3 ms·
If internal IPS are critical security info, something is very wrong.
by api 11y ago
If internal IPS are critical security info, something is very wrong.
- biggerfisch 11y agoWell, imagine you're in a controlled environment (eg, China) and having your non-vpn IP leaked could compromise your identity. Having an easy way for a site to reveal you is therefore a security issue.
- cptskippy 11y agoAh, that makes more sense. I assumed he was referring to the private address assigned to your machine on your LAN.
- biggerfisch 11y agoEven if he is, it's still information that doesn't need to be revealed. It's not a security issue in and of itself, but if combined with another exploit, it could help an attacker. Good security is all about layers and protecting information. LAN IPs are also useful for distinguishing computers from the same external IP which could help compromise your identity or privacy.
- cptskippy 11y agoYeah, I'm struggling to understand why that's an issue.
- cpeterso 11y agoBrowser fingerprinting. If a site knows your Internet-facing IP address and your local IP address, then they can uniquely identify you, even if you delete your cookies or use private browsing mode.
- tezza 11y ago? I browse from work. And I'm fairly sure my Sys Admin won't want random websites knowing my internal IP address. Network shares etc. would likely be somewhere on the same range and they could launch subsequent attacks to try to sniff confidential documents and resources.
- pyvpx 11y agoyour network shares have public, routable IP addresses? that, in my opinion, would be a far bigger issue than 'leaking' a hosts IP address.
- tezza 11y agoi'm more talking about being able to craft subsequent XSS requests. My browser will unwittingly be doing the attacking My ip address is 192.168.99.105 Script tries XSS attacks on: http://192.168.99.1/ciscowebinterface/known_dodgy_admin?user=root&pass=NEVERCHANGED1 http://192.168.99.1/juniper/also_leaky_admin?user=root&pass=NEVERCHANGED2 http://192.168.99.2/... enumerated
- diafygi 11y agoNo, any website can detect your local IP address, then use ajax to scan a targeted IP subnet range fairly quickly (and completely hidden from the user) to find any shitty CORS-enabled web interface your company has (think some "modern" internal accounting webapp that enables CORS for its "API"). Prior to WebRTC you'd have to scan much larger IP ranges to try and find internal network webapps that are CORS enabled.
- api 11y agoAgain: that is a problem. If that is possible your internal network is insecure. The castle and moat model is obsolete anyway. Most attacks today come through "pulled" vectors that bypass the firewall. If you rely on a physical network perimeter for security your security is an illusion.