“Search Engine Hacking,” also called “Google dorking,” has quickly become a favorite technique of hackers to find and expose private or sensitive information that is not intended for public access.
By Search Engine Hacking, cybercriminals can quickly and easily discover sensitive business and personal information, such as financial records and social security numbers, that can be used for malicious purposes. Given its potential to cause significant damage, businesses must be aware of the risks of search engine hacking and take necessary steps to protect sensitive information online.
What Is Search Engine Hacking?
The first step to protecting your business is understanding what Search Engine Hacking is. Search Engine Hacking is the ability to use advanced search operators, along with punctuation marks, to turn a normal query into an advanced formula in order to inform the search engine of exactly what results are desired. Have you ever searched for a phrase or name and put it in quotations or used punctuation marks? That’s a simple example of Search Engine Hacking.
Search Engine Hacking can be used for benign reasons by students, security researchers, or journalists. For example, Search Engine Hacking may be used by students to locate specific file types. Journalists may use it to find information that has been buried underneath sponsored or search engine optimized posts.
Unfortunately, malicious actors also use Search Engine Hacking in dangerous ways. Through advanced search techniques and operators, cybercriminals have discovered website vulnerabilities that can be exploited, login credentials that have been publicly posted online, confidential company documents, and sensitive data including passwords, credit card numbers, and social security numbers. Even scarier: Search Engine Hacking has been used to access and remotely control unsecured Internet of Things (IoT) devices such as webcams and baby monitors.
To combat the risks caused by Search Engine Hacking, businesses must put measures in place to protect the organization and personnel.
Examples of how Search Engine Hacking Could Harm Your Business
In 2011, a Yale Alumni conducted a Google Search and found a vulnerable Yale File Transfer Protocol (FTP) server that contained the names and social security numbers of around 43,000 students, employees and alumni. This information was likely at risk without knowledge by Yale and was indexed by Google. Search Engine Hacking can be used to scour the internet for this kind of information that may be inadvertently exposed. Schools require students and employees to provide the type of information that was exposed. As an organization entrusted with sensitive data, it was not a good look to unknowingly have that vast amount of data left unprotected online. Yet, Yale’s lapse is understandable given the lack of knowledge surrounding search engine hacking, but this type of blunder could cause irreparable damage to a business’ reputation.
Perhaps worse, hackers can easily target institutions with vulnerable web pages through the utilization of Search Engine Hacking. From 2005 to 2012, a hacking rink seized at least 160 million credit and debit card numbers from some of the United States’ top financial institutions through the use of search engine hacking. Dow Jones, JCPenney, JetBlue, 7-Eleven, and NASDAQ were among the many institutions that were targeted in this string of attacks, with just three of the corporate victims alone losing more than $300 million. The hackers found and targeted the specific US institutions through Search Engine Hacking. Given some of the US institutions with the deepest pockets, and likely the most security were targets of these hacks, the average individual can be a victim of theft to hackers through Search Engine Hacking as well.
Another victim of an expensive data breach class action settlement, Inmediata Health Group, discovered that some of their patient’s health records were indexed by search engines. The information exposed included patients’ names, addresses, birthdays, medical claims, and some social security numbers. A class action lawsuit was filed and although Inmediata admitted to no wrongdoing, they paid up to $1.125 million due to this online exposure. Clearly no business would like to fall victim to an issue such as this.
Here are some of our ideas on how to protect oneself from Search Engine Hacking:
How to Protect Your Business from Search Engine Hacking
- Secure your networks: Keeping your networks secure is essential to prevent potential data breaches. When networks are not secure, they may be indexed by a Search Engine and displayed publicly without your knowledge.
- Search Engine Hack your business: Regularly monitoring your business’ online presence by Search Engine Hacking your business’ name and names of your executive board could help to ensure that your sensitive business information is not exposed online.
- Regularly update your software: Frequently updating your operating software and antivirus software is necessary to patch vulnerabilities and protect against new threats.
