Config error leaked Google whois data for 280K domains
(Ars):
http://arstechnica.com/security/2015/03/epic-google-snafu-leaks-hidden-whois-data-for-280000-domains/
"Google leaked the complete hidden whois data attached to more than
282,000 domains registered through the company's Google Apps for Work
service, a breach that could bite good and bad guys alike. The
282,867 domains counted by Cisco Systems' researchers account for 94
percent of the addresses Google Apps has registered through a
partnership with registrar eNom. Among the services is one that
charges an additional $6 per year to shield from public view all
personal information included in domain name whois records. Rather
than being published publicly, the information is promised to remain
in the hands of eNom except when it receives a court order to turn it
over. Starting in mid 2013, a software defect in Google Apps started
leaking the data, including names, phone numbers, physical addresses,
e-mail addresses, and more. The bug caused the data to become public
once a domain registration was renewed. Cisco's Talos Security
Intelligence and Research Group discovered it on February 19, and five
days later the leak was plugged, slightly shy of two years after it
first sprung."
- - -
As someone who feels that all WHOIS data should be fully public except
in exceptional circumstances (I've discussed why in the past), it's
difficult for me to get too worked up about this on that level -- but
obviously if you're told that information is private it's important
that it really is private.
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
