The Internet of Many Things

The two keywords that I used in my smart search were “index.of” - indicating an OD and the other was a random sensitive topic like “crack” ; ”movie” ; ”games” and different file types “.mp3″ ; “.mp4″ ; “.exe”, etc. Later, I combined them or thought of different ones to use.

And there you had it, already thousands of results. 

It was chaos. Some ODs were just huge unorganized messes of old 00′s photos and videos (which were already a sensitive thing that nobody would be glad to have on the internet). Then it went to school stuff, memes, random images of game avatars, love letters, unmeaningful strips of code, organizational stuff, basically what you would have in your hard drive. 

Between these were also some “other” things. Or the whole open directory was filled with it. Porn, illegally downloaded music and movies, books, games. Some even left their passwords or the OD was hacked. 

What was mostly dangerous were lots of lists of names, students, some children that were using different login portals. We could find people with their names and email addresses, as well as phone numbers - this could’ve been used to exploit those people. Between these were also contracts and invoices.  

I also intended to search the search engine “Shodan.com” to help me find some open directories. To my surprise, there were lots of ODs that were hosted by well-known brands and services. 

During my search, I noticed that Open directories were mainly used between the 90′s and 00′s. Even if the popularity had dropped, there are still many that are updating, new people are putting stuff in and it’s important to remember to check if it’s legal to distribute / own the material that is on there. Lastly, always check if what you’re putting out there is okay for you and if it won’t hurt you or your property. There is surely an option to password protect your directory (I’ve stumbled upon a lot that were prohibited to anyone visiting). 

The easiest solution is to just not upload on web servers that don’t provide enough security and instead use a flash drive or an online cloud service that stores your files securely like OneDrive or Google drive. 

Ulož.to was harder to research in, since the search engine does not understand any other operators than keywords you put in. It was trickier to search for email type files.

I tried simply putting the e.g.:".msg" into the search bar and it turned out that a few results popped up for me. I then started to download all kinds of files, especially ones that had a suspicious name (names of companies, "bills", "inbox of name", etc.) or were big in size (some skyrocketed into 40GB!-couldn’t find that one again).

Most ".pst",".mbox" files were certainly inboxes of regular day people, filled with conversations about vacation, every day life or expired tickets, one was filled with plenty of emails exchanged between a psychiatrist and a lady suffering from depression. 

Most of the files I downloaded and looked through, may have included information you wouldn't be comfortable sharing with the whole world so easily, but didn't include any sensitive or dangerous information that could've been used against you or cause you any trouble.

However, after searching through some files, some were filled with business conversations that included lots of future plans, bills, statements of economic activity and loads of contacts of employees, their private addresses and phone numbers. Others included PDFs of their economic statements and bank information.

The most interesting find on Ulož.to was a ".pst" file of a certain IT systems company. The inbox was of an admin that everyone wrote to, if they had any complications or needed information. The admin unfortunately, sent every sensitive information in plaintext and left the ".pst" file onto the site to be discovered by me and probably some other people who stumbled upon it. The emails were filled with admin passwords, passwords for Office365, private contacts including addresses, phone numbers, their private emails, etc. One email included a file named "Action Plan" which described future economic plans for the company. None of these were safe to put out there, knowing you're an IT company where security is most definitely key.

On google.cz things weren't that vibrant. I spent a long time trying different combinations of operators/queries for searching sensitive email file type information, but came only across one file uploaded on a website. I did indeed find loads of sensitive information, but my task was to look for email files.

An ".eml" file held a couple of emails inside that were sent by two women discussing some financial steps. The interesting thing about it was that it was from the site "muni.cz" which belongs to an official university.  

I've used some basic operators such as intitle:"email"OR"outlook"OR"inbox" ; inurl:email, etc. But I also used combinations of queries that locate email addresses in more interesting locations:

_____________________________

"Internal server error" "server at" intitle:"Execution of this script is not permitted" e-mail address filetype:csv csv intitle:index.of dead.letter inurl:fcgi-bin/echo filetype:pst pst ; mbox ; eml ; .ost ; .msg ; .mbox ; .edb ; .emlx filetype:xls username password email intitle:index.of inbox dbx filetype:eml eml +intext:"Subject" +intext:"From" intitle:index.of inbox.dbx filetype:wab wab filetype:pst inurl:"outlook.pst" inurl:cgi-bin/printenv inurl:forward filetype:forward -cvs filetype:reg reg +intext:"internet account manager"

I've searched for over 100 different files and came across only a little amount containing information that could've been used against someone and have consequences. Nevertheless, the habit is there and people are not realizing it. We have to be careful when uploading files online. Always check for any sensitive information, anything you wouldn't want others to get and you regretting it later. Use only trustful sites and make sure you check to have your upload PRIVATE not public, for anyone to download at any time.