Google Patches Vulnerability That Let Anyone Hide Search Results – Source: www.techrepublic.com

A feature of Google’s web indexing system was exploited to remove web pages from the search engine, independent journalist Jack Poulson and the nonprofit Freedom of the Press Foundation revealed on Wednesday. The exploit demonstrates how Google’s methods for pulling web pages into its search engine can be manipulated to suppress public information.

How the Refreshed Outdated Content exploit works

Poulson and Freedom of the Press Foundation deputy director of audience Ahmed Zidan discovered that an article on the foundation’s website had been de-indexed by an unknown party. The article covered the alleged suppression of information regarding tech CEO Maury Blackman’s 2021 arrest on suspicion of domestic violence, for which he was never charged or convicted.

The unknown attacker exploited Google’s Refresh Outdated Content tool. According to Google, the tool is designed to delist pages that no longer exist or “pages that have deleted important (sensitive or critical) content.”

Refresh Outdated Content is intended specifically for individuals who do not own the outdated page; site owners must use a different tool via Google Search Console.

According to Freedom of the Press Foundation, a malicious actor can manipulate the tool by submitting slightly altered URLs — for example, with changes in capitalization — that led to 404 error pages. In this case, Google’s system will fail to distinguish between lowercase and uppercase text, causing the valid page to be delisted along with 404 variants.

In the case of the Freedom of the Press Foundation’s article, someone repeatedly submitted URLs with different capitalizations. The threat actor would restart the process every time the article was re-indexed.

Google rolled out a fix

Freedom of the Press Foundation contacted Google on June 27, and the tech giant deployed a fix for the vulnerability.

Only “a tiny fraction of websites” were affected by the exploit, according to Freedom of the Press Foundation’s communication with Google. The company declined to say how many other sites had been de-indexed using the same method.

“Confirming that we’ve rolled out a fix to prevent this type of abuse of the ‘Refresh Outdated Content Tool,’” an anonymous Google spokesperson said, according to the foundation. The spokesperson added that Google would not provide additional details.

Earlier this week, Minnesota Governor Tim Walz issued an emergency executive order calling the National Guard cyber protection support to help respond to a cyberattack on the city of St Paul.