Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite
1

When I post a picture to an Internet forum or Stack Exchange site I am told to hide and destroy names, domain names, user names, server names and computer names.

hide domain local information

We know that user names are valuable for hackers, but why must we hide local domain names?

I see that a Google search results in many pictures that don't have the information hidden.

When we don't PING one server how can we recognize its location for penetration and hacking? Why do we hide the information when DNS servers can't recognize and query them, and no router can route hackers to local domain site?

share|improve this question

2 Answers

up vote 7 down vote accepted

When performing pen-tests, it's amazing how much information can be gathered by finding the StackExchange accounts of employees. Server naming patterns for example can be quite helpful, makes finding targets easier.

Test environments rarely are secured properly - or at least to the same level as production systems. If you can get into a test system, it's disturbingly common to be able to use that to then make it into production systems.

Any information leaked can help an attacker - even minor things can help an attacker gain a better understanding of the target environment.

share|improve this answer
from stack exchange user's question can we understand what they know and what is their knowledge level? and with their information in pictures find their location and attack and destroy them? – saber tabatabaee yazdi Mar 13 at 6:01
2  
You can learn what technologies are in use, you can get a rough idea of how knowledgeable they are, and in some cases you can get insight to how they secure their systems. It's an amazing amount of data if you invest the time to do the research. – Adam Caudill Mar 13 at 6:06
2  
Don't forget to check and scrub the metadata too, especially if you use a GPS enabled camera/phone. – mr.spuratic Mar 13 at 8:43
how about FB and photos and information there? all you mentioned forbidden? – saber tabatabaee yazdi Mar 14 at 6:43
1  
When I research a company and its employees - I'll look everywhere. I'm not above fake Facebook and LinkedIn accounts to gather data. It's a hard thing to defend against - you have trusting employees that don't see the harm, and people like me, who can find value in even the smallest things. – Adam Caudill Mar 14 at 14:31
up vote 5 down vote

Because information leakage is still information leakage. If it's not relevant to the question why would you include it in the question? You just do it to get a feeling of security.

Also people are posting configuration questions, which may or may not open up security holes.

Also even a test environment can contain valuable information, including confidential information.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.