Slashdot Mirror
Searching For Trouble With Google
achilles writes "From a recent eWeek article: 'Whether they realize it or not, many people leave sensitive information out in plain view on Web sites. But sooner or later, a Google search will dig it up.' The article goes on to list some examples such as 'a search for credit card numbers. Try this one, for "Visa 4366000000000000..4366999999999999' and other 'risky data' from careless users, such as QUICKEN files etc."
...it's called natural selection. Survival of the fittest... if people are that dumb to put stuff on the internet, so be it.
FLR
This was on bugtraq a week or two ago:
Check it out and there was a discussion of it a few days later.
Someone actually has a whole forum dedicated to finding things you can do with google here.
Apparently this was even a DEFCON speech subject.
This is no longer the case. The Google toolbar reports home to Google about sites people visit. Within a couple of minutes of someone viewing a URL that was private and only meant for them with a browser with the google toolbar installed the googlebot will come along to the site and grab the file for indexing. Nasty if you're not expecting it.
-- Sorry, I can't think of anything funny to say here.
I feel sorry for 'Haley' and others with their Quicken files being shown to all of /. and presumably friends etc. I wonder what the 'reach' of the slashdot crowd is when it's a "You're not going to believe this!" story...
Simon
Physicists get Hadrons!
Looks more like Google found forums where people were swapping credit card numbers.
Good thing I've got a Mastercard then :)
This is the sig that says NI (again)
is that you can search for ranges of numbers like that in google. That's pretty neat.
I think there was a similar /. article a while back. Do a google search for "googledorks" to find out what additional kinds of data are accessible.
Is Google liable for harvesting and publishing sensitive information? If neighbour's window wasn't closed, it doens't mean you can take his naked photo and put it on the website?
Also, maybe those numbers are traps to catch people? Surely you need those goods to be sent to an address and someone has to eventually pick it up.
Uselessful technology (Air-Charged
Very popular is the search for "Welcome to phpMyAdmin".
This will give you some nice databases to browse through.
How many people dug out their own visa cards and googled for the number ? :-) I managed to stop
myself.
All interpreted languages are abstractions over Lisp
Having google blocked (presumably from google's end) from this is just security through obscurity. Well it's not even that really, it means there is (1) stuff available in plain text which is a part of a website's (2) public access AND (3) for one reason or another has searching enabled. The problem is part 1 and/or 2, the symptom is 3. Cure the problem, not the symptom.
Not getting just credit cards, but other nice little things.. New Order
Just tried google for a SSN search as well. Same thing, you get a list of results within that social security number range, along with names, and addresses.
I just can't figure out why people would be victim to identity theft.
Obfusacation may have allowed people to be sloppy with their data exposure until now. But that is no excuse for people being lax with their own data security.
The Internet is built by it's users. The responsibility for protecting data lies squarely with the users at the edges.
Just ordered a computer that can actually play Doom 3!
Thanks Slashdot!
Comment removed based on user account deletion
Check out the cached version of the third link and look in the text box. Hopefully it's not any of you... google link
I had trouble believing this, so I downloaded one of the .QDF files from the referenced link. I am feeling completely sick. This guy's checking account number, credit card number, and meticulously-maintained transaction history are sitting on my computer.
It's way too late to warn these people about the files. Their current identity is toast. So is their credit for the next seven or so years.
Is there anything we can advise these people to do to minimize the damage at this point?
Don't publish this on ... hey!
Who needs P2P?
Comment removed based on user account deletion
of the VISA/Google search is that VISA is a sponsored link. Kind of like Microsoft advertising on a website that bashes it for its security holes...wait a minute...
Only some of us are fortunate enough to learn from other people's mistakes. The rest of us has to be the other people....
sigaar
convert 29 fahrenheit to celsius
or
pi=
or
define: hubris
google's got neat tricks
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
The sad thing is that now people will be Googling for their credit card numbers to be sure they're 'safe', but doing so means their credit card number will show up in the list of things people are Googling.
Another good one is searching for copywrite phrases found on front pages of eBooks such as O'Reilly CD Bookshelves. People seem to put up their eBooks for their own convenience. OTOH publishers seem to be doing a bit of Googling of their own, as they tend to be taken down pretty soon. Nothing that a quick WGET won't handle...
I'm sorry if I haven't offended anyone
Guess what - someone who isn't a /. reader is:
Probably the ones most vulnerable to Google mining (for lack of a better term)
The ones least likely to know what a robots.txt is, what it does, and how to utilize it to prevent stuff like this.
You better watch out, there may be dogs about . .
Norton DumbWall 2004
Featuring:
Order now and get a free drool-bib.
"Proudly Posting Without Reading The Article"
Thats my credit card number!
"index of /admin" site:.gov
Pwned!
Well that gets us back to the free market correcting itself. I would ask you though if that's necessarily a good thing.
