die_kluge you are not alone!

[reveal]

At least I think it was die_kluge who posted about finding his tax return shared via Bearshare. Anyway, here's what I'm getting at:

http://www.wtoctv.com/Global/story.asp?S=3117022&nav=0qq6XpfR

Local Man Finds His Tax Return on Internet
No doubt computers and the internet have made filing your taxes easier. But it can also be big trouble if your tax returns--and all the private information they contain--wind up online. We found one local man it happened to.

Don Bodiker uses a popular file sharing program to swap music and other information over the internet. He also uses his computer to prepare his taxes.

He never thought the two had anything to do with each other, until he got a call. "I had no idea who he was or what he was. I just thought he was a typical telemarketer," Bodiker said of the call. "And he wanted to inform me that my tax returns were being posted out on the internet. I was very skeptical but he then proceeded to tell me some very specific details about my tax return."

File sharing software allows you to download files stored in certain shared folders on other users' computers. The flipside is they can also download files from your shared folder. There's a folder on their computer the Bodikers use store the music files they wanted to share. What they didn't realize is that their tax return software saved their returns in the very same place.

"Oh my God, I thought everybody and anybody knows exactly what my social security number is, my address, you know, anything that I had that was pertinent on there that could be used as an identity theft process," said Bodiker.

And he's not alone. A simple search on the file sharing network for the word "tax" turned up hundreds of returns. "It's made me more aware of the possibilities of programs that you attach to your computer," said Bodiker. "Ultimately, if you don't have to keep it on your computer, make a hard copy, and file it away. And that's always the best thing."

That's some good, old-fashioned advice for the information age.

The good Samaritan who called Bodiker--he only wants to be identified as Jeff--says he's called dozens of others and has plenty more to go. He says if you use file sharing, just be careful your shared folder is not the one you save sensitive information to.

Fortunately it looks like Bodiker caught the problem before his information spread.

This is not the only trouble associated with file sharing software. People can also get into trouble for swapping copyrighted material. There is content out there that's free and meant to be shared. You just need to make sure your private information doesn't go with it.

 

[diaglo]

ouch.

 

[der_kluge]

Yea, it's a serious problem, one that neither Bearshare, nor Turbotax seem concerned about.

Here's the problem: Bearshare has a setup feature which allows you to scan your drive looking for media files. Normally I wouldn't bother doing this, but it seems there is a bug in Bearshare's configuration process which causes it to just abort during setup. So, for the longest time I was always having to start this process, and just cancel out of it. So, in some vain attempt at trying to get it to finish, I thought I would try every step, and that was one of them. What I didn't realize was that in doing so, I set up my "my documents" folder to be shared, since under that folder is "my pictures" and "my music". And since there were at least a couple of Windows pictures in the "my pictures" folder, it added the entire directory structure to my "library" as Bearshare calls it.

Low and behold, TurboTax saves it's *.tax files in the "my documents\turbotax" folder (IIRC).

So, just on a whim I decided to log into Bearshare's upload queue to see what people were downloading from me, and I see my tax return sitting in a queued state. Of course, I immediately freaked, and removed it from the queue. Then I promptly modified my library settings. Fortunately, I had turned on my logging to show upload statistics, and I was able to verify that no one had gotten a chance to download it from me. It totally scared the heck out of my wife, though.

For curiosity, I downloaded someone else's .tax file, randomly. Sure enough, I was able to open the file without incident. I could see their social security numbers, their home address, the social security numbers of all their dependents, and their income. Worse yet, if someone chooses to auto-file, you could get their bank name and routing numbers from that file. It's not encrypted at all.

There are at least two solutions which need to occur, preferably both. Bearshare needs stop adding "my documents" to the library. This is, IMHO, unacceptable. People store their resumes, budgets, living wills, and all kinds of personal stuff here. Fortunately, Bearshare has a list of extensions which it, by default, hides. This includes stuff like .dll and other system files that people aren't going to want to download directly. Bearshare could, very easily, simply add ".tax" to this list. That would be a very easy change. Lastly, TurboTax needs to encrypt their files. They could do this with an encryption key unique to the computer generating the tax file. So, if you are not the computer where the file was generated, you wouldn't be able to open it. That is a more difficult solution, but something TurboTax needs to take a serious look at.

I hesitated in doing it, but I posted a thread on the Bearshare forum about this problem. I said I hesitated, because the more people know that it's a problem, the more likely are some unscrupulous people could go and download the files. Last I checked, there were over 400 turbotax files in Bearshare, and the number will only increase the closer it gets to tax season.

My criticisms fell on deaf ears on the Bearshare forum despite numerous people agreeing that it was a problem, though most decided that it was a problem "for all p2p networking" and therefore somehow lessened Bearshare's responsibility to fix it. I also posted an email on the TurboTax website regarding the problem, and I even mentioned that I was notifying the media, to see if that would spark them into fixing the problem. I suppose it's possible that they have, I guess. They could have issued a bug fix for this, and then just not advertised it. With TurboTax you can download bug patches internally with an update option. I haven't ran it in over a month, though I still do need to wrap up my taxes.

I also tried mentioning it on Fark, Slashdot, and wired.com and they all ignored me. That link timed out on me, but it's good to see that at least some people are trying to get the word out.

 

[Darth K'Trava]

All you need to do is move the tax info out of that folder if Turbo Tax doesn't give you the option of where to put it when you save it on your computer. And edit which folders you let the file share programs use for transfering purposes.

And don't be a slackass about where you put sensitive material to start with! If you take just a moment longer when you're saving sensitive files as to WHERE they go, then the likelihood of some unscrupulous individual getting ahold of them goes WAAAY down. All it takes is being smart on your end. Don't assume the computer is going to be smart about it, 'cause, GUESS WHAT, it's not.

Remember: Err on the side of caution!!!

 

[Torm]

If you are using any file sharing apps, and you're in the U.S., you really probably don't want to be sharing OUT at all, anyway - those are the people they are going after.

 

[Darth K'Trava]

Which sucks as they rip us off the worst of the bunch!

 

[der_kluge]

All you need to do is move the tax info out of that folder if Turbo Tax doesn't give you the option of where to put it when you save it on your computer. And edit which folders you let the file share programs use for transfering purposes.

Easy yes, if you know it's a problem. I wasn't aware Bearshare was sharing my "my documents" folder until I happened to see my tax return in the queue. Others may not be aware. Bearshare doesn't make it so blatently obvious.

The good news is, the last I checked, there are fewer tax returns out there, so maybe the latest version locked it down somehow. I haven't downloaded it yet to check.