Social Search Reveals 700 Comcast Customer Logins

nandemoari writes "When educational technology specialist Kevin Andreyo recently read a report on people search engines, he decided to conduct a little 'people search' on himself. Andreyo did not expect to find much — so, imagine the surprise when he uncovered the user name and password to his Comcast Internet account, put out there for the entire online world to see. In addition to his personal information, Andreyo also discovered a list that exposed the user names and passwords of (what he believed) to be 8,000 other Comcast customers. Andreyo immediately contacted both Comcast and the FBI, hoping to find the ones responsible for divulging such personal information to the public. While the list is no longer available online, analysts fear that the document still lives on in various cache and online history services."

Re:While the list is no longer available online

[Anthony_Cargile]

True, in fact, there is already a comment that gives a download mirror, see here. [slashdot.org]"

Nobody waste your time/bandwidth even following that link, as it's to the troll post above which links to nothing but a video and imagery probably nobody wants to see (recall goatse.cx links).

Not the first time

[Anonymous Coward]

I worked for comcast about 8 years ago and at the time they had a Remedy test account they used for various stuff. One day I decided to login to the ftp using the remedy account and sitting there was a year old file with every subscriber's login and password. And since the ftp site was the account's web site home folder, these were just sitting there available to everyone.

Re:Aggressive Social Sites

[z0idberg]

You're not understanding the issue. Yes facebook etc. ask for your email password to get your contact list, but the issue the OP is talking about (though who knows if its true given its an AC who cant recall the original site) is that the site tries to use your supplied email address and the password you use *for that particular site* to try and login to your email account and get your contact list. So you aren't prompted for your gmail/yahoo/hotmail password. They just try to login to your email using your supplied email address and the password for that site. Sneaky given most(?) people use the same password across a wide range of places.

Re:While the list is no longer available online

[poopdeville]

It is.

http://66.218.69.11/search/cache?ei=UTF-8&p=%22ComCast+Mail%22++Kevin+Andreyo&fr=yfp-t-501&u=www.scribd.com/doc/9723141/ComCast-Mail&w=%22comcast+mail%22+kevin+andreyo&d=ZjZ_Sp2uSYep&icp=1&.intl=us [66.218.69.11]

Took about a minute to find.

Re:How do I establish whether I am still a victim?

[Anonymous Coward]

| | | | | | | [e-mail] | kentlake [e-mail] | go60852 [e-mail] | go60852 [e-mail] | JFKHS2005 [e-mail] | go51137 [e-mail] | go51244 [e-mail] | go51244 [e-mail] gortys74 3067 [e-mail] methodios1 2519 [e-mail] trucks99 2462 [e-mail] georgios 1307 [e-mail] yanni [e-mail] ipcorder [e-mail] pilot08 [e-mail] millwright [e-mail] manning6 [e-mail] svetisava [e-mail] bobo1990 [e-mail] 184kp5 [e-mail] 101875 [e-mail] [e-mail] randy001 [e-mail] 8794944 [e-mail] 1soniabelen [e-mail] [e-mail] 1ruta2ed [e-mail] [e-mail] daehlsum [e-mail] kyle22 [e-mail] taycol [e-mail] chimes13 [e-mail] 010636 [e-mail] [e-mail] [e-mail] 1nternet [e-mail] z10824 @2 [e-mail] [e-mail] ghenry208 [e-mail] snickers [e-mail] madison [e-mail] [e-mail] [e-mail] [e-mail] [e-mail] [e-mail] jackie [e-mail] [e-mail] 243404mr [e-mail] lat66pie [e-mail] [e-mail] [e-mail] password [e-mail] rosko9601 [e-mail] wellspring [e-mail] pray42day [e-mail] 194813emt [e-mail] mandible [e-mail] [e-mail] [e-mail] goblu2 [e-mail] johnharold [e-mail] milo88 [e-mail] bjmac1826 [e-mail] [e-mail] passusa [e-mail] passusa [e-mail] weir1931 [e-mail] shiraz11 [e-mail] password [e-mail] pa55word [e-mail] ceasar [e-mail] Good4Tune2U [e-mail] myesme [e-mail] [e-mail] [e-mail] flash1 [e-mail] mehdi88 [e-mail] csah22320 [e-mail] surfing01 [e-mail] monte1225 [e-mail] DeanMax [e-mail] [e-mail] [e-mail] hardhead [e-mail] ginger [e-mail] [e-mail] [e-mail] my3dogz [e-mail] nova5646 [e-mail] [e-mail] bacchus3 [e-mail] [e-mail] hungrycat [e-mail] xmagic [e-mail] [e-mail] dzbain [e-mail] maddie1 [e-mail] select [e-mail] chris1 [e-mail] katykaty [e-mail] [e-mail] Jaybug7 [e-mail] travelnow [e-mail] casey325 [e-mail] aintlovegr8 [e-mail] rad255 [e-mail] tufo1973 [e-mail] nole77 [e-mail] [e-mail] trina7 [e-mail] da2000 [e-mail] jdjjdj [e-mail] KABR1579 [e-mail] 9477216hijulie [e-mail] 517427333330 [e-mail] marianne [e-mail] j1577m [e-mail] mollymae [e-mail] wcdijj [e-mail] rijeka [e-mail] monica [e-mail] [e-mail] madison4 [e-mail] drum68 [e-mail] [e-mail] [e-mail] sarahrae [e-mail] Ba5enj1PennY [e-mail] office [e-mail] nalava.tr [e-mail] freedom [e-mail] bohunk [e-mail] psalm111 [e-mail] seringue [e-mail] explorer [e-mail] 5472308 [e-mail] oneills [e-mail] 373357 [e-mail] artcarve DRa

Re:Aggressive Social Sites

[fractoid]

Actually, what the GPP is referring to is that when you create a Facebook account, it allows you to enter your email password for a few of the major webmail providers (GMail, Hotmail, can't remember the others), trawls through your contact list and/or inbox, and gives you a list of people you've contacted via email who also have facebook accounts. It's a convenient (albeit scary from the security PoV) way to populate your friend list for a new account.

Re:Slashdotted...

[Anonymous Coward]

http://66.218.69.11/search/cache?ei=UTF-8&p=%22ComCast+Mail%22++Kevin+Andreyo&fr=yfp-t-501&u=www.scribd.com/doc/9723141/ComCast-Mail&w=%22comcast+mail%22+kevin+andreyo&d=ZjZ_Sp2uSYep&icp=1&.intl=us

Re:Comcast has Passwords?

[furby076]

It's actually quite simple. When the comcast person arrives at your house and installs the hardware they will want to install the software. Tell them no and to have them call their dispatch. They don't like to do it because now they have to wait on hold, get the person to manually activate the modem (why the software is not built into the modem is beyond me), and wait for it to start. Basically it means the comcast guy will be at your place for an additional 30 minutes. They will, however, not install it on your request. I have never had to persuade, argue, bribe, or threaten the person - I just said "no thanks I prefer not to have any extra software on my computer".

Let's not make it sound like mission impossible.