Is it safe to publish some internal IP of my company?

Question

Sometimes when asking networking questions on StackExchange I want to publish some output where several internal IP adresses from my company appear (output of traceroute command for example).

Since I know it is easy to link my StackExchange account to the company I work for, I was wondering if those IP adresses could be used by attackers to infiltrate my company's network.

A solution is to hide these IP adresses by replacing the numbers with 'x' or '*', but when I have a lot of them it is annoying, so if it isn't necessary I'd be glad not doing it :)

Answer 1

It is (mostly) safe, depending on your organization.

IP addresses are not technically meant to be hidden. Security through obscurity is hammered into any security-minded individual as the one true evil. Technically, any IP address on your network can be discovered fairly easily by anyone determined enough to find it.

From a security standpoint, assume that every server on your network is known. Though try convincing your company's security team that is a different story. Ergo, your company policies may be a completely different matter.

The one thing I can see being a problem is revealing your network structure to potential outside attacks. Let's say you worked at Valve on this brand new game called Half-Life 2. You posted a question about access issues with your source code repository, and forgot to obfuscate it. Then someone doing a targeted attack against Valve may be able to access this repository from a compromised system. If you're unlucky, there's no authentication required to access the full source code.

Of course any attacker capable of compromising the system in the first place can very well figure out the repo on his own. In most situations, attackers will be able to figure this stuff out by the time they have any sort of intranet access to your network.

Answer 2

Though I agree that security through obscurity isn't security at all. Information leakage is a real thing and can be exploited.

Yes, your IP addresses can be relatively easy to discover if an attacker is on your network. However, no, it's not a good idea to post this information on the web.

Making the attacker scan for machine addresses on your network is more noisy to a network admin than just handing over the information. One would hope that your internal network security system would identify that someone is scanning for IP's and take appropriate action.

So this is my roundabout way of saying, best practice would be not to expose them. However, it's only slowing an attacker down if they are hell bent on opening up your network.