Google serves up surprise password cracking function
A Cambridge University researcher successfully used Google to unearth a password used by an attacker to compromise its security blog. — The attacker created an account in Wordpress when he attacked the Light the Blue Touch Paper blog …
Context & Ripple Effects
The incident lands at the high-water mark of Google's November 2007 expansion: ComScore put its U.S. search share at 58.5 percent in October, one of its biggest monthly gains, and regulators were still weighing its pending DoubleClick acquisition. Against that backdrop, a Cambridge University researcher showing that the same index can be turned into a forensic instrument is more than a curiosity — it demonstrates that Google's dominance makes it a shared dependency for both defenders and attackers.
The specifics matter: the attacker who compromised the Light Blue Touch Paper security blog created a WordPress account during the break-in, and the recovered password surfaced through ordinary Google queries rather than any crack of the hash itself.
First-order effects
- The Cambridge team gets its attacker's credential back through search alone, and by publishing the technique it hands every other breached-site operator a free forensics method they can run against their own logs today.
- The attacker, like anyone whose passwords appear in indexed pages, is exposed wherever that credential is reused — the breach investigation effectively runs on Google's infrastructure.
Second-order effects
- WordPress administrators face pressure to audit account creation during compromises, since the account the attacker created became the trail that led to the password.
- Google's role cuts both ways commercially: the same index that anchors its 58.5 percent search share is now publicly demonstrated as a reconnaissance tool, which defenders will exploit and attackers will study.
Third-order effects
- If this pattern holds, security investigation shifts from cracking stored hashes toward mining whatever public indexes already hold — making search engines de facto dual-use intelligence infrastructure whose indexing choices carry security consequences.
- That dual use strengthens the case regulators weighing the DoubleClick deal must consider: concentrating web-indexing power concentrates a capability that no single party fully controls the uses of.
The trend: Search engines are becoming default reconnaissance and forensics platforms, with their indexing scale turning routine crawling into an unregulated intelligence resource for researchers and attackers alike.