« first day (2657 days earlier)      last day (2213 days later) » 

Derpy
Derpy
8:48 AM
Morning room. Sorry to have to bother you folks, I was looking for some information security experts to get some insight on a potential security problem that was identified on the Stack Exchange network. If anyone wants to help, please have a look at this question on the main Meta site.
37
Q: Allowing images from external sources opens doors to serious security exploits

Aaron YodaikenNote: Please see Jeremy's answer for more info on how this poses a security risk. I'm sure you guys already know this, but allowing users to put images from any source in questions means that askers can get all the analytical data you can about their question. So a malicious user could theoreti...

bug images security privacy
at the moment the mayor issues that were pointed out are listed on Jeremy answer.
The most serious one seems to be
> Prevent phishing of user credentials with browser authentication dialog.
we are wondering if any of you can provide more insight or even notice more attack methods that we haven't considered.
Thanks beforehand to anyone willing to help.
 
AviD
AviD
heya @Derpy, we actually had that post on our site a few years ago... hang on I'll go look for it.
some nasty bloke used it to literally troll some newbie off the internet...
 
Derpy
Derpy
@AviD that's what worries me in the first place. I am no infosec expert by far, but at least I have a developer background and would notice a window telling me that badDomain.invalid wants my credential... Can 't assume this is the same for users of other sites in the network. After all, we have sites dedicated to biking, traveling. cooking and so on...
 
AviD
AviD
ah no, the trolling was convincing them that this was an actual security issue.
it's really not...
@Shog's answer there pretty much sums it up, but I'm not finding the security.se version of it right now. might have been deleted?
 
Derpy
Derpy
? then I am even more interested in the post if you can find it
 
AviD
AviD
I think you'll be disappointed :-)
 
Derpy
Derpy
8:58 AM
@AviD Which answer? this?
> So what? Folks can track your viewing habits - that's a part of using The Web. Hopefully you already have off-domain cookies turned off, but if not then do that. If you're really concerned about it, use a proxy...
 
AviD
AviD
^
 
Derpy
Derpy
That is what worries me the less.
This is taken from an ongoing discussion on the "Tavern", Meta.StackExchange chat room
in Tavern on the Meta on Meta Stack Exchange Chat, 30 mins ago, by Shadow Wizard
OK, poisoned image is in sandbox now can you check it? @Sonic
the poisoned image was crafted so that it will present the user with a "provide your credential" prompt
 
AviD
AviD
doesnt seem to be working
 
Derpy
Derpy
Depends on the browser.
 
AviD
AviD
and easily handled using a properly locked down CSP
 
Derpy
Derpy
9:01 AM
It works on Firefox and Edge at least
 
AviD
AviD
okay, well maybe not "easily" :-)
ah yeah, just tried it in edge. interesting.
 
Derpy
Derpy
and I wouldn't expect random 13years old user on sites like "Anime.SE" to "properly lock down CSP"
 
AviD
AviD
uhh the CSP is on SO/SE side
still not finding it on sec.se, but it did reference this:
1
Q: Dynamic picture that displays the visitors IP address?

RobI see this a lot now, jpg files displaying your IP address. To you of course, not to others, they would see their own For example: yourip http://moco-sux.net63.net/palm-sig.jpg How is this even possible? If this is possible, would it be possible to log an IP into a MySQL database from the pictu...

ip-address jpeg
I do see the issue with the browser phishing bug tho
 
Derpy
Derpy
@AviD Yep, I realized what you meant soon after posting. Sorry. :P CSP - Credential service provider, right?
 
AviD
AviD
okay yeah the sec.se one WAS deleted, I have a partial screenshot if you want :-)
@Derpy no, sorry... :-)
Content Security Policy
Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context. It is a Candidate Recommendation of the W3C working group on Web Application Security, widely supported by modern web browsers. CSP provides a standard method for website owners to declare approved origins of content that browsers should be allowed to load on that website—covered types are JavaScript, CSS, HTML frames, web workers, fonts, images, embeddable objects...
sorry for making assumptions and not being clearer :-)
ooh! found it on meta
https://security.meta.stackexchange.com/questions/971/chat-ip-number-time-disclosure
and
https://security.meta.stackexchange.com/questions/972/how-to-protect-from-privacy-problem-in-the-chat
 
Derpy
Derpy
9:09 AM
@AviD That was my second guess. Not really knowing what Credential service provider are about I assumed they could be used to specifically block phishing credential prompts instead of the larger issue
@AviD Both deleted ^_^'
 
AviD
AviD
yeah....
again, not really much to see there, it was a bona fide troll that wound up getting kicked off later. Was trying to convince everyone that the way the web works is a bug in SE.
we dont like FUD here.... ;-)
PS, the last bullet in the meta post regarding "minor mischief" is a completely seperate, CSRF issue (if still exists).
 
