Attackers finding new ways to automate the hunt for vulnerabilities, Imperva researchers say.
Google, hackers have discovered, is very good at finding Web-facing security vulnerabilities. But searching for one vulnerability at a time can be slow--so it's time to automate.
Attackers are now using botnets and Google "dorks"--clearly-defined search parameters--to speed the process of finding exploitable flaws on the Internet, according to a new report issued by researchers at Imperva Tuesday.
"What the hackers are doing is building an army of zombies to perform automated cyber reconnaissance," said Noa Bar Yosef, senior security strategist at Imperva. "This makes the Google search much more efficient, and it also makes it harder to detect, because each zombie only issues two to four queries per minute, which is not enough to raise a red flag."
"Search engines can be directed to return results that are focused on specific potential targets by using a specific set of query operators," the Imperva report explains. "For example, the attacker may focus on all potential victims in a specified geographic location. In this case, the query includes a "location" search operator.
"In another scenario, an attacker may want to target all vulnerabilities in a specific website, and achieves this by issuing different queries containing the 'site' search operator," the report continues. "These particular search queries are commonly referred to as 'Google dorks,' or simply 'dorks.'
"Automating the query and result parsing enables the attacker to issue a large number of queries, examine all the returned results, and get a filtered list of potentially exploitable sites in a very short time and with minimal effort," the report states.
In this new Tech Center report, we profile five database breaches--and extract the lessons to be learned from each. Plus: A rundown of six technologies to reduce your risk. Download it here (registration required).
Dark Reading Tech Digest, Dec. 19, 2014Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Published: 2014-12-26 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-2062. Reason: This candidate is a reservation duplicate of CVE-2010-2062. Notes: All CVE users should reference CVE-2010-2062 instead of this candidate. All references and descriptions in this candidate have been removed to pre...
Published: 2014-12-26 Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) A/52, (2) DTS, or (3) MPEG Audio decoder.
Published: 2014-12-26 VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) ASF, or (3) Matroska (aka MKV) demuxer.
Published: 2014-12-26 The parse_track_node function in modules/demux/playlist/xspf.c in the XSPF playlist parser in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty location element in an XML Shareable Playlist Format...
Published: 2014-12-26 The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive.