Googling Security: How Much Does Google Know About You? (Paperback)

~ (Author)
Key Phrases: naked people, sergey brin, google labs, Google Maps, Google Analytics, United States (more...)

Editorial Reviews

Product Description

What Does Google Know about You? And Who Are They Telling?

 

When you use Google’s “free” services, you pay, big time–with personal information about yourself. Google is making a fortune on what it knows about you…and you may be shocked by just how much Google does know. Googling Security is the first book to reveal how Google’s vast information stockpiles could be used against you or your business–and what you can do to protect yourself.

 

Unlike other books on Google hacking, this book covers information you disclose when using all of Google’s top applications, not just what savvy users can retrieve via Google’s search results. West Point computer science professor Greg Conti reveals the privacy implications of Gmail, Google Maps, Google Talk, Google Groups, Google Alerts, Google’s new mobile applications, and more. Drawing on his own advanced security research, Conti shows how Google’s databases can be used by others with bad intent, even if Google succeeds in its pledge of “don’t be evil.”

 

• Uncover the trail of informational “bread crumbs” you leave when you use Google search
• How Gmail could be used to track your personal network of friends, family, and acquaintances
• How Google’s map and location tools could disclose the locations of your home, employer, family and friends, travel plans, and intentions
• How the information stockpiles of Google and other online companies may be spilled, lost, taken, shared, or subpoenaed and later used for identity theft or even blackmail
• How the Google AdSense and DoubleClick advertising services could track you around the Web
• How to systematically reduce the personal information you expose or give away

 

This book is a wake-up call and a “how-to” self-defense manual: an indispensable resource for everyone, from private citizens to security professionals, who relies on Google.

 

Preface xiii

Acknowledgments xix

About the Author xxi

 

Chapter 1: Googling 1

Chapter 2: Information Flows and Leakage 31

Chapter 3: Footprints, Fingerprints, and Connections 59

Chapter 4: Search 97

Chapter 5: Communications 139

Chapter 6: Mapping, Directions, and Imagery 177

Chapter 7: Advertising and Embedded Content 205

Chapter 8: Googlebot 239

Chapter 9: Countermeasures 259

Chapter 10: Conclusions and a Look to the Future 299

 

Index 317

 

About the Author

Greg Conti is an assistant professor of computer science at the U.S. Military Academy in West Point, New York. His research includes security data visualization, usable security, information warfare, and web-based information disclosure. He is the author of Security Data Visualization (No Starch Press, 2007) and has been featured in IEEE Security & Privacy magazine, Communications of the ACM, and IEEE Computer Graphics and Applications magazine. He has spoken at a wide range of academic and hacker conferences, including Black Hat, DEFCON, and the Workshop on Visualization for Computer Security (VizSEC). Conti runs the open source security visualization project RUMINT. His work can be found at www.gregconti.com/ and www.rumint.org/.

Product Details

• Paperback: 360 pages
• Publisher: Addison-Wesley Professional; 1 edition (October 20, 2008)
• Language: English
• ISBN-10: 0321518667
• ISBN-13: 978-0321518668
• Product Dimensions: 9 x 7 x 0.9 inches
• Shipping Weight: 1.4 pounds (View shipping rates and policies)
• Average Customer Review: 4.2 out of 5 stars  See all reviews (12 customer reviews)
• Amazon.com Sales Rank: #141,134 in Books (See Bestsellers in Books)

  Popular in this category: (What's this?)

  #70 in

  Books > Computers & Internet > Certification Central > Exams > Security+

Customer Reviews

Most Helpful Customer Reviews

12 of 12 people found the following review helpful:

5.0 out of 5 stars Excellent book that explores the many security risks around Google and other search engines, November 12, 2008

By	Ben Rothke "Author of 'Computer Security: 20 ... (USA) - See all my reviews (TOP 1000 REVIEWER)    (REAL NAME)

It has been suggested that if one was somehow able to change history so that aspirin had never been discovered until now, it would have died in the lab and stand no chance of FDA approval. In a report from the Manhattan Institute, they write that no modern drug development organization would touch it. Similarly, if we knew the power that Google would have in 2008 with its ability to aggregate and correlate personal data, it is arguable that various regulatory and privacy bodies would never allow it to exist given the extensive privacy issues.