Derpy
Derpy
@AviD That's alright and I don't have any objection. I was just wondering if a more experienced user base like yours see any other problem we may have missed
 
AviD
AviD
okay, here's another issue: I hotlink to an image on my server, everyone upvotes and shares and maybe even reuses it. Then I swap out the image to something bad (porn, violence, etc). Boom, everyone is still sharing a link to an image of bad stuff.
Dont know if that is reason enough to make that change, but possibly worth thinking about...
 
Derpy
Derpy
That is point two in Jeremy answer
> Prevent images from being changed without triggering an edit in Stack Exchange's system.
 
AviD
AviD
ahhh I didnt catch thats what he meant.
 
Derpy
Derpy
9:17 AM
BTW, I think it already happened at least once.
 
AviD
AviD
heh, I'm sure. I know of a few such instances not on SE, so its not really a specific issue.
and while the phishing bug is not great, I think it should be solvable rather easily. The other issues raised are practically non issues (excpet perhaps the unwanted / unlicensed traffic), at least from a security perspective IMO.
bottom line, I think I would agree there is meat to be discussed here, and a more in-depth analysis should be done when possible. But its definitely not a burning security vulnerability.
@RoryAlsop feel free to jump in! ^^
 
Derpy
Derpy
Ok, thanks. BTW, just to know - from your personal experience - pleas bear with me and my ignorance. This should not be weaponizable to next level attack like the ones more commonly widespread with malwertising and the such?
Basically, it should not be possible to use that to recreate the recent "Yay! Youtube ads now magically include bitcoin mining scripts" incident, right?
 
AviD
AviD
barring browser bugs or implementation flaws, no.
(implementation flaws I mean allowing non-static-image files).
 
Derpy
Derpy
Thanks, that at least alleviates my worries.
 
AviD
AviD
like, dont allow hotlinked flash, ofc.
@Derpy ps ftr there used to be a popular browser bug that allowed running java applets in an image. Look up "GIFAR"... basically, because of the way the file formats are structured, a single file could be both a valid GIF, and a valid JAR.
that said, that was fixed ages ago, and currently there are no known similar issues - but thats not to say someone won't discover such a thing next week. Ofc simply copying all the images to SE server wouldnt stop that, anyway.
 
Derpy
Derpy
9:37 AM
@AviD I remember reading this post once on Super User asking about how secure Google Image searches are. The answer suggest that Google is probably doing some basic form of scan before serving the results, which albeit unproven seem realistic enough - at least to me (they probably don't want some bad news site to post an article titled "Hacked Google Image search serves viruses to its users")
I always assumed that imgUr is doing at least some basic processing of the uploaded images. Which obviously does not mean they would notice everything, but should at least catch the more basic stuff
At least, I know they do remove exif data from the images
 
Tom K.
Tom K.
me and all my colleagues just got an email for new accounts for some platform including username and password. all the usernames are just IDs and the passwords for every ID is "welcome".
 
 
3 hours later…
Derpy
Derpy
12:23 PM
Back here. Sorry, had to go away for a while.
Anyway, thanks @AviD. Your insight was indeed helpful.
 
AviD
AviD
ah so did I!
@Derpy sure thing, glad to help.
and yeah, virus scanning is useful, though obviously not a panacea. Would definitely suggest to do that, if all images are coming into SO/SE servers, but still would not really amount to strong protection (but still worthwhile, for the mass of low quality attacks...)
 
Derpy
Derpy
(now, I just need to check if anyone could use an svg image to trick an user in executing a post request to stackexchange.... and upvote a post in the process. Luckily it seems that SE displays uploaded .svg images in IMG tags, and that should be enough to stop svg javascript execution capabilities...)
 
Tom K.
Tom K.
what's your role in all this @Derpy?
 
