interesting site. how does it do what it does?

[GroundZero3]

http://www.astalavista.com/privacy/


how is this site able to read all this info?

Jason

[SysOpt]

All of that info is easily recordable by any web server. In fact, many/most sites record it without your knowledge in the interest of learning as much about their audience as possible.

[club_med]

This very same site and also www.astalavista.box.sk (http://www.astalavista.box.sk) offers you information on how to avoid this by using a proxy server.

cm.

[djurom]

I'm using proxy but it still reads my IP. That doesn't bother me so much but that file list and all... SCARRY

[Fingers]

I guess it's because I have my Java permissions set so high, but all that site is reporting is my IP, DNS Lookup, a few browser variables and that I linked there through SysOpt.

It is mis-reporting my location as "North Africa, Russian region" and say's it's my first visit...it's not.

Here's another http://privacy.net/analyze/

[mudoggy]

Yeeesh!
That file list part is creepy! http://www.sysopt.com/forum/frown.gif

[Harold7]

Out of curiosity, I tried visiting this site using different browsers.

With IE 6 Beta all information from my system was displayed including HD info by which I could open folders and view the contents (I'll go back later to see if I can access any folder data)... not nice at all.

Using Netscape 4.77, all this same info was there except the HD info which was completely missing... caused by using NSClean as a cookie manager, alias creator, I suspect.

Using Opera 5.1, hardly any info was there, no HD info at all, Javascript variables all blank, system info couldn't tell what browser I was using... I have Opera set to accept cookies only from those URLs that I preconfigured.

The IP address shown for all three browsers was that of my VPN so it never did show the correct IP address.

IE appears to be the least secure browser with security set to medium, though I suspect that if I install IEClean as my IE cookie manager this would change.

Netscape, coupled with NSClean, appears to give some measure of prtection from inquisitive sites.

Opera 5.1 seemed to give me the most security and control over what info leaves my computer... who'd a thunk it?

Just a quick and dirty test, but informative anyway, I was really impressed that programs such as NSClean could stop HD info from being seen and hide my surfing history. http://www.sysopt.com/forum/smile.gif

[club_med]

Where can i get NSClean, is it free ? http://www.sysopt.com/forum/smile.gif.

cm.

[Fingers]

I'm not sure we should be "impressed" that a browser can prevent a website from viewing HDD files and browser information. We should be very "UNIMPRESSED" if they don't.

Like Scott said, there is certain information that websites can gather, and it really doesn't present a security risk, but their ability to view your HDD and folder info is a serious problem, unless you are intentionally running an internet server. I don't think the hard drive info is a result of the browser though, your Windows file sharing and/or network configurations are probably set up to allow your hard drives to be seen and possibly accessed by anyone on the internet... NOT GOOD!!!


You should go to Gibson Research Corp. (http://grc.com/default.htm) and run the Shields-Up program. Run both the "Test My Shields" and "Probe My Ports" tests. The site will offer suggestions on how to close the security holes. You can cut right to it by reading the section on Network Bondage (http://grc.com/su-bondage.htm)

[This message has been edited by Fingers (edited 04-22-2001).]

[GroundZero3]

well i have a linksys. doesn't that supply some sort of secuirty??

[Harold7]

You can find NSClean and IEClean here: http://www.nsclean.com/

With NSClean installed and set up, cookies are kept in a file in the NSClean folder and never make it into C:\Windows.

I just checked this site with IE 6 again and found I could open and run programs that show up in the HD listing at this site... I have file and print sharing turned off, so I'm going to dig into Windows further to see why this is happening. http://www.sysopt.com/forum/smile.gif

[club_med]

I have ZA installed and yet this website was able to view folders, what am i doing wrong ?.

I just followed the advice and carried out the Shields up and the probe my ports test.

Both showed that my ports are stealthed and that my system is at the moment quite secure.

What am i going wrong ?.
cm.

[Fingers]

Perhaps I'm misunderstanding which files and folders are detected.

