Slashdot Mirror
Online Search Engines Lift Cover Of Privacy
Rican writes "MSNBC has an interesting article about how 'Googledorks' are using the powerful search engine to do searches across the web for sensitive and/or private information. Some of this information includes 'Medical records, bank account numbers, students' grades, and the docking locations of 804 U.S. Navy ships, submarines and destroyers.'"
While googlestalking is scary and bad and I'm not condoning it, in this *specific* case, if the docking locations of U.S. naval ships is something that they do not want made public perhaps they should simply not make them public?
That googledorsk link... You're telling me if i put the word "googledorks" on my website and wait a few months i will be one because it appears in a google search?
Is googledorks a real hacker movement or just some random key word any one with a high ranking web page can abuse?
On another note, the best thing i found that was supposed to be hidden was with the query "quality hentai" This was last year. It has since been secured (by being taken offline).
What have you found?
Why do people always have to drag Google into this sort of thing? Somewhere, someone is pissed off at Google for putting their medical records on the web, and letting people get at them, when they should be angry at the people who posted them to the web in the first place. It's like calling Southwest Bell your partner in crime because you used DSL to steal from an online bank. It just makes SWBell look bad, just as this makes Google look bad.
-twb
This all brings up one of the central tenets of computer network security: If it is connected to the Internet, it can be accessed, and sometimes the probing computers that are looking leave their little IP footprints all over the place. For instance, I was rather surprised a couple of years ago watching some IP's scroll through while someone/a software bot was accessing my workstation. Whois revealed nothing, but traceroute revealed an IP that allowed me to do a little more poking around to find out the identity as something from a "Special Collections Service" in Maryland. A little more poking around revealed it to be something involving a state department program whereupon I rather quickly decided to stop investigating. I still don't know anything about them or what they do, but it is surprising how hard it can be to be anonymous on the web. Hey, I am sure even all those Slashdot anonymous coward posters are leaving IP's that can and are documented. :-)
Visit Jonesblog and say hello.
The real story here is that companies and other organizations and institutions are setting machines up as servers and are too stupid to create an appropriate robots.txt file and/or keep their confidential information elsewhere. Google doesn't just drop in, even on networked machines. I have some sympathy for individuals who don't understand what they are doing when they make their machine a server, but surely any professional sysadmin, even one with limited training and experience, should know better than this. It's the same as leaving your briefcase on the front seat of an unlocked car.
Part of this problem comes out of who owns the daggoned data. For example, let's say a hospital, instead of using clipboards, uses smartcards to hocket about patient records.
Who own's the data. The hospital, the insurance company paying the bill, or the poor schmuck on the business end of a colonoscopy?
I ask because without the indiviual having the write to own the data, there seems to me little that can be done to protect oneself other than go through expensive and tedious legal channels.
And if someone else can own sensitive data about me, then what can we do, as private citizens with limited resources, to make sure larger entities such as insurance companies play by rules like HIPPA?
--- have you healed your church website?
article:
Since 2001, the FTC has settled cases with Eli
Lilly & Co., Microsoft Corp. and clothing maker
Guess Inc. for not taking "reasonable" measures
to keep medical or financial information
secure, said Jessica Rich, assistant
director of the commission's bureau of consumer
protection. Letting customer information
reside on an unsecure server can open
up a business to such liability.
If your information is "sensitive" or "private", do yourself a favor and don't put it on the web.
Peeps nowadays...
Shouldn't Google take precautions to make sure that sensitive data doesn't fall into the wrong hands?
No, they should not. They are not in a position to know what _is_ sensitive - and to whom. They can reasonably only assume that anything reachable with an ordinary, polite spider is meant to be accessible to the world at large. If you feel certain information should not be made accessible, bring it up with those actually making it accessible, not with those just indexing it once it is.
Shooting the messenger is not just pointless, it is counterproductive.
Trust the Computer. The Computer is your friend.
http://www.rootstrikers.org/
Also, these are not precise locations. Yeah, you can find that the USS Roosevelt (DDG-80) is homeported in Mayport, Florida but you're not going to find the precise pier number.
As for ships on deployment, one can find their general locations just by looking at the latest issue of the Navy Times and by reading the newspaper of the town that the ship and its battlegroup are from.
The Navy really tightened up on what get's posted on official ship's websites after 9/11. If there is sensitive information still out there, Google is not at fault, but rather the unit's webmaster, Commanding Officer, and the Operational Security people who are supposed to be looking out for that sort of thing.
Imagine if the US government gets in its head that search engines are a terrorist tool?
Wouldn't that be interesting?
Saskboy's blog is good. 9 out of 10 dentists agree.
Maybe they should just use the fricking robots.txt protocol. That's what it's *FOR*. You can put a little file named robots.txt in the directory you want hidden, put text in it that says "i want this hidden, google", and google will ignore your directory forevermore.
No one has any right to complain if their page is in a search engine unless they followed the robots.txt protocol and the search engine did not.
