Re: JavaScript security leaks?

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Yes, I have had the same experience (internal IP address revealed past
NAT router) using Firefox.  When Java is disabled (not Javascript, but
Java, for at least the particular site I was using), the IP address was
no longer visible.

Still, given that your address on a local network is selected from a
very small range of addresses that are re-used on every local network
(e.g.,, and so on), it is hard to see what value this
information would have for an attacker.  The reason that we use NAT
routers is so that scanners will not get a response when they scan for
open ports and come across the IP address by which we are known on the
Internet.  This address is significant because if a response is given,
then a hacker knows that a responsive machine is at that address and
can return to it at a later date to try to exploit that responsiveness.
 Given that broadband connections allow people to remain online at the
same IP address for many days at a time, that knowledge is significant.

But once your machine is behind a NAT router on a local network, its IP
address is only relevant within that network.  So, it is hard to see
how it could be used by an attacker.  You could pretty much guess at
anyone's internal IP address and be right a significant fraction of the

So, if I visit a particular Web site and they trap my internal IP
address, what are they going to do with it?  They already know my
router's address, and they know that a real computer is behind it,
because I am accessing their site using that address.  So, they can now
attempt to exploit vulnerabilities in my browser, or Java, or whateer,
which they could have done anyway.

Am I missing something, or is it reasonable to think that an exposed
internal IP address is not much of a threat?


Julia Thorne wrote:
Quoted text here. Click to load it

Site Timeline