0

I shared a Speccy report link (publish option) on Reddit Security's chatroom after I was asked to by an expert while he was trying to solve an issue for me. please let me know. thanks

2
  • What type of data was in the report? Were there any serial numbers? MAC addresses? IP addresses? Usernames or passwords? Phone numbers? Social security numbers? Family secrets? Nuclear launch codes? For MAC addresses and IP addresses, there are questions on this site that discuss security implications. Apr 22 '20 at 17:01
  • Please let me know if I should delete the comment (After you have viewed the link)
    – Samuel P
    Apr 23 '20 at 10:29
0

In your scenario, there are (at least) 3 things to be mindful of or possibly concerned with:

  1. Are you sharing any PII or other personally sensitive information? This could include unique technical identifiers such as MAC addresses and public IP addresses, or more personal information. Just glancing at the report, I'd say probably not, but that may differ by individual opinion. One thing to note is that the report contains a list of IP addresses you were connected to; this could reveal what sites and services you were using at the time.
  2. Are you sharing any sensitive technical information? The data contains what applications are running, what patches you have, and what network services are listening. If you were running anything vulnerable or unpatched, this could be an issue.
  3. Is the person friend or foe? Obtaining basic system information could be a legitimate request, but it could also be used maliciously by a social engineer to demonstrate their credibility and/or learn more about your machine. It gives them the ability to say, "oh no, your report says you have explorer.exe running; that's a virus! I better remote in right away to fix it!" or "looks like you have Microsoft Word installed; lucky you, just download this document and it has all the steps to fix your computer! Just make sure you enable macros first."

I don't think you need to worry too much about the information you already shared, but proceed with caution and don't let them connect in or run any software that you don't understand.

2
  • Thank you sincerely sir. Is my computer unsafe now? What should I do?
    – Samuel P
    Apr 24 '20 at 7:35
  • @SamuelP like I said, you are most likely fine. They may be trying to help, but don't trust strangers to the point where they have you installing strange software or running commands you don't understand. Look things up before you do them. Apr 24 '20 at 14:37
0

Here are a few things I see in the report:

  • Operating system
  • Installed updates
  • Running processes
  • Versions of Windows software
  • TCP connections

Those are things that would be immensely helpful if I were attacking you. I could use that to figure out exactly the sort of attack that would be most likely to succeed.

Now, on the topic of privacy/anonymity, I found these things in the report:

  • Computer name
  • User name
  • Time zone
  • Language

Privacy/anonymity is important, because you need a way to attack somebody, and usually a motivation. But this is the Internet, so it's hard to be completely anonymous. And also there are a few crazy people wandering around (don't make eye contact with them, please).

In this particular case, those names didn't appear very useful, but they could be. The time zone and language (assuming they are correct) point to an area of the world that has quite a lot of people. These details could be used to refine OSINT, though.

I could do OSINT on the account you posted from (Reddit or Stack Exchange). A lot of people accidentally share more than they realize, especially if you have accounts that are traceable to other platforms like Twitter or Facebook.

If I were just evil, I could contact you in the chat and "helpfully" post a link to a malicious website and hope you click on it. Here is where I need to point out those TCP connections. Several of those were websites. I could use that to figure out what websites you look at, and prepare a very convincing link.

But with risks, you have to look at likelihoods. For example, if you published this report on Twitter, that's higher visibility and thus higher likelihood of attack. On the other hand, if the link will expire, if it's a private chat room, if the chat messages get deleted automatically (or aren't easy to search), or if the computer is one you're going to replace soon anyway, then that would diminish the likelihood.

So wrapping up: I wouldn't advise posting the report for the general public, but you probably don't need to worry too much. If you can get the chat message deleted, that might be a good idea. If you're a politician or a spy, get rid of the computer right now.

1
  • Thanks. Well I'm just a regular guy, they asked me for that report because my computer had potential malware. It was on Reddit's techsupport chatroom. Is my computer now unsafe to use? The chat message can't be deleted, I asked the mods. I truly appreciate your help sir
    – Samuel P
    Apr 24 '20 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.