bugtraq - Re: Motorola Timbuktu's Internet Locator Service real-time data exposed to public.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <31277367.1837281223499522580.JavaMail.juha-matti.laurio@netti.fi>
Date: Wed, 8 Oct 2008 23:58:41 +0300 (EEST)
From: Juha-Matti Laurio <juha-matti.laurio@...ti.fi>
To: artful38@...oo.com, bugtraq@...urityfocus.com
Subject: Re: Motorola Timbuktu's Internet Locator Service real-time data
 exposed to public.

The vendor fixed the issue remarkable quickly, but

Additionally, the Last modified field in directory listings disclosed the timestamp of location information too.
Addresses like firstname.surname@...ain.com disclosed confidential information about the people working in specific organizations too. 

Juha-Matti

artful38@...oo.com wrote: 
> Looks like they closed the hole. Even using the hard-coded password, you can no longer get directory listings of email addresses (nor can you do so without credentials)
>