Slashdot Mirror
Has Google Indexed Your Backup Drive?
itwbennett writes Depending on how you've configured the device, your backup drive may have been indexed by Google, making some seriously personal information freely available online to anyone who knows what they're looking for. Using a few simple Google searches, CSO's Steve Ragan discovered thousands of personal records and documents online, including sales receipts with credit card information and tax documents with social security numbers. In all cases, the files were exposed because someone used a misconfigured device acting as a personal cloud, or FTP (File Transfer Protocol) was enabled on their router.
How idiots got their backups indexed ?
It doesn't matter how many times this happens, or if it happens to customers, companies, or the government, nothing changes. Everyone points fingers, people are confused about what's going on because they aren't a 'computer person', the 'computer people' get annoyed that their grandma is giving them shit because they didn't configure something correctly and her cc info got stolen and sold to some Russian kid, and everyone else just doesn't even care at all.
Security apocalypse when?
There was a link on another webpage that pointed to that server in the first place.
Not only the most insecure set up, but he already had links to that insecure setup.
I think much of Slashdot might agree with me that if you're silly enough to deploy a public-facing server with no or default authentication, yeah, you'll probably deserved get indexed by Google.
So there are lots of people out there who are:
1. Enabling FTP on their NAS boxes.
2. Enabling anonymous access on this FTP service
3. Allowing their Firewall/Router to let incoming FTP connections directly to the NAS box.
I mean, the authors suggest those enabling FTP do not realize the implications, but how can you do ALL THREE and not realize the implications? Any one of those, particularly disabling anonymous access, would foil random search engines (and lazy hackers) trying to get at your files. But to do all three at once?
You are not alone. This is not normal. None of this is normal.
maybe sort of related... http://freer.com/bits/wp-conte...
No Yipppeeeeee!
By now even the slowest 'puter users should be wise that once it leaves your machine it ain't yours anymore.
It's just all the same, along with FTP, FBI, WIFI, ICMP, ICBM, IBM, and RTFM. It's not different than the road.. clearly they're driving, just not clue on how to do it or how it works.
I store my bank statements in a "personal cloud" too. They come in the post and then I place them in a blue metal box I keep in my cupboard. Good luck indexing that, Google.
So, you're saying you're a Republican?
Scaremongering bullshit. Fuck you Slashdot.
Great to see that many are following his footsteps now!
I once had a signature.
If you've got sensitive stuff naked on the net then you have seriously fucked up and should not be allowed near other people's sensitive stuff.
Google indexes everything?
-inurl:htm -inurl:html -inurl:php intitle:”index of” (mp3) “singing in the rain”
I cannot find any sort of extensive manual at google for how to perform highly advanced searches.
I understand google search can support nearly regex like syntax and has all sorts of set and type modifiers.
Does anyone have a link to a really good google search cheatsheet for advanced users?
I love how Google is mentioned here while all of the other search engines get a free pass. As if their crawlers haven't done the same thing.
Actual the twit in poster or author of the pieces is out of bounds.
Useless FUD, except the huge buckets of cash twit is searching for. Rubbish post.
A quick search returned bank statements, someones 2012 1040 tax form (completed w/ soc and everything)...
Couldn't find any porn though. I guess those aren't making it into the google indexes...
Is Google really at fault? They handled it poorly, yes, but the data was already out there to be used by blackhats. It would be better if they placed a file on the FTP "You know these files are open to the internet because your router configuration sucks, right?.txt".
Well, I might have a way, but it only works on a semi spherical planet in a vacuum.
a one liner: "If you've made your private files available publically (either intentionally or through ignorance) then your private files are available publically."
Removing them from google results is far less important than making the files themselves no longer available.
Looking on google to see if they are available is sort of silly - if you're using one of these silly commercial "automatic backup" packages that came bundled with an external drive, read its manual and documentation, and review its configuration, as well as that of your router.
"Has Google Indexed Your Backup Drive?"
Yes, if you're a pillock that's configured your backup drive in such a way that you allow authenticated remote access to it from the Internet and it has FTP or HTTP protocols enabled.
"Has Google Indexed Your Naked Pictures Of Your Wife?"
Similar answer.
Plain FTP should have died in the 1990s. sftp is the replacement.
Why are we even having this issue today?
Not if you use Google's cached webpages
so I was working at a University several years back. At the time there was an old webserver, actually a desktop. It was previously used by an admin who left and left behind a web service with notes. It was a collection of brain dumps, notes, old emails etc....which all of us admins knew about and occasionally referenced, that's why we never shut it down....or particularly considered its contents.
That is until we saw an article in the local school student run rumor mill, which most of us read, about this fascinating website on campus with a number of internal emails shedding new insight on some of the inner workings of the staff.
Of course, we saw the article because half the staff found the rumor site amusing and read it on a regular basis, so it was shut down immediately, but it didn't take long before someone posted a link to it in the google cache. Smart kids, as annoying as it was, it still put a smile on my face to see how resourceful they were.
"I opened my eyes, and everything went dark again"
When you have millions of people using the internet and setting up devices connected to the internet when they haven't the slightest clue how to properly configure, administer and maintain such devices... yeah...
When you hand unqualified people advanced technology, stupidity happens.
I just hope that in the name of safety for the millions of unqualified we don't get ISP's closing down running services of any kind from home. Probably will happen though, in the name of safety. Glad I migrated all my internet facing services to AWS years ago.
Personally, I think people should require a license to connect ANYTHING to the internet, sort of like how we have to have a license to operate motor vehicles, or HAM radios. There's just too much stupid out there messing things up for the qualified.
I'm reminded of the old bag of glass SNL skit - some products (or product features) are just plain dangerous, and saying "but we explain the risks in page 17 of the manual" isn't a good excuse.
How much effort would it take to set defaults that (1) disable anonymous FTP for addresses outside of the local subnet, and (b) inject a fake robots.txt that prevents search engine indexing? And then add an explanation of the risks if you try to disable those defaults?
This is not a google problem, it's a moron problem.
Headline should read "Have YOU misconfigured your backup drive?"
I have never agreed to any terms and conditions to google or anybody else, and by providing the service, google have agreed to MY terms and conditions.
My data is my intelectual property and any attempt to access it by any means is an act of war. and subject to a measured response.
It was Apple.
Sadly, a Libertarian cannot force his views on another, and freedom cannot spread as does the cancer known as religion.