- Training your employees and limiting their exposure to sensitive information: Training your employees on Search Engine Hacking, malware, and phishing will help them know what to expect and how to protect the business from potential vulnerabilities. Limiting your employees’ access to sensitive business information will also hopefully prevent unintended online disclosures.
- Use strong passwords: Encouraging your employees to use strong passwords and change them frequently will make it more difficult for search engine hackers to access company information. Similarly, employees should be encouraged not to reuse passwords. Passwords are commonly left available for exploitation through Search Engine Hacking. Therefore, if employees reuse passwords, they put their accounts and your business’ accounts at risk.
- Invest in tools: Investing in tools that help protect your business from Search Engine Hackers would also help ensure your business is safe from any potential hacking risks. A few of these tools include:
- Google Search Console, which would help you monitor your business and improve its website’s presence in Google search results.
- Content Security Policy (CSP), which would help your business specify the sources of content that are allowed to be displayed on the business’ website.
- Google Alerts, a free tool offered by Google, which would help you monitor your business’ presence online by receiving alerts when sensitive business information is exposed.
However, we wanted to dig a little deeper and give you the perspective from Ethical Hackers themselves, who know best what malicious actors are going to use these very techniques for.
We asked OWLsec founders, and Ethical Hackers how one can protect themselves against Google Dorking, and they have said the following:
Due to the potentially significant repercussions of a data breach or cyberattack, as a business owner you should carefully consider paying attention to the cyber security issues involving Google Dorking. Cybercriminals may get sensitive information from Google Dorking and exploit it for identity theft, financial fraud, or other nefarious purposes. This includes employee and customer data.
If a company disregards these concerns, they run the danger of losing the trust of their customers, having their reputation ruined, and suffering financial losses as a result of penalties from the government or legal action. The cost of engaging security specialists, alerting impacted parties, and putting in place additional security measures may all pile up in the wake of a data breach or hack. To avoid malicious results from Google Dorking, firms should prioritize cyber security and take preventative measures. We have provided a Google Dorking Safety Practices checklist to protect your business from Google Dorking:
It’s clear that Search Engine Hacking is a security threat that businesses need to take seriously. However, with the right strategies and tools, you can mitigate the risks to your business.
- Review the information that is publicly available: Perform a search for your business name and review the information that is publicly available. Make sure that all the information is accurate and up-to-date.
- Review employee information: Check if any employee information, such as email addresses or passwords, is publicly available. If so, take steps to have it removed.
- Review customer information: Check if any customer information, such as credit card details or personal information, is publicly available. If so, take steps to have it removed.
- Check website vulnerabilities: Use Google Dorking techniques to search for vulnerabilities in your website, such as exposed login pages or database files. Take steps to patch any vulnerabilities found.
- Review social media profiles: Check if any social media profiles associated with your business are publicly available. Make sure that privacy settings are set to the highest level possible.
- Conduct regular audits: Conduct regular audits of your online presence to ensure that all information is accurate and up-to-date. This will also help you to identify any potential security risks.
- Educate employees: Educate your employees about the risks of Google Dorking and how to practice safe internet use. This can include using strong passwords, enabling two-factor authentication, and limiting the amount of personal information shared online.
By using this checklist, businesses can ensure that their Google Dorking security is up to date and that they are taking steps to protect their online identity and information.
The OWLsec founders Kevin Roberts and Jimi Flynn even gave us some useful “Dorks” to use in self-defense to protect your business. Here is what they said:
Intitle:”index of” admin
This search query can reveal directories and files named “admin” that are publicly available on a website, which could potentially contain sensitive information such as login credentials or configuration files, or customer PII (personally identifiable information)
filetype:xls | filetype:xlsx | filetype:csv site:example.com
This search query can reveal spreadsheets on a particular website that contain potentially sensitive data such as financial data, customer information, or employee records.
Intitle:”Index of” finance
This search query can reveal directories or files named “finance” that are publicly available on a website, which could potentially contain financial data, such as accounting spreadsheets or invoices.
Google hacking alone can cause damage to a business, but what comes after is usually worse. Securing any Google Hacking vulnerabilities is the best way to stop an attack before it even begins.
