lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 9 Dec 2009 13:51:16 -0800
From: "Thor (Hammer of God)" <>
To: "" <>
Subject: RE: Millions of PDF invisibly embedded with your internal disk paths

Not you too... people talking about "enough for them to search your computer" and "silent mapping of intranet."  Enough already.  The home path is a local path or mapped drive letter.  Not an IP or UNC.  Even if it was, "\\\users\jsmith" is worthless.  You don't even know the source of the document. Don't we have enough to deal with than waste time with this?  You actually think the security team needs to be aware of this and make policies to scan and replace metadata in pdf's?  Why not have them start off by cleaning up Word docs just to show us they are capable of it in the first place. 

My homepath is c:\users\tmullen.  My IP address is  Go ahead, map away.

Bonsai kittens, search warrants, silent intranet mapping and autonomous amelioration tools.  People have lost their minds.  Check the headers on people's email if you want a map of the intranet.   Meh.


-----Original Message-----
From: Nick FitzGerald [] 
Sent: Friday, December 04, 2009 1:51 PM
Subject: Re: Millions of PDF invisibly embedded with your internal disk paths

Ian Bradshaw wrote:

> This isn't a security issue its a privacy issue.

If the leaked, embedded paths can be things like UNCs or IP-based 
internal server addresses, it is arguably a bit more than a privacy 
issue, allowing silent, external, partial mapping of the corporate 

Not good if your organization is in the habit of making lots of PDFs 
more or less publicly available from many departments, etc...

Definitely something the security team should be aware of and 
(probably) making sure there are policies, and as necessary, 
amelioration tools and processes, to handle such.


Nick FitzGerald

Powered by blists - more mailing lists