[ISN] Hackers use Google to access photocopiers

[InfoSec News]

http://news.zdnet.co.uk/internet/security/0,39020375,39167848,00.htm

[The Google Hacking Database (GHDB) @ http://johnny.ihackstuff.com/ 
will fill in any blanks this story is missing.   - WK]


Dan Ilett
ZDNet UK
September 24, 2004

Hackers are using search engines to watch what people photocopy. 

Using Google hacks -- requests typed into the search engine that bring 
up cached information on networks -- hackers are discovering and using 
login details for networked photocopiers so they can watch what is 
being copied. 

"You don't have to be a genius to do this," said Jason Hart, security 
director at Whitehat UK. "You can see what people are photocopying on 
your monitor. You just have to search for online devices on Google." 

Google stores billions of Web URLs and information sent from Web 
servers. Some Web servers, if configured incorrectly or left to 
default, can accidentally broadcast network information, such as IP 
addresses, login details and device information. Google, like many 
other search engines, stores this information, which can be recalled 
at any time. 

"Essentially Google caches everything on the Web," said Hart. "By 
inputting commands into Google you can extract information and use it 
as a reverse-engineering tool." 

Hackers have been using Google hacks for some time -- exploiting 
photocopiers is only a recent example of compromising online devices. 
Hackers also use the search engine to view logged conversations on the 
Google computer groups list. In these, techies often share network 
information, such as logins, and their company domain name when they 
post their email address with a message. 

Hart added: "If you look at a firm's domain you can see all their 
security questions which means you can see their network 
infrastructure. [Hackers] wait for people to come along and say: 'I've 
been put in charge of security but don’t know much. Can you help me?' 
The hacker helps out and gets their trust until they get the passwords 
to the firewalls." 

Hart advised that security staff should regularly check Google for 
cached information on their firms' domain names. He said that if using 
public forums to solve problems, participants should sign in using an 
anonymous e-address. 

"You can ask Google to take certain information off its site," said 
Hart. "It's always worth taking a look at. It's a simple check, but 
worthwhile."