By Dan Goodin in San Francisco
10th December 2007
For the past 20 months, the Ministry of Defence has been generous enough
to provide detailed information about visits to its Counter Terrorism
Science & Technology  site.
We're not sure, exactly, what to make of the logs showing some of the
site's most popular pages and most prolific visitors. On the one hand,
such details aren't exactly state secrets. Then again, what possible
benefit can come from volunteering statistics that show that the
Bulgarian IP address 126.96.36.199 was the top visitor for the month of
March, having accessed 668 files for a total of 3.5 MB worth of data?
Until late last week, usage stats as measured by an analysis program
called Webalizer were freely available from April, 2006 through this
month. We're guessing the disclosure was not intentional, because the
information was quickly removed about a day after MOD admins were
informed of the public pages. (The information is still available in
search engine caches by using search strings such as
http://www.ctcentre.mod.uk/usage/usage_200605.html and so on.)
Besides showing top visitors, they list some of the site's most popular
pages for each month. Last month, for instance, the Counter Terrorism
site had just north of 15,000 page impressions ,and its fourth most
popular URL was this one relating to potential suppliers.
To be sure, disclosures such as these aren't likely to lead to the kinds
of security nightmares that result when, say, a consultant "loses" a
laptop containing personal information belonging to hundreds of
thousands of individuals. At the same time, seeming innocuous
information like this can be precisely the kind of fodder gathered in
footprinting exercises, in which attackers learn as much as possible
about sites they intend to penetrate. Loose lips sink ships, as the
"I think I can reasonably say that any conventional enterprise or
government entity most likely intends to have policies in place that
would consider IP addresses of visitors to be information not intended
to be casually shared on the public internet," says security researcher
Rodney Thayer of Canola & Jones.
The MOD is by no means the only website that has made its Webalizer logs
available to the world. Running this search reveals tens, possibly
thousands, of sites that allow anyone to view usage statistics. NASA,
the US Army and a UK Hospital are among them.
Visit InfoSec News