WARNING! Google Search Reveals Credit-Card Numbers

[On the Road]

---snip

The search request was simple. Using a researcher's Visa debit card, we started with the first four numbers on the card and extended the span of possible number combinations. So we entered in the google.com search window: visa 4060000000000000..4060999999999999.


The result was a long list of Visa card numbers complete with name, address, phone number, expiration dates and a list of recent purchases. In less than two seconds, we found everything a cyber crook would need for one heck of a shopping spree or a fresh new identity.

---snip

http://news.yahoo.com/news?tmpl=story&u=/nf/20040916/tc_nf/26967

------------------

Apparently, some websites store credit card numbers in a way that shows up on search engines.

It might a good idea to Google your own credit card numbers to make sure they don't show up (mine didn't). If they do, requesting a new card might be a good idea

[gasperc]

1. this seems unbelievable

:beer:

[On the Road]

4. Iit's difficult to believe that webmasters could be so stupid,

but there are all kinds of clueless small businesses trying to make money on the internet.

I had some job responsibilities in telephone fraud a few years ago, and it's amazing what loopholes open up sometimes.

[Carla in Ca]

25. Did you read the August 7th thread in the 'Politics and Campaigns"

forum?
Someone in her state got a hold of voter registration sheets and sent in changes of address for them! How widespread could this be? Another reason to vote absentee, I think.

[Pallas180]

2. Thanks RIBO - that' s very important.... thanks again

:hi:

[rabid_nerd]

3. If you google your own credit card

you might as well post it online

you've just posted your card number to an unsecure form! (non-https) and advertisers on google.com get search terms in their statistics.

[rabid_nerd]

5. example query

SCARY... Example

Google card query

[On the Road]

9. I Did Some Tests Myself

and it does appear that there are some search results with name, VISA number, expiration date, and IP address. Censored example (original had full name and number):

VISA::Mary H********::4820XXXXXXXXXXXX::06-04::205.XXX.XXX.XXX]

On Edit: It looked like this site was storing new memberships for some local association, so the security probably wasn't that good. But what's even stranger is that the website used secure http (the URL started with "https").

[On the Road]

6. Well, Maybe a Better Idea Would Be to Search on a Range

of numbers so your individual number doesn't come up.

But even if it does, there wouldn't be any name or associated information with it. That's what makes me more concerned.

[neomonkey]

8. Egads

This whole thing is oozing of SCAM.

[chiburb]

7. I think this hack has been "closed"

According to one hacker's site I visited. Also, the query doesn't work for me; even using my own cc#

[On the Road]

10. Hmmm... Strangely Enough, It Worked for Me Just Now

To completely close the loophole, you would need to eliminate all the "number range" features on all the search engines -- otherwise, you could just go to Dogpile, Northern Lights, or some foreign search engine. The only other way would be to eliminate all the insecure storage of credit card numbers.

I'm wondering whether the hackers are only pretending to be stymied.

[gasperc]

12. if you type your CC# into the google search where's it go??

doesn't it end up in some cache somewhere?? isn't it dumb simply to type in any private# into google. Albeit checks need to be done to see if private numbers can be easily searched but this seems like a very dumb way to do it, in fact makes the problem worse.

[On the Road]

14. As Rabbit_Nerd Pointed Out, That May be True

although just having a credit card number without a name or expiration date is not as useful as having all the information.

A better way to check might be to use a number range. You can use the number range feature of Google, put your credit card number on both ends of the range, and change the last two digits to "00" and "99" respectively. That will cover a range of 100 possible card numbers.

[chiburb]

13. Check it for yourself, I'm no expert!

3] Almost everybody has heard of this hack. Google spits out credit card numbers when you type visa+4356000000000000..4356999999999999 (this hack no longer works.)

http://pepechingon.com/

Like I said, I know nothing...


:-)

[vajraroshana]

11. sounds very farfetched

I smell an internet urban legend in the making.

[On the Road]

16. Try it Yourself

I was able to get some names, numbers, and expiraiton dates this way, including the Mary H mentioned above who may not know her credit card is available on the net.

The article picked up by Yahoo came from a legitimate business periodical on Customer Service:

http://crm-daily.newsfactor.com/

[zbdent]

15. Well, whaddaya expect? There were reports of hackers getting into

some major credit card company computers early this year or sometime last year.

Wouldn't surprise me if a lot of this was available somewhere after the hackers were done with the info . . .

[On the Road]

18. Seems Like Most of This is Due to

Small sites which use credit cards and don't take steps to make sure the data files are NOT available to web searches. The hits I got looked mostly rinky-dink.

The worst thing about this is that you don't even have to be a hacker, just someone capable of using Google.

[Obamarama]

17. I'll try this tonight with some cards I have recently cancelled....

That way, if this is any sort of scam at least they will be scamming a closed account that can't be used. I'll report back on my findings.

[Bandit]

19. I just tried two card numbers I know are valid and got zero results

:shrug: Did not match any documents. No pages were found matching #####

[On the Road]

22. Not Surprising --

Most card numbers are probably NOT able to be Googled.

Nevertheless, there seem to be many that are. Depends if you gave your number to an amateurish website that didn't secure it properly.

[Cronus Protagonist]

20. My friend was interviewed by FOX News because his card was on the net

Just as described above.

Fascism: We Report You Decide
http://cronus.com/quiz

You might be a Republican if...
http://cronus.com/quiz

Commentary by a Republican...
http://cronus.com/republican

The REAL Republican Platform...
http://cronus.com/platform

Bush's Illustrated Resume
http://cronus.com/bushresume

Isn't That Strange?
http://cronus.com/oil

:)

[Pallas180]

21. Cheez, I tried it with just the first 4 numbers of my visa as shown

to do in the header,,and some guys address and full credit card number, (among many others) showed up where he bought a machine gun
for $18,000.

I'm not kidding.

whewww

This is scary.

But it certainly didn't have all cc numbers.

How would I find out directly if mine is on?

Use first four # and last four #

[On the Road]

23. I Would Suggest Trying the First 14 Digits

and making the last two "00" to 99". That way, your number is hidden in a range including 99 other cards.

[Pallas180]

26. It doesn't seem to work on Mastercard at all, I mean if

you put in MC or mastercard

[On the Road]

27. Did You Try Searching on the First Four Digits of a Real Mastercard?

The sites that I saw probably didn't discriminate. They had card numbers, names, expiration dates, along with a ton of irrelevant stuff. Most card numbers are not on the web, but some are.

[Pallas180]

29. Yup I tried with first four..works on Visa , but not M/C - can you show

how to put in M/C

is it Mastercard or
M/C or

MC

darn it. someone paid me a loan by sending it to my credit cards and
put it on line. damm

[On the Road]

31. You May Not Even Need to Use the Term "Mastercard"

the only purpose is to avoid extraneous hits like the 1 million digits of pi or long encryption strings. Maybe there's another term that would show sometimes for these sites.

[951]

24. I remember reading about this months ago its probably old news

[George W. Dunce]

28. This is why all my on line

purchases with a pre paid Master Card. If the number gets intercepted or stolen from a site I won't lose more then what is currently on it. Never more then $500 on it.

[Blue_Tires]

30. as someone who is battling in an ID theft case

i find this very unsettling