SearchingtheSearcherswithSearchAudit.docxVIP

John P. John Fang Yu Yinglian Xie Martín Abadi Arvind Krishnamurthy Presentation by Sam Klock Searching the Searchers with SearchAudit Motivation We can find this via a Google search Motivation (cont’d) Search engines open opportunities for attackers Construct clever queries Find vulnerable sites Plant malware; spam (e.g., MyDoom) Do so stealthily and cheaply Mitigation strategy: identify malicious queries May be able to deny results to user Identify attackers (probably bots) Interpret strategy, then anticipate and prevent The question: how to do so Proposed Approach SearchAudit Framework for generating malicious queries Input: Seed set of known malicious queries Search logs Output: Large set of suspicious queries Regular expressions matching queries inurl:gotoURL.asp?url= filetype:asp inurl:shopdisplayprod ucts.asp ext:pl inurl:cgi intitle:FormMail * -*Referrer -* Denied -sourceforge -error -cvs -input filetype:cgi inurl:tseekdir.cgi ... SearchAudit inurl:gotoURL.asp?url= filetype:asp inurl:shopdisplayprod ucts.asp ext:pl inurl:cgi intitle:FormMail * -*Referrer -* Denied -sourceforge -error -cvs -input filetype:cgi inurl:tseekdir.cgi ... inurl:gotoURL.asp?url= filetype:asp inurl:shopdisplayprod ucts.asp ext:pl inurl:cgi intitle:FormMail * -*Referrer -* Denied -sourceforge -error -cvs -input filetype:cgi inurl:tseekdir.cgi ... inurl:gotoURL.asp?url= filetype:asp inurl:shopdisplayprod ucts.asp ext:pl inurl:cgi intitle:FormMail * -*Referrer -* Denied -sourceforge -error -cvs -input filetype:cgi inurl:tseekdir.cgi ... /includes/joomla\.php site:\.[a-zA- Z]{2,3} /includes/class_item\ .php site:[^?=#+@;:]{2, 4} php-nuke site:[^?=#+@;:]{2, 4} modules\.php\?op=modl oad site:\.[a-zA- Z0-9]{2,6} Seed set Search logs Expanded set Regular expressions Proposed Approach (cont’d) Needed to implement: Seed set: Search logs: Microsoft Research ? Bing Way to expand seed set into more que