I’ve known this for some time, but finally have a good post to link. Tom’s Hardware has a review of a Black Hat dat talk about the dangers and uses of Google in hacking.

I firmly believe that famed Adrian Lamo, the “drifter” hacker who performed his hacks using only a web browser and open cybercafe computers, utilized search engines in smart ways to find vulnerable sites.

You can easily do a search for the title of a web admin interface page and come up with potentially unprotected hits. For instance, I once found an open Linksys WRT54G web interface by typing in some combination of text that is found on the admin web interface. Limit a search for “admin” to a particular domain or company, and you might just find pages that some admin thought were hidden because no pages linked to them and they weren’t know…i.e. they thought obscurity was enough security.

Just think, using Google to look up default and running VNC installs open to the public…just connect and 0wn.