02:45 PM
Connect Directly

Blippy Leaks Four Credit Card Numbers

Social exhibitionism meets Google Search and learns that one can share too much information.

One day after The New York Times explored the rise in social Web sites that expose information about users' purchases and activities, declaring that people are becoming more relaxed about privacy, a minor data breach at one such site offers a reminder that people do indeed have something to hide.

Blippy.com, a social Web site that allows users to share information about things they've bought, was found to have leaked four credit card numbers. All of the numbers begin with 5424, the Citibank Mastercard prefix, suggesting that statements provided to Blippy by one particular payment processor contained too much information.

A Google search for the exact phrase "from card" in conjunction with the site: operator to restrict the search to the blippy.com domain turned up the four credit card numbers for purchases made at merchants such as Audible, Exxon Mobile, Pizza Hut, iHop, Kroger's, Starbucks, Wendy's, and numerous others.

The same search on Bing.com does not reveal credit card numbers and it appears that Bing has not even indexed them -- a search for a specific credit card number returns no results in Bing.

Ask.com and Yahoo.com searches also do not return credit cards from Blippy.

The reason for this is that Google's indexing procedure is not only extremely fast but also aware of new data on servers -- even data that has not been linked to other pages -- if the site owner has published what's called a site map. Site maps tell Google's crawler where to look for information.

In a phone interview, Blippy co-founder and CEO Ashvin Kumar said that Blippy has asked Google to remove the information.

Google responded as this article was being written. Subsequent efforts to access the search results pages were rejected with the following message: "We're sorry ... but your computer or network may be sending automated queries. To protect our users, we can't process your request right now."

In a blog post, the company offered an official statement: "Many months ago when we were first building Blippy, some raw (not cleaned up, but typically harmless) data could be viewed in the HTML source of a Blippy Web page. The average user would see nothing, but a determined person could see 'raw' line items. Still, this was mostly harmless -- stuff like store numbers and such. And it was all removed and fixed quickly."

But according to the company, Google indexed this information before it was cleaned up. While cached pages were subsequently updated to reflect the clean versions of the Web pages published by Blippy, its search snippets continued to include the data that had long since been removed from Blippy's files.

In a statement, Google confirmed that it was dealing with the issue.

"Around 9:00 a.m. Pacific we learned that Blippy.com had published credit card numbers on their website," a Google spokesperson said in an e-mailed statement. "As part of our usual crawling and indexing process, these numbers became discoverable in Google search snippets. Blippy contacted us and we took special measures to remove the numbers from search results. We fixed the problem around 11:20 a.m. Pacific and the numbers should no longer be discoverable in search."

Aware that news of the incident was spreading on Twitter, Google accelerated its takedown procedure for the information. But even so, the exposed credit card numbers have been copied to online forums like anonboard.com.

This means that the unfortunate individuals affected face an elevated risk of fraud or identity theft, even with the removal of their information from Google's search snippets.

Asked whether this incident might make some people reconsider sharing information, Kumar said, "Naturally people may feel that way, but they should know that security is a super-important issue for us. At the end of the day, we're all users of Blippy too and we don't want our information exposed."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-05-02
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595.

Published: 2015-05-01
The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.

Published: 2015-05-01
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request.

Published: 2015-05-01
Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users to cause a denial of service (prevent host start) by creating a long snapshot chain.

Published: 2015-05-01
Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd service and a plugin during service startup, which allows local users to obtain sensitive information by reading files in the directory.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.