funsec mailing list archives
more than just malware.. [was: Google Malware Search]
From: Gadi Evron <ge () linuxbox org>
Date: Tue, 18 Jul 2006 09:15:20 -0500 (CDT)
Guys, HD and the guys at Websense are obviously very cool for noting this Google hacking technique and exploiting it (HD publicly). Still, this thing can be used far and wide.. a lot more than just for known signatures of malware, etc. I was lucky enough to be playing with this for a bit before Websense went completely public and HD made it public, so I came up with a few more possibilities... Also, I have cool friends who played with this and gave me some ideas too! :) A few examples I gave in my blog on this, inspired by Websense and then HD's new tool, is to look for other signatures rather than just known stuff. For example, looking for UPX packers results in almost 10K suspect samples: signature: 00004550 UPX1 The PE binary part, and then the UPX section named UPX1. Trying other combinations, possibly along with the filetype: feature, can result in many interesting findings other than known malware. How many packers and protection systems are out there for starters? Also, tried any checks for open directory indexes? :) I wrote more about this on my blog at securiteam: http://blogs.securiteam.com/index.php/archives/513 Gadi. _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.
Current thread:
- more than just malware.. [was: Google Malware Search] Gadi Evron (Jul 18)
- corporate uses for Google malware finding, etc. [was: more than just malware..] Gadi Evron (Jul 18)
- Re: corporate uses for Google malware finding, etc. [was: more than just malware..] Valdis . Kletnieks (Jul 18)
- Microsoft buys Winternals Larry Seltzer (Jul 18)
- Re: corporate uses for Google malware finding, etc. [was: more than just malware..] Dude VanWinkle (Jul 18)
- corporate uses for Google malware finding, etc. [was: more than just malware..] Gadi Evron (Jul 18)