Google as a Vulnerability Scanner
----------------------------------
Todays Post Gonna Be something Different,we know Nowadays There are Many or we Can say various types Scanners Available but herez new Try out!!
DO COMMENT!!
Goolag Scan scours the Web for compromised systems and confidential information. But is it legal?
Google, as everyone knows, excels at helping users find information scattered across the Web. Leveraging this fact, a hacker group known as cDc, or Cult of the Dead Cow, has created a tool that uses Google to automatically scour the Web for compromised systems and confidential information.
A vulnerability scanner is a powerful tool that can be used for both good and evil purposes. The software, which searches and maps applications, computers and networks for existing weaknesses, can be used by an individual or business to spot and fix security holes — or by an attacker to find easy targets. Using Google, and its immense power to drive searches for attack friendly resources, can potentially create the ultimate vulnerability scanner.
Enter Goolag Scan
-----------------------
Goolag Scan, cDc's Google-powered vulnerability scanner, uses selected search queries to uncover links to exposed Web applications, backdoors and documents that contain potentially useful information for attackers. Although skilled hackers have long been able to find such material with their own custom-search techniques, Goolag Scan promises to give the same power to far less knowledgeable individuals, conceivably expanding the ranks of attackers significantly.
Cybersecurity experts have therefore become interested in Goolag Scan. The new software raises the frightening prospect of an automated attacker spider that capitalizes on even the slightest security lapses, pouncing on any trace of system weakness. Such a program could be an extremely powerful tool in the hands of anyone who intends to hijack a digital resource for personal or financial gain.
Letter of the Law
--------------------
Moral issues aside, many security experts are unsure that Goolag Scan is legal. While attacking a computer system with the intent to create damage is illicit almost everywhere, the law is far less clear about whether one can use Google to uncover publicly exposed vulnerability information.
Mike Barwise noted in an article for the Heise Security Web site that, under British law, as long as a content owner planned for the information to be publicly accessible, there is no legal risk in following a link and viewing content. "But if the owner of the material exposed it to public access in error, intending it to be private, it could be a whole different kettle of fish," he wrote.
Barwise observed that the U.K.'s Computer Misuse Act of 1990, as amended by the Police and Justice Act of 2006, bars unauthorized access to any type of computer material. Several U.S. laws also prohibit unauthorized access. Yet for authorities to successfully convict a hacker, they have to prove that the individual intended to gain access to private material. Since Goolag Scan is an automated and powerful vulnerability scanner, it would be difficult to affirm that the user knew any of the information it supplied was unauthorized. On the other hand, authorities may be able to prove that search queries driving the scan were crafted to find private information.
Since Goolag Scan is a new tool, no cases have yet been brought against anyone using it in an alleged crime, either in the U.K. or the U.S. If or when this happens, a court will decide whether employing this software is illegal. Until then, Goolag Scan users — particularly those with malicious intent — should realize that they are using the vulnerability scanner at their own risk.
Comments
Post a Comment