When I first set up my network, I visited grc.com and was shocked to find that they detected the names of all my networked drives, and the folders on each of them. My first step was to unbind TCP/IP from my network adapter and instead use NETBEUI as my network protocol for file sharing.

Here's a quote from the Network Bondage link above.
-------------------------------------------------------------------
Faithful to Microsoft's typical philosophy of "we're going to turn everything on so you won't ask us how to", the default bindings for a system with the components shown above would look like this mess:

... You don't need to be a rocket scientist to easily see why this is unsafe: The insecure Microsoft networking components — the Client for Microsoft Networks and File and Printer Sharing — are bound to the Internet's worldwide routable TCP/IP protocol, and the TCP/IP protocol is bound to ALL of the system adapters! Thus, anytime this system has any contact with the Internet, the machine's guts are spilling out for the whole world to access!
.................................................. .................

[BBA]

Ummm...

They are not seeing your drive.
They are instead scripting your PC to open explorer in the window space shown on your browser. THATS ALL.

The reason it does not work in other browsers is the other browser does not incorporate the specific java/script function.

The web page there is designed to scare you...the information they detect is detectible from any webpage you visit..it's how TCP/IP and HTTP works.

If you did not know your IP and machine data/browser data is detectible...you are missing a large part of how the internet works.

As for GRC seeing and accessing your shares...it was because you had sharing setup improperly or need a firewall.

[scripteaze]

exactly! the files and folders that you see on thier site are really only viewable on your PC. It's like your only using thier webpage to view your files. go to the top of your IE browser and put a c: in the address bar and hit enter...Thats all thier doing.

[scripteaze]

exactly! the files and folders that you see on thier site are really only viewable on your PC. It's like your only using thier webpage to view your files. go to the top of your IE browser and put a c: in the address bar and hit enter...Thats all thier doing.

[This message has been edited by scripteaze (edited 04-22-2001).]

[vfrxsw]

[This message has been edited by vfrxsw (edited 04-22-2001).]

[This message has been edited by vfrxsw (edited 04-22-2001).]

[voogru]

take a peek at the source code...


*deleted* - Takes up way to much space Voo. Dont do that again http://www.sysopt.com/forum/smile.gif

If you want to read the Source code go to the page and right click and choose "view source" Simple and doenst waste our space and time http://www.sysopt.com/forum/smile.gif

[This message has been edited by Mntsnow (edited 04-22-2001).]

[rh71]

Uhhh... it was wrong:

Your region:
Asian pacific region like India,Afghan

[Comtech]

You mean the show folders like this?

<FONT SIZE="2" FACE="Verdana, Arial"><iframe src="c:\"></iframe>

[SiteCharts.com]

Running WinXP and IE 6.0 it reported some info about my IP, browser, Screen res. but nothing else.
What are these "viewable folders" that everybody is talking about?

I'm running WinXP Beta 2.0 with IE 6.0, the Firewall is OFF!!! and I'm connected with the internal PPPoE over DSL!

[club_med]

Hi people,

Just to clear up the confusion i have made a screen shot of whats been worrying some people here including me.

Click here to view image (http://members.aon.at/system29/example1.gif)

If BBA is right, then this is not a security breach, am i right ?.

cm.

[This message has been edited by club_med (edited 04-23-2001).]

[Mntsnow]

BBA is CORRECT...There was NO security breach....Just a "slight of hand" type magic trick....Just done to scare people

[GroundZero3]

oh okay i didn't know. Thanxs for clearing that up Mntsnow

Jason

[ladyJ8us]

Harold7 - Where do you download Opera browser? Thanks ladyJ8

[GroundZero3]

you can get it from www.download.com (http://www.download.com)

Jason

[Romulus2]

The iframe command performs this trick (http://www.romulus2.com/articles/features/hddspy.htm) in IE.

(Scroll to the bottom of the Results page.)




[This message has been edited by Romulus2 (edited 04-23-2001).]

[Romulus2]

(double post!)

[This message has been edited by Romulus2 (edited 04-23-2001).]

