The Seattle Post-Intelligencer reveals how easy it is for hackers using nothing more than Google to uncover all kinds of supposedly private information:

Teams of hackers surfed the Web at Seattle University yesterday, harvesting Social Security and credit card numbers like a farmer cutting wheat. In less than an hour, they found millions of names, birth dates and numbers — cyberburglar tools for the crime of identity theft — using just one, familiar Internet search engine: Google.

But these were the good guys — members of a somewhat secretive organization of computer security pros, forensic cybercops, prosecutors and federal agents called Agora.

The group decided to lift the curtain of secrecy for a day to sound a warning about the dangers of “Google hacking.”

It turns out that the powerful search engine, in the hands of a knowledgeable cybertrekker, can ferret out all kinds of sensitive information never meant to be made public. All it takes are sophisticated search terms. The terms go beyond specifying key words to include file types. The right terms can even find information deleted from corporate or government Web sites but temporarily cached in Google’s massive warehouse of data….

“We’re simulating an ID-theft ring,” mumbled Heidt, who was focused on his screen as he entered a search term that, to the uninitiated, looked like nothing more than a jumble of meaningless letters.

Moments later, Heidt bellowed out “Yes” as military credit card numbers filled his screen. In the next chair, Akshay Aggarwal, also with IOActive, was grinning. “A million Social Security numbers of immigrants. Tax records. Addresses. What do you want?”

Truly disturbing.

comments (0)   trackbacks (11)