Derpy
Derpy
@TomK. trying to convince the staff that switching to only allow images from i.stack.imgur is indeed a good idea or convince myself that thinking that can be weaponized to do much more than fake credentials prompts is FUD
probably, the second one.
That said, I am somehow intrigued by the amino apps approach of only including on pages content that was uploaded to their domain
 
Tom K.
Tom K.
12:52 PM
probably #FUD
it would be kinda weird, if people didn't try to exploit that already
although I guess it's hard to hide a cryptominer in a jpeg
 
Derpy
Derpy
@TomK. Anyway, since you asked, the discussion was based on this post on the main meta and the following comments from the various answers. That started some arguments on a different chatroom after an user posted a crafted image in the same room, causing some browsers to show a "insert credential" prompt.
We have been discussing the issue, trying to ensure there aren't more serious vulnerabilities made available from accepting external urls to images
 
AviD
AviD
@Derpy honestly, probably both are true :-)
 
Tom K.
Tom K.
yup, it doesn't encourage people to try :P
 
AviD
AviD
Hmm, looking again I'm not sure CSP actually has a solution for this.
 
Arminius
Arminius
2:03 PM
@Derpy Could you provide a sample image which actually triggers a basic auth dialog in FF when hotlinking? I was sure this was fixed in browsers long ago.
 
Derpy
Derpy
2:30 PM
@Arminius can confirm it is not fixed in every browser, the link was already posted in the chat room I linked before but sadly has been once removed. Give me a second
should be this one:
in Tavern on the Meta on Meta Stack Exchange Chat, 16 hours ago, by Jeremy Banks
Sources have it that this, posted by itself, exploits a security hole in Edge: !https://stack-exchange-login-dot-com-dot-me.glitch.me/
that said
in Tavern on the Meta on Meta Stack Exchange Chat, 1 min ago, by Shadow Wizard
@Derpy yeah, can see deleted messages in Den and sandbox, but I won't post it anymore since @Marc said it affects people even when deleted afterwards.
please, don't try this on the chat.
but you can safely copy the url to the address bar if you want to see what is happening to conduce some test/study
 
Arminius
Arminius
Thanks
Doesn't work in Chrome or FF though
 
AviD
AviD
confirmed in Edge.
 
Arminius
Arminius
(rolls eyes)
 
AviD
AviD
@Derpy do you know of any documented bug / KB / CVE / etc? Something canonical to point to?
 
Derpy
Derpy
@Arminius seems it does work on FF under some settings. We had different results.
@AviD nope. As I said, I am not very experienced with this kind of stuff.
 
Arminius
Arminius
2:36 PM
@Derpy You get the dialog when opening the URL directly, but the question is if you see it when embedding it as an image, say <img src="https://stack-exchange-login-dot-com-dot-me.glitch.me/">
Are you sure actually hotlinking (and not just opening) the URL triggers the auth dialog in FF?
 
Derpy
Derpy
@Arminius I discovered this in the first place because an user posted that on the chat and I did indeed see a dialog.
 
AviD
AviD
well there is this
44
Q: IMG tag vulnerability

Paul PodlipenskyIs it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, but not the image? Is there any known vectors? I've tried to serve javascript:alert(1) or the same, bu...

web-browser xss known-vulnerabilities file-upload chrome
 
Arminius
Arminius
@Derpy I see, that's interesting
 
AviD
AviD
@Derpy in light of how longlived that bug is, I might lean towards amending my initial response.
But as I said, it is worth spending a few cycles analyzing the actual risk here, and not just jumping all over it - unless the other benefits of caching to SE servers only are worth doing it regardless.
 
Derpy
Derpy
seems that Mark is getting involved too. Maybe we will see a fix of some sort
if anyone want to join, he is in the tavern now.

 Tavern on the Meta

MY GOD, IT'S FULL OF STARS AND BACKLOG! General friendly chit-...
10
5
 
Arminius
Arminius
2:47 PM
My strongest argument against hotlinking is not security-related but that images may suddenly disappear
 
Benoit Esnard
Benoit Esnard
That's why we don't love link-based answers right?
 
Arminius
Arminius
My point exactly
 
AviD
AviD
^
 
Anonymous
3:04 PM
In Firefox, my impression is it only appears if you've already visited the domain. Bit not sure. Some heuristics.
 
Arminius
Arminius
3:44 PM
Seems like they reverted the patch after running into compat issues
 
 
2 hours later…
Rory Alsop
Rory Alsop
5:25 PM
@AviD - Just spotted this conversation. Catching up now.
 

« first day (2657 days earlier)      last day (2213 days later) »