Major Security Flaw With Google Sitemaps Stats

[mandy]

David Naylor points out, as does this WebmasterWorld thread spotted via Threadwatch, a pretty surprising security oversight with Google's new Sitemaps stats system that can allow anyone access to stats of other web sites, if those web sites don't report 404/File Not Found errors correctly. Right now, I'm looking at stats for eBay and AOL, as well as Google's own Orkut!

...The problem is, some web sites will respond that any page exists, even if it doesn't. Rather than sending out a 404 File Not Found error message, they'll dynamically generate the page with content anyway or they'll tell the user the file doesn't exist, but the server code sent to a browser says differently.

full article: http://blog.searchenginewatch.com/blog/051118-092239

A couple of things we’ve found since playing with this:

    * 23% of the Alexa Top 100 sites are susceptible to this problem
    * Other big sites include Orkut, Infoseek Japan, Match.com, Business.com and Whitehouse.gov
    * SEW ranks for singingfish
    * Most sites we added were using 301 or 302 to another file. We noticed if your 302 or 301 crosses a domain, the site was added
    * MSN servers return 200 OK but also “STATUS_CODE: NotFound", which Google fell over on ("temporary problem")
    * Monster.com should be susceptible but Google’s servers couldn’t resolve it.

full article: http://www.davidnaylor.co.uk/archives/20...-sitemaps/

[jezebel]

Still not fixed  :

[bargainbloodhound]

[quote author=jezebel link=topic=1343.msg5278#msg5278 date=1132961059]
Still not fixed  :
[/quote]

They fixed it the same day it was discovered.

http://news.com.com/2061-10812_3-5961484.html?part=rss&tag=5961484&subj=news