  11. Oracle Attacks Example • Oracle servers/database attack on iSQLPlus • Java servlet that listens on port 7777 or 5560 • If either port is exposed to the internet • Web server and applications can be inventoried by a web crawler • A route to access an internal database is created • From here, user accounts can be easily stolen • Do-it-yourself • allinurl: “/isqlplus”

  12. CONCLUSION

  13. What can be improved • Latest updates and patches • Disable directory browsing • No sensitive information online • Unless using proper authentication • Analyze server’s log for web crawler’s access • Ask the search engine provider to remove any necessary content

  14. Conclusion • Web Crawler program/script overhaul • Google Webmaster Tools • More security • Workload • WYSIWYG (me)

More Related