I shared a Speccy report link (publish option) on Reddit Security's chatroom after I was asked to by an expert while he was trying to solve an issue for me. please let me know. thanks
In your scenario, there are (at least) 3 things to be mindful of or possibly concerned with:
- Are you sharing any PII or other personally sensitive information? This could include unique technical identifiers such as MAC addresses and public IP addresses, or more personal information. Just glancing at the report, I'd say probably not, but that may differ by individual opinion. One thing to note is that the report contains a list of IP addresses you were connected to; this could reveal what sites and services you were using at the time.
- Are you sharing any sensitive technical information? The data contains what applications are running, what patches you have, and what network services are listening. If you were running anything vulnerable or unpatched, this could be an issue.
- Is the person friend or foe? Obtaining basic system information could be a legitimate request, but it could also be used maliciously by a social engineer to demonstrate their credibility and/or learn more about your machine. It gives them the ability to say, "oh no, your report says you have explorer.exe running; that's a virus! I better remote in right away to fix it!" or "looks like you have Microsoft Word installed; lucky you, just download this document and it has all the steps to fix your computer! Just make sure you enable macros first."
I don't think you need to worry too much about the information you already shared, but proceed with caution and don't let them connect in or run any software that you don't understand.
Here are a few things I see in the report:
- Operating system
- Installed updates
- Running processes
- Versions of Windows software
- TCP connections
Those are things that would be immensely helpful if I were attacking you. I could use that to figure out exactly the sort of attack that would be most likely to succeed.
Now, on the topic of privacy/anonymity, I found these things in the report:
- Computer name
- User name
- Time zone
Privacy/anonymity is important, because you need a way to attack somebody, and usually a motivation. But this is the Internet, so it's hard to be completely anonymous. And also there are a few crazy people wandering around (don't make eye contact with them, please).
In this particular case, those names didn't appear very useful, but they could be. The time zone and language (assuming they are correct) point to an area of the world that has quite a lot of people. These details could be used to refine OSINT, though.
I could do OSINT on the account you posted from (Reddit or Stack Exchange). A lot of people accidentally share more than they realize, especially if you have accounts that are traceable to other platforms like Twitter or Facebook.
If I were just evil, I could contact you in the chat and "helpfully" post a link to a malicious website and hope you click on it. Here is where I need to point out those TCP connections. Several of those were websites. I could use that to figure out what websites you look at, and prepare a very convincing link.
But with risks, you have to look at likelihoods. For example, if you published this report on Twitter, that's higher visibility and thus higher likelihood of attack. On the other hand, if the link will expire, if it's a private chat room, if the chat messages get deleted automatically (or aren't easy to search), or if the computer is one you're going to replace soon anyway, then that would diminish the likelihood.
So wrapping up: I wouldn't advise posting the report for the general public, but you probably don't need to worry too much. If you can get the chat message deleted, that might be a good idea. If you're a politician or a spy, get rid of the computer right now.