full-disclosure - Interesting referrer URLs when accessing vulnerability disclosure information

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 19 May 2013 21:46:30 +0000
From: halfdog <me@...fdog.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Interesting referrer URLs when accessing
 vulnerability disclosure information

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello list,

In the aftermath of most of my full-disclosure posts I've observed
quite interesting referrer URLs when someone tries to read information
provided explaining the issue. In quite some cases, those requests can
be attributed to national CERTs, software distributors' security
teams, universities with IT-security research units, ... accessing
that information.

Information leaked via the referrer URLs indicates, that a noticeable
number of security experts do not exercise strict separation of their
internal working processes, e.g. accessing their internal
wiki/mantis/communication/... systems, from the context used for
accessing POC data. In rare cases even session IDs are encoded in the URL.

A malicious attacker could use the disclosure of e.g. an unrelated
zero day to compromise especially machines of CERT/DoD/.. or get at
least hints, who is interested in his material, e.g. by requests like

[Some-IP] - - [14/May/2013:17:44:38 +0000] "GET
/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/ HTTP/1.1"
200 7707
"http://rcf.mitre.org/~coley/cve-content/coffin-train-source-complex.html"
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0"

hd

PS: just curious: would be interested, what
coffin-train-source-complex.html is about, perhaps one having access
to the source could forward me a copy.

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlGZSDAACgkQxFmThv7tq+5J+ACdEFZ0zaucMaKsxCyfM7DbAAi2
1RgAn1SK6mcFxFdjAw3GOkzrikiQlCAd
=/E2Z
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/