Interesting referrer URLs when accessing vulnerability disclosure information

[halfdog <me () halfdog net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello list,

In the aftermath of most of my full-disclosure posts I've observed
quite interesting referrer URLs when someone tries to read information
provided explaining the issue. In quite some cases, those requests can
be attributed to national CERTs, software distributors' security
teams, universities with IT-security research units, ... accessing
that information.

Information leaked via the referrer URLs indicates, that a noticeable
number of security experts do not exercise strict separation of their
internal working processes, e.g. accessing their internal
wiki/mantis/communication/... systems, from the context used for
accessing POC data. In rare cases even session IDs are encoded in the URL.

A malicious attacker could use the disclosure of e.g. an unrelated
zero day to compromise especially machines of CERT/DoD/.. or get at
least hints, who is interested in his material, e.g. by requests like

[Some-IP] - - [14/May/2013:17:44:38 +0000] "GET
/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/ HTTP/1.1"
200 7707
"http://rcf.mitre.org/~coley/cve-content/coffin-train-source-complex.html";
"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0"

hd

PS: just curious: would be interested, what
coffin-train-source-complex.html is about, perhaps one having access
to the source could forward me a copy.

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlGZSDAACgkQxFmThv7tq+5J+ACdEFZ0zaucMaKsxCyfM7DbAAi2
1RgAn1SK6mcFxFdjAw3GOkzrikiQlCAd
=/E2Z
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/