When Google isn't Google

Published: 2013-06-10. Last Updated: 2013-06-10 12:22:43 UTC
by Johannes Ullrich (Version: 1)

Like many other exploit scripts, the recent "Plesk" exploit used a fake user agent of "Googlebot". Attackers assume that most web applications are happy to be indexed by Google and possibly ably no or less stringent filters. For example, some applications will show more content to Google that is not readily displayed to normal users unless these users sign up, solve a captcha or even pay.

Google however makes it pretty easy to distinguish "real" Google bots from fake once. The IP address used by Google will reverse resolve to crawl-a-b-c-d.googlebot.com, where a-b-c-d is the IP address of the bot. In addition, this host name will resolve to the IP address used. In order to validate if a google bot is "real", the lookup against .googlebot.com is required. An attacker could fake the reverse lookup if the attacker can provide reverse DNS for the IP address used by the attacker.

Personally, I use a little shell script to extract "fake google" spiders from my logs:

#!/bin/sh

# you may need to adjut the "cut" parameter and file name to match your own log format.

for b in `grep 'Googlebot' /var/log/httpd/*access_log | cut -f 2 -d' ' | sort -u`; do

h=`host $b`

if echo $h | grep -e ' crawl-.*\.googlebot\.com\.$'; then

h=`echo $h | cut -f5 -d' '`

n=`host $h | cut -f4 -d' '`

if [ "$n" = "$b" ] ; then

echo ok $n $h $b

else

echo fake $b;