If Bill Gates is using the same SS # that was leaked in 1995, then he is a total moron. He is not a moron. Therefore he is not using the same SS # that was leaked in 1995. QED
An old trick I used to do was searching for something along the lines of
"http://*:*@" member
and you would get a bunch of sites with direct links into passworded member sites. Microsoft will put a stop to this with their latest update to IE however.
I.O.U One Sig.
And on a totally unrelated thought. . .
Is Yuki Noguchi on crack? Google does not do anything to privacy. All Google does is make it easier to find publicly available information. Maybe "Online search engines act as a catalyst to find private information" would be more a accurate title. ". .Losing faith in humanity one person at a time.
OT:
How come Homer and Krusty look like clones?
It's intentional. MG originally intended it to be a joke; Bart didn't respect his dad, but he worshiped a clown who looked exactly like his dad. He mentioned this on an NPR interview last week.
Google and the wayback machine, respectively, have memories. Just because you take something off the web doesn't mean it can't be found by those services; it just means it won't respond to your browser's request. Cached results and so forth are dangerous. If there ever was leaked data about the locations of those ships, it can still probably be found somewhere, and if that information hasn't changed since it was taken off the web, it's still a problem.
This applies to any information that's ever been stored electronically; I call it the "backup tape problem". Someday, that information may (will?) find its way online, a public service will index it, and the genie will be out of the bottle forever.
It's rare that you're presented with a knob whose only two positions are Make History and Flee Your Glorious Destiny.
Right. And then you can complain about that site doing the cross linking, or you can think about putting access controls on that sensitive document that you've put on the world-readable public internet.
There are no trails. There are no trees out here.
On the one hand, yes, the information was already out there to be found and sorted. On the other, however, things like Google take such information and make them available to anyone (which they were before) in an incredibly easy-to-use form (which it was most certainly not previously). Say I want to know information about Al G. Trenton, the G is for Greerson. This person went to XYZ school back in high school and held ZYX position. Do a few searches for common phrases, you get some information maybe from a private web side or a town newspaper. Maybe you get parents' names or the name of a college or something; boom, you have more information to refine your search. This once would have taken days, maybe weeks, and preferably a trained professional; now it takes hours, and is easily done by a moderately bright and creative individual.
Or you realize that putting something on the internet means that it is no longer private..... regardless of how stupid it is to say that google will leave it alone if you just ask..
Hopefully this sort of flagrant violation will draw at least a modicum of public attention.
This isn't some hardened criminal mastermind at work. It's not a seasoned cracker attacking military targets. This isn't even some script kiddie poking at IIS. It's a MACHINE. A machine that respects robots.txt for Eris' sake!
If medical records and other "real" secrets are this visible, something is terribly wrong and I want to see public floggings. Seriously, this is not a case of weak security, or poor security, or incompetent security. It's a case of there not being so much as a screen door between the public and sensitive information.
This is actually a case where I think the government (or at least the courts) can do some good. You'll notice banks don't get hacked on a daily basis. That's because they'd lose squintillions of dollars if it happened. But nobody cares about my medical records because it costs money not to have incompetent asses running things. On the other hand, if revealing to without were punishible by a $1000 fine per person, per offense, you'd notice a severe tightening of security in a mighty big hurry.
It's a shame that suing people is sometimes the only way to get their attention, but with the decline of basic civil responsibility it might be inevitable.
High-speed Road Trip (18.000KPH)
I say why blame just one person/group/entity. Let's blame the people who publicly post the personal information AND the people who use that information to hurt people. But let's not blame Google or any other search engine for doing too good of a job.
Losing faith in humanity one person at a time.
Is it bad? Lots of shops etc know my CC#. Thats the way it works.
Ur protected from losses
It is not insightful, it is trool, stupid.
robots.txt is a polite request not to do something.
Of course rogue people will not even notice this or will use it to their advantage.
IANAL but write like a drunk one.
I know this is very late in the discussion.
But, if I wander into an unprotected system, like a bank or military site, and I start reading confidential documents... Is this not a crime?
What's the difference if I locate the unprotected documents via a search engine or by using a port scanner with an IP range.
I think what I'm saying is that port scanning and finding an vunerable system, going into that system and looking around is now a crime.
But didn't I just describe what's going on with google hacking?
I don't advocate nor believe any of this is a crime but where and why is a line drawn between them?
I've often said about hacking that just because I go to the market and forget to lock my front door, that doesn't mean I expect to come home and find someone rumaging through my house.
If it's an administrator who forgets to lock down a port or one how inadvertantly places confidential materal on the wrong box... Again, Where is the line and how is it drawn, and why, between criminal hacking and "it's on an open system, google found it so it's legal".
I'm just asking. It's early in the AM and my brain isn't working because it's not seeing the difference. I'm only seeing a very fine line between what one might consider a "public" system versus one that expected to be "private". Is the only difference our "expectation" of privacy that makes one illegal and another a sport?