In a fascinating and eye-opening new book Googling Security: How Much Does Google Know About You?, author Greg Conti explores the many security risks around Google and other search engines. Part of the problem is that in the rush to get content onto the web, organizations often give short shrift to the security and privacy of their data. At the individual level, those who make use of the innumerable and ever expanding amount of Google free services can end up paying for those services with their personal information being compromised, or shared in ways they would not truly approve of; but implicitly do so via their acceptance of the Google Terms of Service.

While the book focuses specifically on Google, the security issues detailed are just as relevant to Yahoo, MSN, AOL, Ask and the more than 50 other search engines.

Until now, Google and security have often not been used together. As an example, my friend and SEO guru Shimon Sandler has a blog around search engine optimization (SEO). In the over three years that his blog has been around, my recent post on The Need for Security in SEO was the first on topic of SEO security. Similar SEO blogs also have a very low number (and often no) articles on SEO and security. Sandler notes that when he mentions privacy issues around search to his clients, it is often the first time they have thought of it.

The book opens with the observation that Google's business model is built on the prospect of providing its services for free. From the individual user's perspective, this is a model that they can live with. But the inherent risk is that the services really are not completely free; they come at the cost of the loss of control of one's personal information that they share with Google.

The book lists over 50 Google services and applications which collect personal information. From mail, alerts, blogging, news, desktop, images, maps, groups, video and more. People are placing a great deal of trust into Google as each time they use a Google service, they are trusting the organization to safeguard their personal information. In chapter 5, the book lists over 20 stated uses and advantages of Google Groups, and the possible information disclosure risks of each.

In the books 10 chapters, the author provides a systematic overview of how Google gets your personal data and what it does with it. In chapter 3, the book details how disparate pieces of data can be aggregated and mined to create extremely detailed user profiles. These profiles are invaluable to advertisers who will pay Google dearly for such meticulous user data. This level of personal data aggregation was impossible to obtain just a few years ago, given the lack of computing power, combined with the single point of user data. The book notes that this level of personalization, while golden to advertisers, is a privacy anathema.

Chapter 6 is particularly interesting in that it details the risks of using Google Maps. Conti explains that the privacy issue via the use of Google Maps is that it combines disclosure risks of search and connects it to mapping. You are now sharing geographic locations and the associated interactions. By clicking on a link in a Google map, the user discloses and strengthens the link between the search they performed and what they deemed as important in the result. By aggregating source IP addresses and destinations searches, Google can easily ascertain confidential data.

After detailing over 250 pages of the risks of Google and related services, Chapter 9 is about countermeasures. Short of simply not using the services, the book notes that there is no clear solution for protecting yourself and company from web-based information disclosure. Nonetheless, the chapter lists a number of things that can be done to reduce the threat. Some are easier, some are harder; but they can ultimately add up to a significant layer of protection. Chapter 9 details 11 specific steps that help users appreciate the magnitude of their disclosures and make informed decisions about which search services to use.

Googling Security: How Much Does Google Know About You? is an important book given that far too many people do not realize how much personal information they are disclosing on a daily basis. An important point that the book makes is that small information disclosures are not truly small when they are aggregated over the course of years. Advances in data mining and artificial intelligence are magnifying the importance of the threat, all under the guise of improving the end-user experience. The book emphasizes the need to evaluate the short-term computing gains with the long-term privacy losses.

The final chapter notes that apathy is the enemy. As a user becomes aware of the magnitude of the threat, they will see it grow every day. But the next step is to take action. Be it with technical countermeasures, taking your business where privacy is better supported, or petitioning lawmakers.

As to the underlying question, "how much does Google know about you?", the answer is that it is a colossal amount, far more than most people realize. For anyone who uses the Internet, Googling Security should be on their list of required reading. The risks that Google and other search engines present are of great consequence and can't be overlooked. If not, privacy could slowly be a thing of the past.

7 of 7 people found the following review helpful:

4.0 out of 5 stars resistance is futile, November 24, 2008

By	Pablo - See all my reviews

In buying this book on amazon, and leaving a review on amazon, the net knows that much more about me.

This book addresses one of those game theory scenarios, where whats good for the collective (maximum data) is bad for the individual (loss of privacy). The rational response is to let everyone else fully disclose and capitalize on that, while maintaining your own privacy.

