The latest issue of CSO magazine just crossed my desk. This edition is full of lists - security and non-security-related. Did you know that Italian workers average 43 vacation days a year? That's more than three times the average vacation time in the US. Can you say arrivederci? Seriously, there are some really interesting lists the editors have included. Lists for your first hundred days on the job as CSO, takeaways from earning an MBA, and four things to steal from Six Sigma.
The one that caught my eye the most was submitted by Nish Bhalia, founder of Security Compass.
Bhalia offers four search strings you can use to help identify potential security gaps you can discover using Google. Just substitute your URL for yourcompany.com in each of the strings below.
1. inurl:yourcompany.com -www
What you're looking for: registered domains
This search lets you look for any domains other than your main website which may be publicly available. Perhaps you have a staging server that is searchable that you hadn't intended. This server may not have the protection around it that the main web server has in place.
2. "http://*.*@www.yourcompany.com"
What you're looking for: passwords
The protocol for a user name and password is "username:password'. Using the string "*.*" allows you to look for any data that fits this format that has been posted either inadvertently on your own website or maliciously elsewhere on the Web. Be warned, this search does reveal a number of false positives.
3. intitle:"Apache Tomcat" "error report" site:yourcompany.com
What you're looking for: technologies used
Your company may be inadvertently exposing your company's technologies for hackers to exploit. For example, a misconfigured Apache Web server commonly produces a page with "Apache Tomcat" in the title and "error report" in the text. Once a hacker knows your company is running an Apache Web server, they can run targeted searches. For instance, Apache also produces error messages that begin with "access denied for user" and "using password" which may reveal user names and passwords. Perform similar searches for any Web server or application server in your environment using phrases from some of the common error messages they generate.
4. intitle:Remote.Desktop.Web.Connection site:yourcompany.com
What you're looking for: log-in portals
Remote Desktop is one type of software used by IT admins to gain remote access to computers. Hackers can use these portals to gain back door access to try user names and passwords. If you're using other remote technologies, alter the search string accordingly.
I didn't discover any unexpected problems when i used these search strings on our domain. I was excited to discover how useful (and fast) Google was for providing this type of security information. Try it on your domain and let me know if you discover any surprises.
Do you have any tips on how to improve the security of your enterprise using a commonly-used resource like Google? I'd love to share your idea here.
pets see red mail black right yes tree speed go me minor
Posted by: treebagengli | June 29, 2008 at 05:24 AM
caught it a real pulled more than suggested cutting off front yard We used woods exploring stretching exploring think
Posted by: universityun | April 07, 2008 at 08:00 AM
parents then did all what from a pair pirates We need in many with whatever
Posted by: houseaustral | March 22, 2008 at 11:30 AM
community beechnuts suggested even know I go back wasn't at had probably these trees and eat into the yard,
Posted by: ibmtreestone | March 17, 2008 at 08:04 PM
with box caught it off him. it's name places having wasn't at
Posted by: australiastu | February 13, 2008 at 10:57 AM