Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

6/9/2016
11:00 AM
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Google Dorking: Exposing The Hidden Threat

Google Dorking sounds harmless, but it can take your company down. Here's what you need to know to avoid being hacked.

Virtually everyone uses Google or other search engines, but what most people don't know is that these search engines can perform advanced queries that are exploited to carry out successful cyberattacks.

For example, earlier this year, a cyberattack by suspected Iranian hackers made headlines when they used a simple technique called Google Dorking to access the computer system that controlled a water dam in New York. Google Dorking is readily available and has been used by hackers for many years to identify vulnerabilities and sensitive information accessible on the Internet.

Since its inception, the capabilities in Google Dorking have been added to other search engines, including Bing, Baidu, and Open Source Network Intelligence Tools (OSNIT) such as Shodan and Maltego.

Google Dorking, however, isn’t as simple as performing a traditional online search. It uses advanced operators in the Google search engine to locate specific information (e.g., version, file name) within search results. The basic syntax for using an advanced operator in Google is Operator_name: keyword

The use of advanced operators in Google is referred to as “Dorking” and the strings themselves are called “Google Dorks.” Dorks can be as basic as just one string, or they can be a more complex combination of multiple advanced operators in a single search string. Each Dork has a special meaning to the Google search engine that enables hackers and others to filter out unwanted results and significantly narrow down search results. For example, Google Dorks can be used to find administrator login pages, user names and passwords, vulnerabilities, sensitive documents, open ports, email lists, bank account details, and more.

Anyone with a computer and Internet access can easily learn about the availability of advanced operators on Wikipedia or via other public sources. Therefore, it’s not surprising that federal authorities say it is increasingly being used by hackers to identify computer vulnerabilities in the United States. The Department of Homeland Security and the FBI in 2014 issued a special security bulletin warning the commercial sector about the risks of Google Dorking.

The underlying threat associated with Google Dorking is that search engines are constantly crawling, indexing, and caching the Internet. While most of this indexed data is meant for public consumption, some is not and is unintentionally made “accessible” by search engines. As a result, a misconfigured intranet, or other confidential information resource, can easily lead to unintended information leakage.

Considering how easy it is for cybercriminals to access sensitive information via public search engines and security tools raises an important question: What can organizations do to minimize the risk of being hacked via Google Dorking?

The first step is to avoid putting sensitive information on the Internet. If unavoidable, assure that the data is password-protected and encrypted. In addition, make sure that websites and pages that contain sensitive information cannot be indexed by search engines. For example, GoogleUSPER provides tools to remove entire sites, individual URLs, cached copies, and directories from Google’s index. Another option is to use the robots.txt file to prevent search engines from indexing individual sites, and place it in the top-level directory of the Web server.

More important, organizations should implement routine Web vulnerability testing as part of standard security practices. In this context, Google Dorking can be a proactive security tool using online repositories like the Google Hacking Database (GHDB), which documents the expanding number of search terms for files containing user names, vulnerable servers, and even files containing passwords. The database provides access to Google Dorks contained in thousands of exploit entries. The direct mapping between Google Dorks and publicly available data allows security professionals to more rapidly determine if a particular web application contains these exploits.

The Google Dorking phenomenon once again underscores how organizations must not only test for vulnerabilities, but also assess whether they can be exploited, and what risks they represent. This is best achieved when vulnerability assessment, penetration test, and a cyber-risk analysis are performed hand in hand.

Related Content:

 

 

Dr. Srinivas Mukkamala is co-founder and CEO of RiskSense and a former advisor to the U.S. Department of Defense and U.S. Intelligence Community. He is an expert on malware analytics, breach exposure management, web application security, and enterprise risk reduction. Dr. ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ruchiroshni
50%
50%
ruchiroshni,
User Rank: Apprentice
10/2/2017 | 12:10:03 AM
Re: Still relevant in 2016
Thanks so much for providing this information, it is really helpful, also i have found one platform to learn more on 

cyber security please visit for more information on https://infosecaddicts.com.
ChristopheV560
50%
50%
ChristopheV560,
User Rank: Author
6/9/2016 | 3:03:54 PM
Still relevant in 2016
This was relevant a decade ago, and continues to be, especially given the recent spat of social engineering related attacks. 
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19729
PUBLISHED: 2019-12-11
An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects _bsontype==ObjectID in the user-inpu...
CVE-2019-19373
PUBLISHED: 2019-12-11
An issue was discovered in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can trigger arbitrary unserialization of a PHP object from a packages/cms/page_templates/page_remote_content/page_remote_content.inc POST parame...
CVE-2019-19374
PUBLISHED: 2019-12-11
An issue was discovered in core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_upload.inc in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can delete arbitrary files from the se...
CVE-2014-7257
PUBLISHED: 2019-12-11
SQL injection vulnerability in DBD::PgPP 0.05 and earlier
CVE-2013-4303
PUBLISHED: 2019-12-11
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-s...