I probably knew most of the material in this book beforehand, being in tech, but its unlikely I can abide by the recommendations. My Google RSS Reader is loaded up with 100+ feeds, some of which spool up 100 articles per day. Google Calender is best of breed. And Google Email offers POP/IMAP for free, whereas Yahoo email does not. All three of these "killer apps" work best when logged in continuously. So I login from home and work, and they stay logged in 24x7. As a result, whenever something pops in my head, and I do a search, Google is able to track that, and tie that to my name because my name is tied to my email.

I may switch to NewsGator or Bloglines, and go back to Yahoo email/ Calender. And I may code up something on my linux firewall to switch its MAC / IP address on a weekly basis. And I may ditch my Grandcentral, with the cost that I will have to give out my real cell phone number to merchants. But I probably won't.

I was able to muster a small pyrrhic victory, and steer clear of the G1 (google) phone. Which is integrated tightly with Google, such connecting with a Gmail address, and all the contacts associated with that email address.

Also, re. chaffing countermeasure, with Firefox TrackMeNot is interesting. I tried that out sometime back, and had it cranked up to some number of queries per minute. It wasn't long before Google (temporarily) blocked my IP address with some error message. And I just noticed that I have TrackMeNot turned on at work at a rigorous "chaffing" pace, and it was not disabled. I assume that is because Google cannot easily turn off chaff coming out of a big corp, thats behind a firewall/ NAT. This might be something of a loophole. I will have to explore this further.

5 of 6 people found the following review helpful:

5.0 out of 5 stars An excellent book, but I question the audience, December 8, 2008

By	Richard Bejtlich "TaoSecurity.com" (Metro Washington, DC) - See all my reviews (TOP 500 REVIEWER)    (REAL NAME)

There's no question that Greg Conti writes excellent books. Last year's Security Data Visualization book earned 5 stars, and I put Googling Security in the same league. Conti takes a thorough and methodical look at the privacy consequences of Google's services, incorporating technical realities and thoughtful analysis. My only question is whether this book will matter to the intended audience.

Ben Rothke's review does a nice job summarizing the book, so I won't do that here. Instead, I'd like to share this thought: do the millions of Google's users care about how Google collects and uses personal information? I argue the answer is largely "no," and I recognize that Conti's book is intended to try to change that point of view. However, I really doubt it will have that effect.

I see three main consumers for Conti's book, meaning groups of people most likely to play close attention to the technical details while trying to implement privacy-preserving countermeasures. The first includes organized criminals. A certain component of organized crime is tech-savvy, motivated, and likely to adopt practices to shield their less technical colleagues.

The second includes national intelligence services and related operatives. When reading Googling Security I thought to myself "This is a big OPSEC manual," similar to Johnny Long's great No Tech Hacking book. Google Security contains all the right material for an operative to construct a false identity, and then know how to act as safely as possible to not compromise that identity. In fact, the operative could move to the other extreme and use Google's services to construct what looks like a convincing false person, with a presence on a variety of sites.

The third group (which receives some attention in the text) includes national governments and other regulatory agencies. Even without sustained popular pressure, we have seen regulatory bodies exert privacy measures on private companies. This is probably the best route to move Google in the direction Conti would like.

One related note on nation states: Conti writes on p 4: "I view Google as the equivalent of a nation-state because of its top-tier intellectual talent, financial resources in the billions of dollars, and world-class information processing resources combined with ten years of interaction data." I reject that argument, just as I reject similar arguments regarding Bill Gates' wealth and so on. Neither Google nor Bill Gates nor any other similar actor can deny a person of life, liberty, or property. If any Google employee tried to imprison any person on behalf of "Google," he would suffer criminal charges. The tiniest nation-state on Earth has more legal power in this regard, especially when you add in other aspects of sovereignty like issuing passports, minting currency, imposing taxes, and the like.

I also think Conti fails to appreciate the benefit of putting your data in the hands of a provider. At one point Conti mentions having one's data "safe on your home computer." Safe from what? Theft? Fire? Disk failure? Intruders who convince someone to click on a malicious link? The more consumers become service users and less system administrators, the better overall level of security we will attain.

Regardless of my reservations, if you want to read the best book on how Google services impact your privacy, I strongly recommend Googling Security.