apparently, after google bought the technology to index binary files in html summaries, people can now search google for different key phrases and locate pe (and other) binaries of their choice.

you can play with this as much as you like, finding different packers, strings, file sizes… the sky is the limit. originally, this was brought to public attention by websense, as you can read here and here.

websense shared their code only with closed trusted communities of researchers. they did not release it to the public. hd just released a tool for it.

searching for known malware signatures like hd shows is just the tip of the ice berg…
as an example a friend demonstrated to me, searching google for:

signature: 00004550 upx1
would find almost 10k pe binaries (00004550 for pe) packed / protected by using upx. searching for other packers, as an example, will yield a lot more results.

one can use the google api to search google for signs of malware directly, and apparently the websense guys had a lot of success with that approach.

the great guys over at meatsploit and offensive computing just released a tool for you, plus some signatures in a yet small database. it is limited only to known samples. you can find information about it here:

http://metasploit.com/research/misc/mwsearch/mwsearch.html

use their “search engine” to search for current malware they have signatures for:
http://metasploit.com/research/misc/mwsearch/index.html

here is a better link for the search page, which shows you some possible results:
http://metasploit.com/research/misc/mwsearch/?q=.&btng=malware+search

unrelated to their tool… anyone checked some of the results for open directory indexing?
anyone tried looking for pe files with the wrong extension? (using the filetype: feature as specified below)

the sky is the limit.

there are some corporate and pen-testing uses for this feature to be considered:
a cool google trick, as my friend noted, is using the filetype: search.

filetype:cpp, filetype:c, etc.

adding some interesting words such as microsoft, may turn up some interesting results as well.

another trick that can be tried is using the site: feature of google, and checking your own web pages for hosted malware, either for aup violations or compromises.

that said, google hacking is always evolving and indeed, finding new search strings such as packers, as demonstrated with upx above is the future of this technique.

gadi evron,
ge@beyondsecurity.com.

-

Is your site safe from XSS Attacks? Sig nup for Beyond Security Vulnerability Scanner today!