|
It is surprisingly easy to search peer-to-peer (P2P) networks for sensitive and personal data, and because of this, P2P file sharing should be promptly added to a companys list of security threats. Using just a few simple tools, confidential business documents, billing data, internal audits, health records, and product specifications can be easily and quickly found on P2P networks, essentially making them accessible to anyone in the world. Inadvertent file sharing usually occurs when someone is downloading media files and agrees to share files from the default Windows My Documents folder. Several P2P protocols exist that include programs built for accessing the network, including BitTorrent (used the most for legitimate purposes) and Gnutella which is favored by open source enthusiasts. In addition, every client is a server and therefore searchable. The author used LimeWire Pro, Gnutellas most popular client, to search for potentially sensitive files. What he found was shocking and scary. Using the search term audit and LimeWires Browse Host button pulled up an internal audit plan and notes from internal investigations, among other things. The search term ssn resulted in bank passwords, credit card numbers, credit reports, and tax returns. Other sensitive information that was revealed included the HIV and hepatitis status of patients, home and cell phone numbers of U.S. Senators, and divorce documents. People known as information concentrators troll P2P networks for exactly this kind of information, looking to exploit it and use it for identity theft. It seems that many of the data leaks were coming from small businesses that were partners to large companies.
|