'Diggity' family of search tools will help security teams and pen testers find searchable flaws before bad guys, Stach & Liu researchers say.
Go Google-hack yourself.
No, it's not a curse. It's a bit of advice being prepared by two researchers who will present a new batch of search engine-based hacking tools at the Black Hat USA conference in Las Vegas next month.
Fran Brown and Rob Ragan, both researchers at the consulting firm Stach & Liu, are planning to roll out a series of tools--dubbed "Diggity"--that speed the process of finding security vulnerabilities via Google or Bing. The tools are designed to help enterprises "Google hack" themselves to identify potential avenues of attack before the bad guys do.
"We wanted to find a way to bring search engine hacking back into light because it's a pretty effective method of finding vulnerabilities, and we see it being used more and more [by malicious attackers]," Ragan said.
Indeed, just last week, the Stach & Liu researchers offered evidence that the LulzSec hacker group used Google hacking to choose its targets during its run of hacks on the websites and databases of well-known companies and government organizations.
At Black Hat, the researchers will demonstrate how enterprises can use Google hacking tools on themselves to expose flaws in their data and applications that might be found using a search engine. The tools--each of which carries the name "Diggity"--enable enterprises to search across multiple domains to identify Google-searchable flaws that might lead to common attacks, such as SQL injection and cross-site scripting.
"You can do this yourself with Google, but you would typically have to do it on one domain at a time, and that can be incredibly time-consuming when you're an enterprise that has hundreds of domains," Brown says.
Brown compares the Diggity tools to an intrusion detection system that searches for known attacks.
Black Hat USA 2011 presents a unique opportunity for members of the security industry to gather and discuss the latest in cutting-edge research. It happens July 30-Aug. 4 in Las Vegas. Find out more and register.
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.
As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Published: 2014-10-30 Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.
Published: 2014-10-30 SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.
Published: 2014-10-30 The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.
Published: 2014-10-30 Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...