The “Google Dorking” phenomenon: how an Iranian hacked a dam in New York using a search engine

On Thursday, March 24, Iranian resident Hamid Firoozi was accused of hacking into the computer systems of a dam 30 kilometers from New York. According to The Wall Street Journal , the Iranian used the Google Dorking method to find vulnerabilities, so a number of media outlets considered Google partially responsible for the hack due to the provision of such a service. In fact, “Google dorking” is just a method of using Google that is available to everyone, but it is actually often used by hackers.

Trial of seven hackers

Together with Hamid Firuzi, the US Department of Justice indicted six more hackers. The authorities announced this at a special press conference, presenting the case as illustrative.

The Justice Department said the attackers worked for some Iranian computer companies that were affiliated with the Iranian government. The hackers were mainly accused of hacking into banking systems and shutting down bank websites: their victims were 46 people, and the total losses from 2001 to 2013 amounted to tens of millions of dollars.

None of the hackers were in the United States, and there is no extradition from Iran to the States, so the Americans cannot bring the attackers to justice. However, officials say the purpose of such a case is to hint to hackers that they are being followed even though they are on the other side of the globe, and that they could be arrested if they leave the country.

Attacks on the financial sector are nothing new, but what Hamid Firouzi did has attracted particular media attention. He managed to gain control of the computer from which commands were given to the dam, which was controlled by an electronic system.

The still-classified dam intrusion highlights a major concern for U.S. officials as they enter an era of digital interstate conflict. America's power grids, factories, pipelines, bridges and dams—all prime targets for digital armies—are virtually unprotected online. And unlike traditional warfare, in this case it can be difficult to determine where the enemy struck from. In the case of the dam breach, investigators initially believed that a larger dam in Oregon may have been targeted.

from The Wall Street Journal article dated December 20, 2015

Dam Hacking

The dam, called Bowman Avenue Dam, is located in the 10,000-person town of Rye Brook in New York State. The dam itself is tiny: its opening is the width of a small room, and the height difference is only six meters.

As the New York Times notes , the dam's primary use is to prevent Blind Brook from flooding downhill buildings during floods. The mayor of Rye Brook, Paul Rosenberg, said that the hackers' choice of this particular dam for hacking is strange: it has no critical significance for the infrastructure.

According to Rosenberg, hackers may have confused Bowman Avenue Dam in Rye Brook with a dam in Oregon named after Arthur R. Bowman. It has significantly larger dimensions (244 meters wide and 75 meters high) and is used for irrigation of local farms.

Firuzi’s penetration did not bear any fruit: the hack occurred back in 2013 during the repair of the dam, when the equipment was disconnected from the Internet. However, Rosenberg noted that authorities must be more careful when maintaining infrastructure facilities that have access to the network.

Google dorking as the culprit behind the dam breach

According to The Wall Street Journal's source familiar with the hacking investigation, Firouzi used the so-called "Google Dorking" method to study vulnerabilities in the Rye Brook Dam control system. A number of Russian publications have positioned this method as an “accessible Google search tool,” and the WSJ itself asked Google for comment as if the company might have an opinion on how its search is used to discover vulnerabilities.

According to WSJ, Firuzi was simply using Google to search for unsecured systems—for example, those running a CMS with known vulnerabilities, or those that required a standard login and password pair to log in. That's how he came across a server from which he could get control of the dam.

The essence of “ Google Dorking ”, that is, non-standard use of Google, is to discover the content of pages on the Internet that cannot be seen simply by following links on sites. Google is known for its deep indexing of pages, including those that administrators forgot to hide from detection by search engines - or did not bother with such a security measure due to lack of professionalism.

Such hidden data can be obtained using queries to Google, composed in a certain way. For example, [site:tjournal.ru] will return only pages from a specific domain; using the [ filetype: ] operator, you can search for files of certain extensions - for example, .doc or .pdf with technical documentation that were uploaded to the server, but were not intended to be made public. The combination [filetype:xls intext:username] can reveal the contents of Excel tables with logins and passwords.

Judging by the circumstances of the dam hacking case, Firuzi was able to find in the description of the pages of the target server information about the use of a certain content management system, the hacking method of which was known to him.

In July 2014, the FBI, together with the US Department of Homeland Security, issued a memo to companies on how to combat the Google Dorking phenomenon. They noted that there are free tools that automate network scanning using Google Dorking, and therefore company representatives should test their systems themselves for penetration - for example, with the help of specialists from cybersecurity companies.