lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 4 Dec 2009 15:27:29 -0000
From: "Ian Bradshaw" <ian@...bradshaw.net>
To: <bugtraq@...urityfocus.com>
Subject: RE: Millions of PDF invisibly embedded with your internal disk paths

This isn’t a security issue its a privacy issue.

-----Original Message-----
From: Thor (Hammer of God) [mailto:thor@...merofgod.com] 
Sent: 03 December 2009 22:27
To: bugtraq@...urityfocus.com
Subject: RE: Millions of PDF invisibly embedded with your internal disk
paths

(Fixing rejected post)

Meh.   I replied to something similar off-list.

"Leaking" a pdf with 'e:\nethome\joe_kitten_lover' doesn't remotely "prove"
anything.  If I create a user called MayIMommaDogFaceToTheBannanPatch and
"leaked" a pdf, it doesn't mean Steve Martin was culpable.  This is a
non-issue, no matter how much you might want to create some fanciful "bonsai
kitten" theory to get Joe in trouble, dawg.

t


From: WebDawg [mailto:webdawg@...il.com] 
Sent: Thursday, December 03, 2009 1:58 PM
To: Pavel Machek
Cc: Patrick Webster; Thor (Hammer of God); bugtraq@...urityfocus.com
Subject: Re: Millions of PDF invisibly embedded with your internal disk
paths

While the risk may not be large it is still information that should not be
leaked.  Leaky computers should always be plugged.
On Thu, Dec 3, 2009 at 4:01 AM, Pavel Machek <pavel@....cz> wrote:
Hi!

> I agree. Discovering the local path may be considered a risk, but in
> most cases the risk is nil.
Often, risk is not big, agreed.

> Considering that, perhaps for the PDF format specifically this could
> be an issue, under the assumption that consumers use PDF
> /specifically/ to prevent data leakage.
Exactly. Imagine someone posting (anonymously) copy of EvilCorp's
internal web pages, that prove EvilCorp is planning  to produce bonsai
kitten, as .pdf. If the pdf contains 'e:\nethome\joe_kitten_lover'
.. then, well, Joe has a problem.

(It would be bad if that .pdf contained username/hostname, too; I
could imagine even timestamps being problematic.)

(And yes, similar problems are elsewhere. Exif contains way too much
information, if you try to leak pictures of bonsai kitten from digital
camera.)

                                                                       Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures)
http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html



Powered by blists - more mailing lists