Goolag Tool Lets Google Aid Hackers

The hacking group Cult of the Dead Cow has released a tool that should make Google hacking a little easier for novices.

Called Goolag, the open-source software lets hackers use the Google search engine to scan Web sites for vulnerabilities.

This is something that hackers have been doing for years, but it can be tricky work -- involving custom scripts and tools that sift through the mountain of data available via Google.

The Cult of the Dead Cow is best known for creating the Back Orifice software 10 years ago, which could be used to remotely control a Windows machine.

Like Back Orifice, the software could be used by both legitimate security professionals and criminals. Goolag comes with an easy-to-use graphical interface. It is based on techniques developed by Computer Sciences Corp. researcher Johnny Long, a well-known computer hacker who has spent years documenting the way that Google's search engine can be used to uncover security vulnerabilities in the Web sites it indexes.

Exposing Holes in the Web

In a statement, The Cult of the Dead Cow said that the software is "one more tool for Web site owners to patch up their online properties."

"It's no big secret that the Web is the platform," the statement said. "And this platform pretty much sucks from a security perspective."

There are already free Web vulnerability search tools available -- such as the Wikto scanning software -- but the Cult of the Dead Cow's notoriety will probably help make Goolag popular, security experts said Friday.

"I don't think it's particularly new, but maybe it makes [Google hacking] more accessible," said Robert Hansen, CEO of Sectheory.com and author of the Ha.ckers.org Web security blog.

"It is interesting because it could theoretically represent a lower burden of entry for the novice Google hacker," he added.

Amichai Shulman, chief technology officer with security vendor Imperva, agreed that there are still far too many security vulnerabilities on Web sites. "Maybe the headlines that this release is getting will serve as a wake-up call for application owners," he said.