Worms turn on Google to hunt for victims

The latest 'Google hack' uses the search tool for automated vulnerability detection

Malware authors are increasingly creating digital pests that use Google to find their next victim.

Using the search tool for automated vulnerability detection is the latest trend in a technique known as 'Google hacking'.

George Kurtz, senior vice president for risk management at security firm McAfee, told vnunet.com about the phenomenon after a presentation at the RSA Conference in San José.

The Santy.a worm, for instance, targeted a known vulnerability in some versions of the phpBB open source bulletin board application to deface websites. It found its victims through an automated Google search query.

Google eventually stopped the worm from spreading by blocking all searches that would turn up servers running the application. But the search engine is able to detect the abuse only if the queries stand out from other searches.

Google 'hacking' does not mean breaking into the company's servers but involves online criminals using Google and other search engines to find sensitive information on the internet.

Hackers have used search engines to assist in break-ins ever since the creation of online search.