Remember Microsoft? Corporate giant, kinda unethical? Their producs are notoriously unsecure, and yet people still use Windows/IE/Outlook. Why? Because free market economics don't work in a corporate dominated environment. We don't have free market capitalism, we have corporate monculture, and it's notoriously unreliable for producing good, solid, honest products. Instead we get salesweasels shovel^H^H^H^H selling producs that don't work as advertised. Better alternatives are quashed, or relegated to the open source community (which is good, but lacks an R&D budget). I think you're being overly optimistic.
Erotic is when you use a feather. Exotic is when you use the whole chicken.
This could be good in finding websites that illegally publish this content.
With this search in google:
Mastercard 5000000000000000..5999999999999999
I found this russian site that published American credit card information with expiration dates, names and addresses:
http://kupi-cc.0golf.com/halyva.htm
Scary stuff. I would prefer google to find this information so that I can type in a simple query and see where my information is being wrongly published then not knowing at all.
I'm surprised at how easily you guys assume other net users are simply so dumb? Let's be a bit more humble and take any news/comment with a grain of salt. If you try the search suggested, you'll see some sites were russian forums exchanging credit card numbers they illegally obtained.
Besides, who would ever take the time to post one's own credit card numbers on the net? It's dumb to assume someone did that by themselves, frankly. I can only imagine someone might got card lost and the number got into those illegal forums, or someone put the number in an email to CS representative and the email got put into FAQ, or scenarios like that.
On a lark, I've tried searching P2P (in this case, Kazaa), for things that people have inadvertently made available. The things I found were jaw-dropping. Beyond the expected credit card and finance information, I found patent applications, doctoral dissertations, corporate documents, etc.
I'm pretty laissez faire on this one. If you leave your keys in the car and car running, the insurance company won't cover its theft (or at least, so goes the lore). Same principle applies here, I think.
-db
This person uses a lot of (paraphrase) "I haven't seen it myself, but I am sure real numbers are there."
Unless this person can site a real case then all he did was show us test files (as he claims he has seen)
I mod down so you can mod up. Your welcome.
At this point if I were someone looking for a free credit card, I'd probably go at least a few down in the results, I'd like to think that the top 20 or so are plants by law enforcement by now...at least I'd hope...
...in bed
Any website that accepts credit card payments worth using will require an AVS number and address.
As for coding these numbers on to other cards and using them in bricks and mortar shops, you would hope that the shops check that the embossed number matches. If they have checked all this, under UK law anyway, the CC company is liable.
With chip and pin cards being introduced across Europe CC numbers are becoming more and more useless to criminals now.
----
actually, I didn't input the entire number, I omitted the last four.
In that case you won't find it even if it was there. Google uses exact matches, so 1234 won't match 123456789.
Beware: In C++, your friends can see your privates!
Yes and they also mentioned that this wasn't as big a deal as people think.
For one the the valid credit cards numbers will be rapidly be made useless as 3rd parties use them and they are cancelled. The bottom line is very few customers will be liable for any of these fraudulent transactions.
The majority of the credit card numbers are on semi underground script kiddy sites. Where they are posted to gain cred or access to pr0n. I'd like to bet that most of these are invalid or the product of a credit card number generator.
Lastly this article implies (and a number of posters here) that the credit card numbersfound are the result of carelessness by credit card holders on the web and therfor it is their own fault. This is not the case. Google did not expose any mass stupidity by internet users, it simply exposed some of the sites that havest credit card numbers.
Unfortunately there isn't a good way to search for URL strings like this:
2 6b 40f-c8a84ba388
... EVERYONE will have Gmail!
http://gmail.google.com/gmail/a-e00073f786-289e
But once someone figures out a way
--
Until then, five of you can hit me up at kevinomara at gmail.
Seems that everything, except the personal information posted by a third party, can be summed up by a simple common acronym: RTFM. Ignorance of the law isnt a defense -- neither should be not reading the manual.
Sometimes I wish computers were less friendly.
"Parent directory". That Google search is the most fun you can have with your clothes on.
There are banks offering special 'web credit card' services. They issue credit card numbers that are valid only for a single transaction. After the transaction has taken place, the number expires. Even if a site would have serious security issues, allowing someone to see all the credit card numbers they ever received from people, these single-transaction numbers would be worthless to anyone finding them. Of course ultimately a website shouldn't ever receive credit card numbers, but instead relay credit card payment to a bank and then communicate with that bank to see if all went well, but that is another issue.
Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book
Actually, at least here in Canada, the insurance companies have to cover you even if the keys are in the ignition--theft is theft. I know this because my father just went through getting his truck stolen after leaving the keys in the ignition.
:)
The insurance companies will try to bully you into thinking that they don't have to cover you, but they do. However if they can convince you that they don't have to and you just go away then they don't have to pay you. This is the usual course of action.
Luckily my father has a good insurance broker who knows the law and wouldn't let his client be bullied. Its astounding what insurance companies can get away with.
