How does automated query compromise other Google users?

Question

Sometimes when using TOR browser / tor proxy, Google refuses to process the request you issue, especially if it's in a different language (e.g. searching for Arabic word while using German proxy).

For me I thought that its some kind of DoS attack prevention as Google might think that you're a bot who is trying to overload the engine with spam search requests.

But why the message error says that it wont process the query in order to protect their other users?

Is there some kind of queries that compromise other client on the internet using same search engine?

Answer 1

You're correct in your assumption that Google blocks this traffic in order to prevent the search service from being slow, but there are indeed other reasons:

• Automated searches allow malware to scan for vulnerable web pages, using "Google dorks", i.e. search queries designed to match content on vulnerable sites. This would increase drive-by attacks across the internet, so Google is right to say they are "protecting" users.
• Automated queries, if allowed, would probably account for a sizeable chunk of requests. This would cost Google money that they could otherwise spend on making better services for their human users.
• You may not realise that your machine is sending automated requests, so the verification page is a good way to alert users, especially since a large chunk of internet users are likely to visit Google at least once in a browsing session. This is a nice way to catch malware.
• Tor is a source of a lot of bad traffic, so it's reasonable to expect Google to cut that down to human stuff only. Automated queries via Tor make log analysis and all sorts of other forensic efforts more difficult, so if Google did suffer a breach keeping the automated traffic to a minimum could help.

However, there isn't really a direct effect on a specific user from an automated query. It's not very likely that an automated query would be particularly important from a threat model perspective; if the user is already unknowingly doing automated requests it would imply that they're already infected with malware, at which point their keystrokes and files are compromised already.