April 23, 2004
Googling for sensitive info
A sysadmin should be responsible for assuring that sensitive info doesn't get published to the web. Here's list of googledorks with links to how such info is exposed to the public.
Take a look and see if your server is making any of these mistakes. Then think about why it's a bad thing...
An important point to consider is how these links can be used to hammer away at your user login passwords. Often times these web pages don't take sufficient care to guard against brute force password attacks. Here's the scenario, your users are setting up accounts for themselves on 3rd party websites. They're using the same username as the one they use at work. Then they're also using the same password as their work account. How is this bad? You might think that since your work sites are setup to monitor and report if any bad logins are attempted (they ARE, arent't they?) that you'd be safe. WRONG.
Here's why, should someone guess Joe's account username they could then hammer away at these outside sites trying to break his password. Then all they'd need to do is come back to the work site and trying using the discovered password. There'd be nothing you could detect, other than their source IP, that would prevent it. Thus you really need to stress to your users that using the same password across many different systems is a REALLY BAD THING. If anything, given user laziness, you should stress that they NOT use their work username and password on ANY other systems.
The next step, if you're running such site, might be to consider providing some sort of notiifcation to your users if their account login is being unduly accessed. Just send their e-mail address a short message that says something like "Your account has been repeated accessed from IP address: x.x.x.x using the wrong password." Granted, this might run the risk of having them ask you what the hell to do about it. Yes, you might be risking actual contact from your users seeking assistance. Consider this as an oppportunity to let them know you're looking out for them; they'll be stunned to encounter a sysadmin that actually cares.