This of course after them pleading poor to the Canadian government only to report record profits a couple of months later. What's $2.6Billion among friends? Now that is in Canadian funds but it still works out to about $100US or so
I'd like to see more of that kind of thing, preferrably all of the following as options:
"Good everywhere all the time, with no control at all" just seems like a bad idea. But since banks either shit on the consumer or the merchant when it comes to fraud, they have little incentive to secure the system. When they pass the new bankruptcy bill in congress, even shoddy lending practices will be given a pass as well.
A while ago SOME GUY ON IRC personal Cabletron switch puked out, so SOME GUY ON IRC needed a new firmware image. Low and behold, SOME GUY found an account via google. Some school posted theirs online. (Cabletron makes overpriced gear sold to gov't mainly, you can generally get enterprise level huge switches on ebay for $5, since it doesn't carry the Cisco name.). Oh that was a lucky find, since hardly anyone uses Cabletron (now Enterasys) equipment, it is hard to find unlike Cisco CCO accounts.
Google rocks! Don't forget to google for your FLEXLM license files for your Solaris and similar systems, or your crusty Digital licenses for VMS, OSF/1, etc.
Southeastern Virginia REPRESENT!
Soon enough all valid Visa numbers will be slashdotted by orders at ThinkGeek.
/^([Ss]ame [Bb]at (time, |channel.)){2}$/
...is the price of a cheese pizza and a large soda at Pinnuci's!
Facts do not cease to exist because they are ignored. - Aldous Huxley
I just called all the people on one of the lists linked here and either left a msg or explained the situation. Took about 30 minutes. The clearest way I found of convincing them was to tell them how to do the Google search themselves. For most of them, their name in quotes and the word "MasterCard" or whatever brought up 1 page, the page with their info on it. I got many answering machines and disconnected numbers, but a few thanks as well.
Anyone know what that 481 on the signature strip is for?
It actually depends on what the name is on the front of the card. It has different meanings for different names.
Yours would be.... ?
--LordPixie
"outlook.pst" filetype:pst
MBNA has ShopSafe
Citibank has Virtual Account Numbers
Discover has Discover Deskshop
even American Express...
This is *nothing* new
For Visa, I did this one and got 2450 pages of listings of credit card numbers. Doing the same for Master Card returns only another 481 pages - not just card numbers, but web pages containing numbers - and some are test pages to demonstrate how LUHN codes work, but I don't think they all are. Oh, let's not leave home without American Express, where we can find a whopping 7,780 pages of listings!
I don't think they are all tests. Some include the number, expiration date, plus the name, address and telephone number of some people who apparently placed orders on-line. A great way to commit fraud or implement identity theft, wouldn't you say?
My guess is that if you called some of these people you would find out that yes, that is their credit card number and they had no idea it had been exposed.
Oh, I forgot to troll for Social Security Numbers. Now that returns 7 million pages, most being things like zip codes and such, but it wouldn't be hard to do that by redoing the search on an automated basis by inserting the '-' where appropriate and generating several thousand searches. At random I picked a range and tried all Social Security 301-01 numbers, and got 115 pages. Not only that, but the text ad from Google was for a company that offered on-line searches of social security information! Very helpful too!
Paul Robinson
The lessons of history teach us - if they teach us anything - that nobody learns the lessons that history teaches us.
http://help.yahoo.com/help/us/ysearch/tips/tips-01 .html
* Airport Information
* Airline Registration Information
* Area Codes
* Calculator
* Dictionary Definitions
* Encyclopedia Lookup
* Exchange Rates
* Flight Tracker
* Gas Prices
* Hotel Finder
* ISBN Numbers
* Local Search[new]
* Maps
* Movie Showtimes
* News
* Packages
* Patents
* Sports Scores
* Stock Quotes
* Synonym Finder
* Time Zones
* Traffic
* UPC Codes
* VIN Number
* Weights, Measures and Temperatures
* Weather
* Zip Codes
SIGUSR1
If you find something of yours that shouldn't be online, and you have access to the server, the best thing to do is put up an empty document with the same name.
Contacting google to remove their 'hit' on it could take a while, and remember--there *are* other search engines out there. If the doc just disappears, it'll stay in Google's cache (and who knows who else's) for who knows how long.
However, if a doc with the same name and same location still exists but has little, no, or bogus data, the engines will suck up this new worthless copy the next time they come 'round and the good copy in their cache will be overwritten with the new worthless copy.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
I can't tell if you're being ironic or just stupid.
You're suggesting that you "secure" you sensitive information by listing where it is in robots.txt? I think I want to have a look in your robots.txt, now.
The purpose of robots.txt is not to secure your information, it is to avoid getting eaten alive by bandwidth-hogging search spiders, and to prevent spiders from indexing irrelevant or out of date information.
If you want your information to be secure, here's a hint: don't put it on a fricking web server.
One thing I don't think I've seen mentioned yet though, is that everyone is assuming that people choose to post the data in question. While this is probably true to a large part, it is by no means always the case. Some of the data may have been stolen due in no part to the victims (hacked website, disgruntled employee at a bank, etc) was then posted.
Vote Quimby.
I worry, now that it's on Slashdot, a certain Visa search will end up on Zeitgeist for sure!