Quick factual / historical note regarding Anonymizing RFI Attacks Through Google which Stefan and Ilia both referenced today.
As far as I know the notion of “programming” legitimate 3rd-party web spiders to attack other sites was first raised back in 2001 by Michal Zalewski (also wikipedia) in Against the System: Rise of the Robots.
Not that I’m hunting hacker-cred - ran into it via his book Silence on the Wire (which is a great read BTW - ever thought about how those Javascript key press events uniquely identify you?).






November 26th, 2006 at 7:19 am
Just a follow up on these (mentioned in the first paragraph)
http://blogs.securiteam.com/index.php/archives/746
http://blog.php-security.org/archives/49-Google-Request-Forgeries.html
http://ilia.ws/archives/144-Search-Engine-Hacking-more.html
November 28th, 2006 at 8:00 am
In general, the idea of Robots runnin around out there doin their own thing is kinda freaky, especially when they are commanded by humans. I’d rather run into a bear in the woods than a robot.