In the aftermath of most of my full-disclosure posts I've observed
quite interesting referrer URLs when someone tries to read information
provided explaining the issue. In quite some cases, those requests can
be attributed to national CERTs, software distributors' security
teams, universities with IT-security research units, ... accessing
Information leaked via the referrer URLs indicates, that a noticeable
number of security experts do not exercise strict separation of their
internal working processes, e.g. accessing their internal
wiki/mantis/communication/... systems, from the context used for
accessing POC data. In rare cases even session IDs are encoded in the URL.
A malicious attacker could use the disclosure of e.g. an unrelated
zero day to compromise especially machines of CERT/DoD/.. or get at
least hints, who is interested in his material, e.g. by requests like
[Some-IP] - - [14/May/2013:17:44:38 +0000] "GET
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0"
PS: just curious: would be interested, what
coffin-train-source-complex.html is about, perhaps one having access
to the source could forward me a copy.
PGP: 156A AE98 B91F 0114 FE88 2BD8 C459 9386 feed a bee