AOH :: ISNQ4928.HTM

Ministry of Defence leaks counter terrorism traffic




Ministry of Defence leaks counter terrorism traffic
Ministry of Defence leaks counter terrorism traffic



http://www.theregister.co.uk/2007/12/10/mod_usage_statistics/ 

By Dan Goodin in San Francisco
The Register
10th December 2007 

For the past 20 months, the Ministry of Defence has been generous enough 
to provide detailed information about visits to its Counter Terrorism 
Science & Technology [1] site.

We're not sure, exactly, what to make of the logs showing some of the 
site's most popular pages and most prolific visitors. On the one hand, 
such details aren't exactly state secrets. Then again, what possible 
benefit can come from volunteering statistics that show that the 
Bulgarian IP address 85.187.138.185 was the top visitor for the month of 
March, having accessed 668 files for a total of 3.5 MB worth of data?

Until late last week, usage stats as measured by an analysis program 
called Webalizer were freely available from April, 2006 through this 
month. We're guessing the disclosure was not intentional, because the 
information was quickly removed about a day after MOD admins were 
informed of the public pages. (The information is still available in 
search engine caches by using search strings such as 
http://www.ctcentre.mod.uk/usage/usage_200604.html, 
http://www.ctcentre.mod.uk/usage/usage_200605.html and so on.) 

Besides showing top visitors, they list some of the site's most popular 
pages for each month. Last month, for instance, the Counter Terrorism 
site had just north of 15,000 page impressions ,and its fourth most 
popular URL was this one relating to potential suppliers.

To be sure, disclosures such as these aren't likely to lead to the kinds 
of security nightmares that result when, say, a consultant "loses" a 
laptop containing personal information belonging to hundreds of 
thousands of individuals. At the same time, seeming innocuous 
information like this can be precisely the kind of fodder gathered in 
footprinting exercises, in which attackers learn as much as possible 
about sites they intend to penetrate. Loose lips sink ships, as the 
saying goes.

"I think I can reasonably say that any conventional enterprise or 
government entity most likely intends to have policies in place that 
would consider IP addresses of visitors to be information not intended 
to be casually shared on the public internet," says security researcher 
Rodney Thayer of Canola & Jones.

The MOD is by no means the only website that has made its Webalizer logs 
available to the world. Running this search reveals tens, possibly 
thousands, of sites that allow anyone to view usage statistics. NASA, 
the US Army and a UK Hospital are among them. 

[1] http://www.ctcentre.mod.uk/index.php 


__________________________________________________________________      
Visit InfoSec News
http://www.infosecnews.org/ 

Site design & layout copyright © 1986-2014 CodeGods