Search engines ˝at the service˝ of hackers

Madrid, August 4, 2004 - In today´s Oxygen3 24h-365d, we are going to look at how the power of Internet search engines, which allow users to query a huge amount of data collected from websites, can be exploited by attackers. A recent example is the Mydoom.N worm, which harvested e-mail addresses to send itself out to from the queries of popular search engines like Lycos, Altavista, Yahoo and Google.

Search engines usually have programs called robots, which constantly scan websites and collect information. To prevent search engines from automatically indexing certain files -which, for some reason or other, must not be consulted-, there is a protocol that determines which parts of a website the robots must not visit.

Hackers´ use of search engines usually focuses on exploiting vulnerabilities in the website in order to steal files containing confidential information, such as the source code of applications or passwords. The majority of attacks are usually caused by application programming errors, or the carelessness of webmasters. The golden rule for avoiding this type of attack is to ensure that no confidential information can be accessed through the website without requiring authentication details or without applying other types of security mechanisms.

Oxygen3 24h-365d, by Panda Software
© Panda Software 2003

2004-08-05 11:26

Back

IT News: