Poor website security means that criminals can harvest credit-card details with nothing more exotic than a Google search, according to hosting company UKFast.
 |
| Simple Google search harvests credit-card details |
The company discovered open databases on multiple company networks that meant a well-tailored search could uncover customer details with no need to crack the network's security.
“Anyone can find this information – there is nothing you require apart from a browser and the thought on how to construct a good search,” said Neil Lathwood, IT director at UKFast.
“Google is very good at indexing, so any indexable back-up files stored on the server may not be linked to from the website, but can still be found through Google and anyone - even without advanced technical skills - is able to find it.”
According to Lathwood, one of the many databases found through a simple Google search uncovered 1,800 valid credit-card details processed by an American takeaway, including names, expiry dates and security codes.
UKFast said these sort of low-level, under-the-radar attacks were potentially more dangerous than widely publicised data breaches, such as the Sony attack which saw card details of 77m accounts breached, as the compromised cards were quickly flagged or cancelled once the attack was discovered.
Lathwood said less obvious attacks were more worrisome, "the ones where you have been compromised and do not know it".
“We have identified users who can sell full credit-card details of individuals for as little as $5. These are the greater concern as they are using techniques that are harder to track and trace. As a result they continue to gain details at an unknown rate.”
UKFast said it was not disclosing the search terms it used in its research in case the details were used to mount further attacks.
We have identified users who can sell full credit-card details of individuals for as little as $5
This is dummy text. It is not meant to be read. Accordingly, it is difficult to figure out when to end it. But then, this is dummy text. It is not meant to be read. Period.
Conversion Conversion Emoticon Emoticon