Bugtraq mailing list archives
Re: Millions of PDF invisibly embedded with your internal disk paths
From: Pavel Machek <pavel () ucw cz>
Date: Thu, 3 Dec 2009 10:01:53 +0100
Hi!
I agree. Discovering the local path may be considered a risk, but in most cases the risk is nil.
Often, risk is not big, agreed.
Considering that, perhaps for the PDF format specifically this could be an issue, under the assumption that consumers use PDF /specifically/ to prevent data leakage.
Exactly. Imagine someone posting (anonymously) copy of EvilCorp's internal web pages, that prove EvilCorp is planning to produce bonsai kitten, as .pdf. If the pdf contains 'e:\nethome\joe_kitten_lover' .. then, well, Joe has a problem. (It would be bad if that .pdf contained username/hostname, too; I could imagine even timestamps being problematic.) (And yes, similar problems are elsewhere. Exif contains way too much information, if you try to leak pictures of bonsai kitten from digital camera.) Pavel -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
Current thread:
- Re: Millions of PDF invisibly embedded with your internal disk paths Pavel Machek (Dec 03)
- Message not available
- RE: Millions of PDF invisibly embedded with your internal disk paths Thor (Hammer of God) (Dec 04)
- RE: Millions of PDF invisibly embedded with your internal disk paths Ian Bradshaw (Dec 04)
- Re: Millions of PDF invisibly embedded with your internal disk paths Nick FitzGerald (Dec 07)
- RE: Millions of PDF invisibly embedded with your internal disk paths Thor (Hammer of God) (Dec 10)
- RE: Millions of PDF invisibly embedded with your internal disk paths Thor (Hammer of God) (Dec 04)
- Re: Millions of PDF invisibly embedded with your internal disk paths Nick FitzGerald (Dec 07)
- Message not available
- Message not available
- Re: Millions of PDF invisibly embedded with your internal disk paths Pavel Machek (Dec 07)