:: Deepquest ::

Several blogs [0] have pointed out that Google Code Search can be used to discover vulnerabilities in the indexed code. One can find SQL injection possibilities [1], potential buffer overflows [2] and backdoor passwords [3]. But it’s not just security holes in software that you can find.

One particular search I did revealed a file containing a particular person’s entire collection of usernames and passwords. It included several banking account numbers and passwords, SSNs for him and his wife, keys for popular software and mortgage payment details. Assuming the passwords hadn’t changed since, I had more than I needed to steal all his money and his identity.

Irony of ironies, the file was included, as plain text, in the source code package for a “secure password storage” product this person had written and posted to the web!

I sent him an e-mail a couple of weeks ago, and he replied saying that some of the data was out of date, and he would change the rest. But it’s not easy to change bank account numbers and SSNs.

The RISKs: testing security software with confidential data; when working on software, not keeping the development version and the version you use separated.

[0] [url=http://www.kottke.org/06/10/google-code-search]http://www.kottke.org/06/10/google-code-search[/url]
[1] [url=http://www.google.com/search?q=inurl:%22SQL+select%22+inurl:asp]http://www.google.com/search?q=inurl:%22SQL+select%22+inurl:asp[/url]
[2] [url=http://www.google.com/codesearch?q=buffer+%22should+be+big+enough%22]http://www.google.com/codesearch?q=buffer+%22should+be+big+enough%22[/url]
[3] [url=http://google.com/codesearch?hl=en&lr=&q=%22backdoor+password%22+%28warning%7Cshell%29]http://google.com/codesearch?hl=en&lr=&q=%22backdoor+password%22+%28warning%7Cshell%29[/url]