lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.LNX.4.21.0607180923580.1369-100000@linuxbox.org>
Date: Tue, 18 Jul 2006 09:26:12 -0500 (CDT)
From: Gadi Evron <ge@...uxbox.org>
To: full-disclosure@...ts.grok.org.uk
Cc: funsec@...uxbox.org
Subject: corporate uses for Google malware finding,
 etc. [was: [funsec] more than just malware..]

A couple more notes...
This can have significant uses for corporations. For example, finding lost
source code by using the filetype: feature, or as Dude already mentioned
on this thread, to find wrongly named executables.

Also, using the site: feature can help corporations search their websites
for executables for potential AUP violations or compromises.

Really, the sky is the limit even if this is not the holy
grail. It's... cool.

	Gadi.

On Tue, 18 Jul 2006, Gadi Evron wrote:
> Guys, HD and the guys at Websense are obviously very cool for noting this
> Google hacking technique and exploiting it (HD publicly).
> 
> Still, this thing can be used far and wide.. a lot more than just for
> known signatures of malware, etc.
> I was lucky enough to be playing with this for a bit before Websense went
> completely public and HD made it public, so I came up with a few more
> possibilities...
> Also, I have cool friends who played with this and gave me some ideas
> too! :)
> 
> A few examples I gave in my blog on this, inspired by Websense and then
> HD's new tool, is to look for other signatures rather than just known
> stuff.
> 
> For example, looking for UPX packers results in almost 10K suspect
> samples:
> signature: 00004550 UPX1
> 
> The PE binary part, and then the UPX section named UPX1.
> 
> Trying other combinations, possibly along with the filetype: feature, can
> result in many interesting findings other than known malware. How many
> packers and protection systems are out there for starters?
> 
> Also, tried any checks for open directory indexes? :)
> 
> I wrote more about this on my blog at securiteam:
> http://blogs.securiteam.com/index.php/archives/513
> 
> 	Gadi.
> 
> _______________________________________________
> Fun and Misc security discussion for OT posts.
> https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
> Note: funsec is a public and open mailing list.
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