[jl123]

Umm......well it didn't fool me too well because it displayed my hard drive in the same iconpax icons i have installed. http://www.sysopt.com/forum/smile.gif But it still made me wonder how it was done. http://www.sysopt.com/forum/wink.gif

View Here (http://jl321.tripod.com/SCREENSHOT.JPG)

~Joel

[This message has been edited by jl123 (edited 04-23-2001).]

[club_med]

Thanks for the clarification http://www.sysopt.com/forum/smile.gif.

cm.

[zskillz]

how come when I double click on one of the folders, I get a warning message about performing a system command... I don't have the balls to actually click yes.

can someone expound??
thanks
-Z www.twelvecents.com (http://www.twelvecents.com)

[noch2004]

has anyone checked the coding on that site
it could be just a program that views all your details
but the ppl on the OTHERSIDE cant see whats on your HDD

[Harold7]

You can get the latest version, Opera 5.11, here: http://www.opera.com/ http://www.sysopt.com/forum/smile.gif

[^hyd^]

View C:\ drive? Here ya go... open a new IE window and put this in as a url and hit enter -> "file:///C:/" (minus quotes),it's JavaScript(I'm pretty sure) to view C:\ drive, client-side only!! I'm sure this is all they are doing. Could also do any other valid drive... Have fun!

(I don't have Netscape so can't tell ya if it works for it or not...)

[flea]

Would this work in linux if C:\ was replaced with / or $HOME? Is this just IE/WIN, or could any browser/os do this, as it seems they can all acess the hdd with file:// or whatever. Does XP /lin prevent the browser doing this? Im using opera 5.0b6/lin and it didnt show any files, but detected res, browser and os. I never realised that, even with a proxy this is still possible.

[flea]

Double post. Grr.


[This message has been edited by flea (edited 04-24-2001).]

[Long Haired Hippie Phreek]

It is java script all right, and I quote...

"<script type="text/javascript">
<!-- showhd() // --> </script>"

It tells IE to show your first hard drive. Linux would do the same, assuming the exact same command worked the same in the browser you were using (in fact, if opera or netscape worked just like IE, they would show it too.)

Also, it is rather poorly done in another aspect...while jl123's hard drive was shown as a detail list, mine was shown as icons, because I have them set up that way in explorer. If you enable any view mode, you will see it a different way.

By the way, the "system command" is looking at your own hard drive, M$ hates the idea that you might be accesing your own computer.

[Fingers]

After I re-enabled active Java scripting under IE’s security settings, I was able to see the hard drive section that you guys are talking about. I should have done that before suggesting that there could be a security problem. This doesn’t appear to be at all related to the situation with TCP/IP and file sharing that I previously described.

Grc.com was indeed able to view and even access my drives and files, but as BBA said, that was because I didn’t have my network/sharing set up properly (well actually I think I did have it configured properly ...according to the instructions that came with my NetGear NIC).

Sorry if I bolstered anyone’s suspicions that something shady was going on.

[golfcart]

Actually it would not work in linux. It uses activex controls.

"<script type="text/javascript">
<!-- showhd() // --> </script>"
actually calls the following part of code which is defined in the head tag as yourdata.js
The location value could be changed to any drive letter.


function showhd() {
if (navigator.appName == 'Microsoft Internet Explorer' ){
document.write('');
document.write('<center>');
document.write('<object id="browserIcons" classid="clsid:8856F961-340A-11D0-A96B-00C04FD705A2"
align="baseline" border="0" width="100%" height="150">');
document.write('<param name="Location" value="c:">');
document.write('<param name="AlignLeft" value="1">');
document.write('<param name="AutoSize" value="0">');
document.write('<param name="AutoSizePercentage" value="100">');
document.write('<param name="AutoArrange" value="0">');
document.write('<param name="NoClientEdge" value="false">');
document.write('<param name="ViewMode" value="4">');
document.write('</object>');
document.write('</center>'); }



Trying to stop it from blowing out the bbs frames

[This message has been edited by Mntsnow (edited 04-25-2001).]