Hackers find use for Google Code Search
85579
(InfoWorld) - Google Inc. has inadvertently given online attackers a new tool. The company'sÂ new source-code search engine, unveiled Thursday as a tool to help simplify life for developers, can also be misused to search for software bugs, password information, and even proprietary code that shouldn't have been posted to the Internet in the first place, security experts said Friday. UnlikeÂ Google's main Web search engine,Â Google Code Search peeks into the actual lines of code whenever it finds source-code files on the Internet. This will make it easier for developers to search source code directly and dig up open-source tools they may not have known about, but it has a drawback. "The downside is that you could also use that kind of search to look for things that are vulnerable and then guess who might have used that code snippet and then just fire away at it," said Mike Armistead, vice president of products with source-code analysis provider Fortify Software Inc. Attackers could also search code for vulnerabilities in password mechanisms, or to search for phrases within software such as "this file contains proprietary," possibly unearthing source code that should never have been posted to the Internet. Security experts say that the security implications of Google Code Search are noteworthy, if not earth-shattering. Skilled hackers may already be able to do this type of search with Google's Web search engine, but Code Search is "another tool that makes it a tad easier for the attacker," said Johnny Long, a security researcher with Computer Sciences Corp, in an e-mail interview. For its part, Google did not have much to say about possible misuse of its new product. "Google recommends developers use generally accepted good coding practices including understanding the implications of the code they implement and testing appropriately," the company said in a statement. Google has never said much about the steps it takes to cut down on this kind of misuse of its search engine, though the issue comes up from time to time.Â In July, Websense Inc. used a little know binary search capability within Google Inc.'s search engine to look for malware on the Internet. While Google Code Search will probably not have much of an effect on popular open-source projects, which are already heavily scrutinized, it could help ferret out vulnerabilities in lesser known pieces of code, according to Lev Toger, a software developer with Beyond Security Ltd. "Using Google's code search, it's much easier to find interesting code portions," he said via e-mail. "If your task is to find vulnerability in some random code, this filtering can save you a lot of time. " Â
241820
Also: Hackers rig Google to deliver malware. See what people are saying on News.com Extra.
701997
Beta search app creates vulnerabilities that may threaten your data's security.
500862
Doomwatchers count the ways If you use Google to send email, organize photos or help administer your website, doomwatchers have cataloged three new ways to steal your data and compromise the security of your users. All three of the techniques rely on cross site scripting, or XSS, in which hackers inject unauthorized code by making it appear as if it's hosted by the website being targeted.â¦
734135
Google's search appliances could expose Web sites that use the products to information-stealing phishing attacks.
406505
HOUSTON - A computer scientist and two of his graduate students at Rice University found a security flaw in a search tool distributed by Google, allowing the popular Web site to fix the problem.
240772
Alternative search sites offer enhanced results for songs, movies, source code, engineering data and more -- for when the Google net spreads too wide.
734847
Google was courting computer programmers with new tools to search out software code and imbed slick &quot;gadgets&quot; on Internet web pages.
329888
Google says it has patched a hole in its search engine that could have allowed hackers to modify the content of the Google search results page, reports PC World.
598555
People who use public or workplace computers for e-mail, instant messaging and Web searching have a new security risk to worry about: Google&#39;s free new tool that indexes a PC&#39;s contents for quickly locating data.
395855
The annual hacker hit parade of the most popular loopholes in computer software has been published.
36786
The search engine sometimes plays "tricks" with its secret page-ranking algorithm.
626155
Google Code Search Exposes WinZip Serial Number Info Found via Digg.com, seems that some simple searches on the new Google Code Search will expose some rather valuable information. One searcher found the serial number algorithms for Winzip, Photoshop and mIRC. &#8220;Just by searching for &#8220;keygen&#8221;, &#8220;serial&#8221;, &#8220;name&#8221;, and some well known cracker groups you can come by [...]
4497
Within days of the release of the security bulletin, there was proof of concept code available on the web. As the exploit was analyzed by various security groups, it was found that it was similar
631942
Google launched another new service this morning, this time to enable software developers to find snippets of public source code that they may integrate into their own projects. But with source code more algebraic than linguistic, is Google's ubiquitous query line the right tool for the job?
113328
Computer scientists have discovered a potentially serious flaw in Google&#39;s desktop search utility that could allow attackers to steal information.
571745
Two Google site vulnerabilities that could be used to mount phishing attacks have been reported, says the Internet search giant. It already has fixed one, and expects to patch the second shortly.