Slashdot Mirror
Has Google Indexed Your Backup Drive?
itwbennett writes Depending on how you've configured the device, your backup drive may have been indexed by Google, making some seriously personal information freely available online to anyone who knows what they're looking for. Using a few simple Google searches, CSO's Steve Ragan discovered thousands of personal records and documents online, including sales receipts with credit card information and tax documents with social security numbers. In all cases, the files were exposed because someone used a misconfigured device acting as a personal cloud, or FTP (File Transfer Protocol) was enabled on their router.
There was a link on another webpage that pointed to that server in the first place.
Not only the most insecure set up, but he already had links to that insecure setup.
I think much of Slashdot might agree with me that if you're silly enough to deploy a public-facing server with no or default authentication, yeah, you'll probably deserved get indexed by Google.
So there are lots of people out there who are:
1. Enabling FTP on their NAS boxes.
2. Enabling anonymous access on this FTP service
3. Allowing their Firewall/Router to let incoming FTP connections directly to the NAS box.
I mean, the authors suggest those enabling FTP do not realize the implications, but how can you do ALL THREE and not realize the implications? Any one of those, particularly disabling anonymous access, would foil random search engines (and lazy hackers) trying to get at your files. But to do all three at once?
You are not alone. This is not normal. None of this is normal.
maybe sort of related... http://freer.com/bits/wp-conte...
So, you're saying you're a Republican?
Great to see that many are following his footsteps now!
I once had a signature.
If you've got sensitive stuff naked on the net then you have seriously fucked up and should not be allowed near other people's sensitive stuff.
Google indexes everything?
-inurl:htm -inurl:html -inurl:php intitle:”index of” (mp3) “singing in the rain”
How idiots got their backups indexed ?
As it turns out, dumbass people do dumbass things - things like taking a significant risk with something complex that you do not remotely understand. You either decline the risk entirely, learn a few fundamentals about how it works, or hire someone who has learned them. Those are your sole rational choices. Dumbasses think there's a viable fourth option: invest more heavily than you think in something you know (or should know) you don't understand.
You can see how "I am not a computer expert!" and other bullshit excuses are just a smokescreen. If you really knew that to be a fact, you wouldn't try to tackle it yourself. It's just egos doing what egos do, playing stupid blame games instead of identifying and solving the problem.
Ignorance is far superior to stupidity because ignorance potentially learns from its mistakes and does not repeat them.
Yeah, Google Advanced Search https://www.google.ca/advanced_search
Did you try googling it?
http://lmgtfy.com/?q=advanced+...
I wonder if I should feel bad that I know all of those acronyms so well (including that WiFi isn't normally capitalised like you had it - though personally I hate camel case).
You really do have to hope that someone RTFM before trying to use the ICBM though, and never, ever opens it up to FTP or WiFi... I'm not even sure I'd trust IBM or the FBI or NSA with an ICBM. :-)
Like this one? Now that would be hard to break into.
Does this help? (Amusingly, found using a non-advanced Google search...!)
Or this?
A quick search returned bank statements, someones 2012 1040 tax form (completed w/ soc and everything)...
Couldn't find any porn though. I guess those aren't making it into the google indexes...
Is Google really at fault? They handled it poorly, yes, but the data was already out there to be used by blackhats. It would be better if they placed a file on the FTP "You know these files are open to the internet because your router configuration sucks, right?.txt".
Well, I might have a way, but it only works on a semi spherical planet in a vacuum.
a one liner: "If you've made your private files available publically (either intentionally or through ignorance) then your private files are available publically."
Removing them from google results is far less important than making the files themselves no longer available.
Looking on google to see if they are available is sort of silly - if you're using one of these silly commercial "automatic backup" packages that came bundled with an external drive, read its manual and documentation, and review its configuration, as well as that of your router.
"Has Google Indexed Your Backup Drive?"
Yes, if you're a pillock that's configured your backup drive in such a way that you allow authenticated remote access to it from the Internet and it has FTP or HTTP protocols enabled.
"Has Google Indexed Your Naked Pictures Of Your Wife?"
Similar answer.
WiFi is Pascal case wIfI is camel case. The difference being whether the first character is upper or lower case.
so I was working at a University several years back. At the time there was an old webserver, actually a desktop. It was previously used by an admin who left and left behind a web service with notes. It was a collection of brain dumps, notes, old emails etc....which all of us admins knew about and occasionally referenced, that's why we never shut it down....or particularly considered its contents.
That is until we saw an article in the local school student run rumor mill, which most of us read, about this fascinating website on campus with a number of internal emails shedding new insight on some of the inner workings of the staff.
Of course, we saw the article because half the staff found the rumor site amusing and read it on a regular basis, so it was shut down immediately, but it didn't take long before someone posted a link to it in the google cache. Smart kids, as annoying as it was, it still put a smile on my face to see how resourceful they were.
"I opened my eyes, and everything went dark again"
When you have millions of people using the internet and setting up devices connected to the internet when they haven't the slightest clue how to properly configure, administer and maintain such devices... yeah...
When you hand unqualified people advanced technology, stupidity happens.
I just hope that in the name of safety for the millions of unqualified we don't get ISP's closing down running services of any kind from home. Probably will happen though, in the name of safety. Glad I migrated all my internet facing services to AWS years ago.
Personally, I think people should require a license to connect ANYTHING to the internet, sort of like how we have to have a license to operate motor vehicles, or HAM radios. There's just too much stupid out there messing things up for the qualified.
Until it was killed, I had Google index my backups all the time with Google Desktop. It was useful at the time for finding archived files.
I'm reminded of the old bag of glass SNL skit - some products (or product features) are just plain dangerous, and saying "but we explain the risks in page 17 of the manual" isn't a good excuse.
How much effort would it take to set defaults that (1) disable anonymous FTP for addresses outside of the local subnet, and (b) inject a fake robots.txt that prevents search engine indexing? And then add an explanation of the risks if you try to disable those defaults?
The problem is not FTP, it would have been the same with HTTP or any protocol that allows anonymous access to files. Although it is uncommon, you can even do it with with SFTP.
The issue is that people are making private files public through misconfigured routers, and Google's crawler is very good at finding and indexing anything public.
Bingo!
When you buy hardware/software, that's exactly what you're doing: Hiring experts.
Storage appliances should not allow anonymous access to sensitive data by default.
For those who deliberately take risks, they don't need to " ... hire someone who has learned them."
It little behooves the best of us to comment on the rest of us.
Er, wouldn't it be wiFi then?
I bow to your superior geekery. I still don't like capitals in the middle of words though. :-)
It was Apple.
Sadly, a Libertarian cannot force his views on another, and freedom cannot spread as does the cancer known as religion.