Tenacious Diggity: Skinny Dippin in a Sea of Bing
Francis Brown and Rob Ragan explores tenacious diggity: skinny dippin in a sea of bing at DEF CON 20, examining shodan and practical defenses.
Summary
Architecture and Background
Tenacious Diggity: Skinny Dippin' in a Sea of Bing Francis Brown Managing Partner - Stach & Liu, LLC Rob Ragan Senior Security Associate - Stach & Liu, LLC All brand new tool additions to the Google Hacking Diggity Project - The Next Generation Search Engine Hacking Arsenal.
Vulnerability Analysis
As always, all tools are free for download and use.
Exploitation and Demonstrations
When last we saw our heroes, the Diggity Duo had demonstrated how search engine hacking could be used to take over someone's Amazon cloud in less than 30 seconds, build out an attack profile of the Chinese government's external networks, and even download all of an organization's Internet facing documents and mine them for passwords and secrets.
Remediation and Defensive Strategies
Google and Bing were forced to hug it out, as their services were seamlessly combined to identify which of the most popular websites on the Internet were unwittingly being used as malware distribution platforms against their own end-users. Now, we've traveled through space and time, my friend, to rock this house again... Due to character limits, the full description and Bios are available here:
Related talks
Main Stage·46 min
Alejandro Caceres · Jason Hopper
Alejandro Caceres and Jason Hopper reboot PunkSPIDER, a massive global web vulnerability search engine scanning millions of websites for critical flaws.
Main Stage·37 min
Johnny Long
Johnny Long details johnny Long, Death of a Thousand cuts - Forensics In this day and age, forensics evidence lurks everywhere.
Main Stage·41 min
Johnny Long
Johnny Long details j0hnny long, Google Hacking- The Return of the Googledorks Google hacking is not new, but it's back and deadlier than ever.