Google Hack Honeypot

(via Google Blogoscoped)
In reaction to increasing reports of malicious Google hacks, a new tool called "Google Hack Honeypot" has been released to "provide reconaissance against attackers that use search engines as a hacking tool against your resources."

The Google Hack Honeypot (GHH) is a reaction to a new type of malicious web traffic: search engine hackers. GHH is designed to provide reconaissance against attackers that use search engines as a hacking tool against your resources. GHH implements honeypot theory to provide additional security to your web presence. Coded in PHP and released under the GNU General Public License - GHH is Free Open Source Software.

Google has developed a powerful tool. The search engine that Google has implemented allows for searching on an immense amount of information. The Google index has swelled past 8 billion pages [February 2005] and continues to grow daily. Mirroring the growth of the Google index, the spread of web-based applications such as message boards and remote administrative tools has resulted in an increase in the number of misconfigured and vulnerable web apps available on the Internet.

These insecure tools, when combined with the power of a search engine and index which Google provides, results in a convenient attack vector for malicious users. It is in your best interest to be knowledgable of, and protect yourself from this threat.

The Google Hack phenomenon has caught the attention of a broad audience. While there are many practical uses for Google Hacks, there are also devious and possibly harmful uses of the same technology. An emerging community of malicous Google Hackers has formed up and a response has become necessary. GHH allows administrators to track malicious hosts: observe who is perpetrating the attack and how it is being executed via log file. The data generated by this, or any other honeypot can be used to deny future access to attackers, notify service providers of attacks originating from their networks or act as an input for statistical analysis.

Technorati tag: Google