Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Previously when I posted a screenshot online, someone told me to erase out my usernames, computer names, domain names, etc:

hide domain local information

Is there actually a need to do so?

A quick Google search shows that many people in fact broadly publicize these info.

How can leaking these harmless miscellaneous info allow an attacker to penetrate or hack my computers?

share|improve this question
add comment

2 Answers

up vote 7 down vote accepted

When performing pen-tests, it's amazing how much information can be gathered by finding the StackExchange accounts of employees. Server naming patterns for example can be quite helpful, makes finding targets easier.

Test environments rarely are secured properly - or at least to the same level as production systems. If you can get into a test system, it's disturbingly common to be able to use that to then make it into production systems.

Any information leaked can help an attacker - even minor things can help an attacker gain a better understanding of the target environment.

share|improve this answer
    
from stack exchange user's question can we understand what they know and what is their knowledge level? and with their information in pictures find their location and attack and destroy them? –  saber tabatabaee yazdi Mar 13 '13 at 6:01
2  
You can learn what technologies are in use, you can get a rough idea of how knowledgeable they are, and in some cases you can get insight to how they secure their systems. It's an amazing amount of data if you invest the time to do the research. –  Adam Caudill Mar 13 '13 at 6:06
2  
Don't forget to check and scrub the metadata too, especially if you use a GPS enabled camera/phone. –  mr.spuratic Mar 13 '13 at 8:43
    
how about FB and photos and information there? all you mentioned forbidden? –  saber tabatabaee yazdi Mar 14 '13 at 6:43
2  
When I research a company and its employees - I'll look everywhere. I'm not above fake Facebook and LinkedIn accounts to gather data. It's a hard thing to defend against - you have trusting employees that don't see the harm, and people like me, who can find value in even the smallest things. –  Adam Caudill Mar 14 '13 at 14:31
add comment

Because information leakage is still information leakage. If it's not relevant to the question why would you include it in the question? You just do it to get a feeling of security.

Also people are posting configuration questions, which may or may not open up security holes.

Also even a test environment can contain valuable information, including confidential information.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.