Hacker News Reader

Comment by api | Hacker News Reader

If internal IPS are critical security info, something is very wrong.

Well, imagine you're in a controlled environment (eg, China) and having your non-vpn IP leaked could compromise your identity. Having an easy way for a site to reveal you is therefore a security issue.

Ah, that makes more sense. I assumed he was referring to the private address assigned to your machine on your LAN.

Even if he is, it's still information that doesn't need to be revealed. It's not a security issue in and of itself, but if combined with another exploit, it could help an attacker. Good security is all about layers and protecting information.

LAN IPs are also useful for distinguishing computers from the same external IP which could help compromise your identity or privacy.

? I browse from work.

And I'm fairly sure my Sys Admin won't want random websites knowing my internal IP address.

Network shares etc. would likely be somewhere on the same range and they could launch subsequent attacks to try to sniff confidential documents and resources.

Again: that is a problem. If that is possible your internal network is insecure.

The castle and moat model is obsolete anyway. Most attacks today come through "pulled" vectors that bypass the firewall. If you rely on a physical network perimeter for security your security is an illusion.

your network shares have public, routable IP addresses? that, in my opinion, would be a far bigger issue than 'leaking' a hosts IP address.

No, any website can detect your local IP address, then use ajax to scan a targeted IP subnet range fairly quickly (and completely hidden from the user) to find any shitty CORS-enabled web interface your company has (think some "modern" internal accounting webapp that enables CORS for its "API").

Prior to WebRTC you'd have to scan much larger IP ranges to try and find internal network webapps that are CORS enabled.

i'm more talking about being able to craft subsequent XSS requests. My browser will unwittingly be doing the attacking

My ip address is 192.168.99.105

Script tries XSS attacks on:

  http://192.168.99.1/ciscowebinterface/known_dodgy_admin?user=root&pass=NEVERCHANGED1
  http://192.168.99.1/juniper/also_leaky_admin?user=root&pass=NEVERCHANGED2
  http://192.168.99.2/... enumerated

Yeah, I'm struggling to understand why that's an issue.

Browser fingerprinting. If a site knows your Internet-facing IP address and your local IP address, then they can uniquely identify you, even if you delete your cookies or use private browsing mode.

Reply on news.ycombinator.com