bugtraq - Re: Millions of PDF invisibly embedded with your internal disk paths

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20091203090153.GA1387@ucw.cz>
Date: Thu, 3 Dec 2009 10:01:53 +0100
From: Pavel Machek <pavel@....cz>
To: Patrick Webster <sflist@...hack.com>
Cc: "Thor (Hammer of God)" <thor@...merofgod.com>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: Re: Millions of PDF invisibly embedded with your internal disk
	paths

Hi!

> I agree. Discovering the local path may be considered a risk, but in
> most cases the risk is nil.

Often, risk is not big, agreed.

> Considering that, perhaps for the PDF format specifically this could
> be an issue, under the assumption that consumers use PDF
> /specifically/ to prevent data leakage.

Exactly. Imagine someone posting (anonymously) copy of EvilCorp's
internal web pages, that prove EvilCorp is planning  to produce bonsai
kitten, as .pdf. If the pdf contains 'e:\nethome\joe_kitten_lover'
.. then, well, Joe has a problem.

(It would be bad if that .pdf contained username/hostname, too; I
could imagine even timestamps being problematic.)

(And yes, similar problems are elsewhere. Exif contains way too much
information, if you try to leak pictures of bonsai kitten from digital
camera.)

									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html