Back to list
Millions of PDF invisibly embedded with your internal disk paths
Nov 23 2009 03:45PM
Inferno (inferno securethoughts com)
RE: Millions of PDF invisibly embedded with your internal disk paths
Nov 24 2009 01:11AM
Thor (Hammer of God) (thor hammerofgod com)
Re: Millions of PDF invisibly embedded with your internal disk paths
Nov 25 2009 09:06AM
Patrick Webster (sflist aushack com)
Re: Millions of PDF invisibly embedded with your internal diskpaths
Dec 03 2009 09:01AM
Pavel Machek (pavel ucw cz)
> I agree. Discovering the local path may be considered a risk, but in
> most cases the risk is nil.
Often, risk is not big, agreed.
> Considering that, perhaps for the PDF format specifically this could
> be an issue, under the assumption that consumers use PDF
> /specifically/ to prevent data leakage.
Exactly. Imagine someone posting (anonymously) copy of EvilCorp's
internal web pages, that prove EvilCorp is planning to produce bonsai
kitten, as .pdf. If the pdf contains 'e:\nethome\joe_kitten_lover'
.. then, well, Joe has a problem.
(It would be bad if that .pdf contained username/hostname, too; I
could imagine even timestamps being problematic.)
(And yes, similar problems are elsewhere. Exif contains way too much
information, if you try to leak pictures of bonsai kitten from digital
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
[ reply ]
Copyright 2010, SecurityFocus