Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/23/2010
02:45 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Blippy Leaks Four Credit Card Numbers

Social exhibitionism meets Google Search and learns that one can share too much information.

One day after The New York Times explored the rise in social Web sites that expose information about users' purchases and activities, declaring that people are becoming more relaxed about privacy, a minor data breach at one such site offers a reminder that people do indeed have something to hide.

Blippy.com, a social Web site that allows users to share information about things they've bought, was found to have leaked four credit card numbers. All of the numbers begin with 5424, the Citibank Mastercard prefix, suggesting that statements provided to Blippy by one particular payment processor contained too much information.

A Google search for the exact phrase "from card" in conjunction with the site: operator to restrict the search to the blippy.com domain turned up the four credit card numbers for purchases made at merchants such as Audible, Exxon Mobile, Pizza Hut, iHop, Kroger's, Starbucks, Wendy's, and numerous others.

The same search on Bing.com does not reveal credit card numbers and it appears that Bing has not even indexed them -- a search for a specific credit card number returns no results in Bing.

Ask.com and Yahoo.com searches also do not return credit cards from Blippy.

The reason for this is that Google's indexing procedure is not only extremely fast but also aware of new data on servers -- even data that has not been linked to other pages -- if the site owner has published what's called a site map. Site maps tell Google's crawler where to look for information.

In a phone interview, Blippy co-founder and CEO Ashvin Kumar said that Blippy has asked Google to remove the information.

Google responded as this article was being written. Subsequent efforts to access the search results pages were rejected with the following message: "We're sorry ... but your computer or network may be sending automated queries. To protect our users, we can't process your request right now."

In a blog post, the company offered an official statement: "Many months ago when we were first building Blippy, some raw (not cleaned up, but typically harmless) data could be viewed in the HTML source of a Blippy Web page. The average user would see nothing, but a determined person could see 'raw' line items. Still, this was mostly harmless -- stuff like store numbers and such. And it was all removed and fixed quickly."

But according to the company, Google indexed this information before it was cleaned up. While cached pages were subsequently updated to reflect the clean versions of the Web pages published by Blippy, its search snippets continued to include the data that had long since been removed from Blippy's files.

In a statement, Google confirmed that it was dealing with the issue.

"Around 9:00 a.m. Pacific we learned that Blippy.com had published credit card numbers on their website," a Google spokesperson said in an e-mailed statement. "As part of our usual crawling and indexing process, these numbers became discoverable in Google search snippets. Blippy contacted us and we took special measures to remove the numbers from search results. We fixed the problem around 11:20 a.m. Pacific and the numbers should no longer be discoverable in search."

Aware that news of the incident was spreading on Twitter, Google accelerated its takedown procedure for the information. But even so, the exposed credit card numbers have been copied to online forums like anonboard.com.

This means that the unfortunate individuals affected face an elevated risk of fraud or identity theft, even with the removal of their information from Google's search snippets.

Asked whether this incident might make some people reconsider sharing information, Kumar said, "Naturally people may feel that way, but they should know that security is a super-important issue for us. At the end of the day, we're all users of Blippy too and we don't want our information exposed."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29370
PUBLISHED: 2021-04-13
A UXSS was discovered in the Thanos-Soft Cheetah Browser in Android 1.2.0 due to the inadequate filter of the intent scheme. This resulted in Cross-site scripting on the cheetah browser in any website.
CVE-2021-3460
PUBLISHED: 2021-04-13
The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could lead to the communication channel being accessible by an attacker.
CVE-2021-3462
PUBLISHED: 2021-04-13
A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthorized access to the driver's device object.
CVE-2021-3463
PUBLISHED: 2021-04-13
A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could cause systems to experience a blue screen error.
CVE-2021-3471
PUBLISHED: 2021-04-13
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.