Users of P2P (peer-to-peer) file-sharing services may be sharing more than they bargained for, a former White House cybersecurity advisor has warned. Security researchers have found thousands of files with sensitive information by searching through file-sharing networks, said Howard Schmidt, CEO at R&H Security Consulting. Schmidt, who has also worked as chief security officer for Microsoft, made the comments during an SDForum seminar.
Medical records, financial information and router passwords have all popped up on P2P networks, often after users inadvertently share folders containing the data. "People don't realise you're not just sharing your music," Schmidt said. "You're sharing your personal files."
Millions of households still use P2P services, though the practice of illegally downloading music from these services has been on the decline, according to the NPD Group research firm. And with all of those possible victims, criminals see an opportunity to search these networks for sensitive information, Schmidt said. "These are real live search strings the bad guys are using: bank such-and-such statement for August, bank such-and-such May statement, account summaries, account stop payment, internet scams, bank routing information," he said.
News source: Macworld UK
Some of the P2P searches have been more ominous, he added. "We've actually found people out there searching for how to make sarin gas." Tiversa, a security company in Wexford, Pennsylvania, conducted the research. Schmidt is an advisor to Tiversa.
Hackers have already evolved sophisticated techniques for using Google's search engine to unearth data that has accidentally been exposed on websites. But with P2P hacking, attackers can get access to data on a victim's desktop. "You can set something up for an hour, search for it, and you're gone," Schmidt said. He estimates that there are nearly four times as many P2P searches conducted each day as there are Google searches.
Ironically, a US law enacted to help fight identity theft may be helping the bad guys.
The Fair Credit Reporting Act allows US consumers to request a free credit report once every 12 months, but some P2P users are inadvertently sharing this information, Schmidt said. "They will go to the [free credit report] website, do all the validations necessary, download it on their desktop," he said. "Well what does it contain? Some of them have full date of birth and all this other stuff: your credit cards, places you've lived, spouses' names, and on and on."
Medical records are another source of concern. Researchers found one physician accidentally sharing 97 files with patient data on them, Schmidt said. "I don't think if I was his patient, I would want this information out on any network, let alone a peer-to-peer network."
