Google 302 Exploit Knocks Sites Out

clsc writes "The exploit: Redirect via 302 to another page of your choice, then watch as the URL of your redirect script replaces the URL of that carefully selected page in Google's search results. Once this happens, feel free to redirect any visitor that is not Googlebot to any other page of your choice. Also applies to other search engines as well (not Yahoo! though)."

Yikes!

[LinuxGeek]

Web wide malware. The return of Goatse cannot be far behind... Pun intended.

danger!

[Neuropol]

#15) Optional: For mischievous webmasters only: For any other visitor than "Googlebot", make the redirect script point to any other page free of choice.

heh. tubgirl abounds!

goog

[kloidster]

SELL SELL SELL SHORT!!!!

yawn

[evenprime]

boy, sending me to the wrong page is such a scary and horrible thing to do. Luckily my browser came equipped with the special "back button" anti-malware plugin.

Google can't be wrong

[Anonymous Coward]

Insert MS blame here

Seems like

[kc0re]

Seems like all the hackers are struggling now-a-days. There are no "good" exploits coming out anymore. No directory Unicode transversals.. No Code Red, No Nimda. Not even SQL Slammer...
We haven't had a good exploit/0day in how long? Since the Webdav exploit? Or the RPC DCOM? Now we have to use Google, phishing techniques, and URL redirection. We are scraping the bottom of the barrell apparently.

Re:yawn

[goldspider]

Obviously you've never tripped a well-concealed Goatse landmine. No browser is equipped to deal with that kind of damage!

Re:yawn

[R.Caley]

it will be when your 14 year old boy searches for something for his research paper and gets redirected to pr0n instead.

God knows, 14 year old boys need to be tricked to make them look at porn.

Re:yawn

[fshalor]

Just as long as M$ or someone else doesn't patent the use of the "back" button for evading this sort of ware attack. All it would take was calling it the anti-malware function or something, and we're tanked.

I'm sure google will straighten themselves out in a few days. It's what they do. :)

So you mean...

[Snaller]

...a webmaster can redirect people on his own site? Wow, the horror. (You can't place redirects on someone elses pages)

Wait...

[zBoD]

Do you mean this is not www.kuro5hin.org ??

I would read TFA...

[eno2001]

...if I COULD get to the page. But it's being redirected with a 302. ;P

Re:WTF

[slimak]

a lot of people use google as a sort of bookmarks page(with keywords they remember)

I didn't even realize that I did this until I read your post. Not that anyone cares, but I only have 4 or 5 regular bookmarks; the rest of the pages I need to goto I either a) remember because the url is so easy or i go there so much (e.g., slashdot, orderyourrussianwife.com, etc) b) do a search for them as needed (e.g. martin vetterli's homepage), or c) use the url auto-complete in the browser.

Re:yawn

[eno2001]

That's OK. I had mod points and I did it. Oh wait... ;P

Re:yawn

[Gruneun]

it will be when your 14 year old boy searches for something for his research paper and gets redirected to pr0n instead.

Is that what he told you? "No, Dad, I was just trying to do a research paper. I had nothing to do with it!"

Re:Can I use this to knock out a fraudulent site?

[That's Unpossible!]

A site registered and hosted using stolen funds from my credit card is still online following phoned and faxed demands for revocation and refund sent to the registrar/host. Can I somehow use this to send an entire domain to a black hole until the hosting/domain are revoked?

No, only posting their link on Slashdot would have that effect.

Re:yawn

[EvanED]

I don't think Lynx is "equipped" to deal with that so much as not equipped to do anything else on the web ;-)

Re:yawn

[VanillaCoke420]

As a former 14 year old boy I can only say that if I had internet at that age, I would not need to be tricked into going to those websites...

Re:yawn

[Anonymous Coward]

"I swear Dad, I was just looking up stuff for my... uh... research paper, when suddenly, I was redirect to goatse!"

"That's fine, but why is that wine bottle shoved in your ass?"

"It was a one in a million shot, I tell ya..."

Sombody has to say it

[marvin2k]

*waves hand*
"This isn't the webpage you are looking for."

Re:Yikes!

[Silverlancer]

Apparently slashdot has been hit! A mischevious hacker has added a second "your" to the article:

"The exploit: Redirect via 302 to another page of your choice, then watch as the URL of your your redirect script..."

Re:danger!

[Klar]

*puke*

hah, someone wrote the address to that site on the board in our computing lab in permanent ink. Was funny to see how many people went to it.

Re:yawn

[NanoGator]

"t will be when your 14 year old boy searches for something for his research paper and gets redirected to pr0n instead."

"Son! What are you looking at? Is that ... Porn!?!"

"I told you! I'm working on a report!"

"With naked women?!"

"It's a History report, so I hit the History button on your computer!"

But why not use it for good purposes?

[MrHanky]

It would be nice if someone did something like this to the CherryOS "developers" [slashdot.org].

Re:yawn

[nacturation]

And if you can't, you'll probably have trouble getting/maintaining a real-life GF, which will make you d/l more porn, etc. ad. infinitum.

At first I thought you wrote "a real-life GIF". Talk about misreading!

Re:yawn

[ltbarcly]

I base my morality on the teachings of the tooth fairy.

Re:yawn

[Frank T. Lofaro Jr.]

They focus on things like sex, drinking, smoking, bad words and homosexuality, but ignore things like lying, cheating, stealing, and greed.

Sometimes they don't ignore those bad things, but embrace them. Remember the Jim and Tammy Faye Baker scandal?

Re:danger!

[Anonymous Coward]

I don't see how this post is modded funny, its obviously and insightful post on the uses of permenent ink.

Re:yawn

[Anonymous Coward]

My kids feel the wrath of a transparent squid proxy with logging.

What are you? Some sort of tentacle rape fetishist?

Re:yawn

[ms139us]

That did not make me a sick pervert: I'm a engineer now

The distinction between sick pervert and engineer being what?

Ducks...