Hacker Numerology

HD Moore opens with the German tank problem, where a few captured serial numbers let analysts estimate wartime production far better than intelligence estimates did. He argues that identifiers now sit on nearly everything, from receipts, driver's licenses and car VINs to medical records and hardware serials, and that short, densely packed values often reveal far more than their owners expect once you collect a handful of them.

The middle of the talk walks through real examples. Sequential IDs in lab results and pharmacy prescriptions exposed other patients' records, discarded receipts showed how busy a restaurant was, and Dell service tags encoded purchase dates that could be read from management interfaces. Moore shows how timestamps and MAC addresses hide inside UUIDs and cookies, and how sampling IPv4 and IPv6 space exposes network layout, misplaced devices and unexpected open services. He also describes using a PlayStation discovery protocol to collect device identifiers at scale.

The takeaway is practical. Developers should avoid predictable identifiers for objects and records, and should enforce authorization on every lookup rather than trusting that a number is hard to guess. Defenders should also treat their own identifier schemes, and the metadata they expose, as potential intelligence sources that an outsider can measure over time.