Phishers Use Google to Find Exposed Servers

Three-quarters of phishing sites are built on hacked servers that have been tracked down using pre-programmed Google search terms, according to research from brand-protection firm MarkMonitor.

Among other activities, MarkMonitor tracks phishing attacks that target brand names.

Researchers compiled a list of 750 Google search terms that are used to track down websites likely to have easily exploitable vulnerabilities -- mostly PHP-based sites.

The search terms return a list of sites likely to have particular vulnerabilities; the attackers then exploit the vulnerability, gain access to the site, and then use it to host malicious code or counterfeit web pages as part of the scam.

MarkMonitor found that 75 percent of the phishing sites it had discovered had been originally tracked down using one of the list of 750 Google search terms. The finding was based on a sample of one-quarter of the phishing sites logged by the firm.

The search terms, called "Google dorks," are actively traded on internet forums, and are routinely scanned by IRC-based "bots," which also scan Yahoo and AOL Search results, according to MarkMontitor.

Google has already made moves to block automated exploitation of the "dorks," but they can still be used manually.

The websites exploited tend to be small, local PHP-based sites, which are less likely to have the latest patches installed, and are invaded via one of more than 1,800 known PHP bugs, MarkMonitor said.

In the fourth quarter of 2007, 412 organizations were targeted by phishing attacks, up 37 percent from the same period in 2006, according to the firm's Brandjacking Index, published last month.

Auction sites were the biggest targets, accounting for 44 percent of the phishing emails in the fourth quarter, up from 36 percent in the first quarter of 2007.