3 ms·

I'm always amazed about the amount of data leakage that happens due to binaries including full paths. I'm shocked whenever I see a crash and the error message m

by sxp 6y ago

I'm always amazed about the amount of data leakage that happens due to binaries including full paths. I'm shocked whenever I see a crash and the error message mentioned `f:/username...`. There are also stories about computer viruses that have been reverse engineered and the information about the author was extracted from the file path. And it's not just small companies. I've seen paths leaked from production software coming out of Microsoft and Google.

hprotagonist 6y ago
PDFs whose titles are the full path to the docx they were baked from remains an all-time favorite of mine. Especially in things like legal opinions, company media releases, ...
delusional 6y ago
It's almost universal. Games typically include a ton of local file paths from the developer's computers.
meowface 6y ago
It's so bad that even some intelligence agency-developed malware gets busted (in part) due to leaky paths and other strings in binaries' metadata. Here's a leaked CIA Wiki/CMS thread from 2015 discussing some of the fuckups found by Kaspersky in NSA ("Equation Group") malware binaries: https://wikileaks.org/ciav7p1/cms/page_14588809.html https://wikileaks.org/ciav7p1/cms/page_14588809.html >This is PDB string, right? The PDB path should ALWAYS be stripped (I speak from experience. Ask me about Blackstone some time.). For Visual Studio user mode stuff, the /DEBUG linker switch should NOT be used. For drivers, it's a bit harder to avoid it, but a post-build step using binplace will strip the path information. >For other strings generally, yeah, search the binary for them. Don't use internal tool names in your code. Examples from Kaspersky's report (https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf https://securelist.com/files/2015/02/Equation_group_question...): >"Timeout waiting for the “canInstallNow” event from the implant-specific EXE!" "Implant" is NSA lingo for "persistent malware". Probably best not to include routines for helpful error messages in your production-build nation-state malware code. >"Manual/DRINKPARSLEY/2008-09-30/10:06:46.468-04:00" Conspicuous all-caps NSA codename. >"standalonegrok_2.1.1.1" "The codename GROK appears in several documents published by Der Spiegel, where “a keylogger” is mentioned. Our analysis indicates EQUATIONGROUP’s GROK plugin is indeed a keylogger on steroids that can perform many other functions." >"c:\users\rmgree5\" Follows NSA's internal username / @nsa.gov pattern. (The whole thread's an interesting read in general. You can even hover over all the myriad acronyms/initialisms to see what they mean. Also kind of amusing to see the unsurprising rivalry and passive-aggressive shade between CIA's and NSA's cyber operations teams.)

by sxp 6y ago

hprotagonist 6y ago

PDFs whose titles are the full path to the docx they were baked from remains an all-time favorite of mine. Especially in things like legal opinions, company media releases, ...

delusional 6y ago

It's almost universal. Games typically include a ton of local file paths from the developer's computers.

meowface 6y ago

It's so bad that even some intelligence agency-developed malware gets busted (in part) due to leaky paths and other strings in binaries' metadata. Here's a leaked CIA Wiki/CMS thread from 2015 discussing some of the fuckups found by Kaspersky in NSA ("Equation Group") malware binaries: https://wikileaks.org/ciav7p1/cms/page_14588809.html https://wikileaks.org/ciav7p1/cms/page_14588809.html >This is PDB string, right? The PDB path should ALWAYS be stripped (I speak from experience. Ask me about Blackstone some time.). For Visual Studio user mode stuff, the /DEBUG linker switch should NOT be used. For drivers, it's a bit harder to avoid it, but a post-build step using binplace will strip the path information. >For other strings generally, yeah, search the binary for them. Don't use internal tool names in your code. Examples from Kaspersky's report (https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf https://securelist.com/files/2015/02/Equation_group_question...): >"Timeout waiting for the “canInstallNow” event from the implant-specific EXE!" "Implant" is NSA lingo for "persistent malware". Probably best not to include routines for helpful error messages in your production-build nation-state malware code. >"Manual/DRINKPARSLEY/2008-09-30/10:06:46.468-04:00" Conspicuous all-caps NSA codename. >"standalonegrok_2.1.1.1" "The codename GROK appears in several documents published by Der Spiegel, where “a keylogger” is mentioned. Our analysis indicates EQUATIONGROUP’s GROK plugin is indeed a keylogger on steroids that can perform many other functions." >"c:\users\rmgree5\" Follows NSA's internal username / @nsa.gov pattern. (The whole thread's an interesting read in general. You can even hover over all the myriad acronyms/initialisms to see what they mean. Also kind of amusing to see the unsurprising rivalry and passive-aggressive shade between CIA's and NSA's cyber operations teams.)