Imgur Exploited To Channel Botnet Attacks At 4chan 73
An anonymous reader writes: Imgur has been compromised by attackers looking for an opportunity to direct large volumes of traffic to 4chan. A Reddit thread explains that "when an Imgur image is loaded from /r/4chan [...] imgur loads a bunch of images from 8chan, which causes a DDoS to those sites." Meaning that if a user clicks an Imgur link on /r/4chan, it automatically makes around "500 requests" for one image from imageboard 4chan.org/8chan.
Do over please (Score:5, Insightful)
Can we get a cleanup on this summary please, from someone who actually passed high school English class?
The short version: someone served up malicious javascript on 8chan by hosting it on imgur as images, revealing that imgur does not actually check to make sure its images are images. Some Flash on 8chan loads the javascript from the localstorage object, breaking same-origin. Once again the DOM is proven to be a horrible house of cards.
Re: (Score:1, Insightful)
Can we get a cleanup on this summary please, from someone who actually passed high school English class?
The article summary was probably submitted by a 4chan user...
Re:Do over please (Score:5, Informative)
4chan users actually know how to write, at least better than slashdot "editors". It's just that they add the "faggot" and "nigger" every 3 sentences.
Re: (Score:2)
3 sentences? Maybe 3 letters...
Re: Do over please (Score:1)
mods have never visited /b/. Parent is insightful if anything.
Re: (Score:3)
They only know words that can be typed with one hand... I'll let your dirty mind figure out why
I'm guessing industrial accidents.
Re: (Score:1)
Can we get a cleanup on this summary please, from someone who actually passed high school English class?
The article summary was probably submitted by a 4chan user...
It was 100% submitted by a /. user...
Re: (Score:1)
The submitter copypasted the summary from thestack.com. It makes no god damned sense there, either.
Re: (Score:2)
1. The malicious "images" are hosted on imgur.
2. They are posted to
3. The malicious code downloads a bunch of images from 8chan, effectively DDoSing it.
Yes, the summary is awful and contradicts itself a few times. It has nothing to do with 4chan from how I understand it.
Re: (Score:1)
I only came to read the comments because the description was horse shit.
God damn... Slashdot is becoming more depressing by the day.
"News for idiots. Shit doesn't matter."
Re:Do over please (Score:5, Insightful)
So if you visited www.imgur.com/image.jpg the source code would look like:
img src="data:image/jpg;base64,R0lGODlhEALMAAOazToeHh0tLS/7LZv/0jvb2
When uploading an image to Imgur someone figured out how to append code to the end of the raw data to break out of the data url data and append some Javascript to it.
The Javascript pulled down images from 8chan among other things.
Re: (Score:1)
Re: (Score:3, Insightful)
Well then they're doing it wrong. URL rewriting at the httpd engine level (or the cache level, or whatever serves as the frontmost layer) can handle that without embedding the binary data inside of an IMG tag. Inlining binary data is also contrary to how HTTP is supposed to work, as it breaks the renderer's ability to choose whether or not to retrieve certain media. A user who is browsing with images disabled in their browser has expressly opted not to retrieve that data. When a site inlines images in this
Re: (Score:1)
I am not 100% certain of the nomenclature but I believe it goes like this:
"oldfag is oldfag. teh cancer that iz killin /b/ haz been here since tiem immemorial. lulz will be had by all - except u cuz u is newfag w/knickerz in knotz! lulz. now tits or gtfo, newfag. also ur mom"
Promptly followed with, "stfu, ur mom iz teh cancerz. fgt!"
A witty riposte will be sure to follow and it will, quite likely, be akin to, "no u!" (Accompanied with a picture of gore or the OP's penis.)
I am not entirely fluent, yet, but I
Re: (Score:2)
I was on /b/ back when it was good.
Re: (Score:1)
> implying /b/ was ever good
I was first exposed to the site back in the early 2000s. It's never really been a hangout though I've had some interesting conversations there. They're not all retarded children. The signal to noise ratio is pretty high, currently, but it's dieing down to a dull roar now that the kids have gone back to school and it is losing favor in the media. I think it can be summed up, sort of, as Eternal September(ish) but with fluctuations in the signal to noise ratio.
I'm still wonderin
Re: (Score:2)
Now I'm curious if you've ever been on /b/. The correct response to "when /b/ was good" is "/b/ was never good."
Re: (Score:1)
Disregard that. I suck cocks.
Re: (Score:1)
Can we get a cleanup on this summary please, from someone who actually passed high school English class?
The short version: someone served up malicious javascript on 8chan by hosting it on imgur as images, revealing that imgur does not actually check to make sure its images are images. Some Flash on 8chan loads the javascript from the localstorage object, breaking same-origin. Once again the DOM is proven to be a horrible house of cards.
Also, the DDoS was at the very least also targeted at 8ch. There was a pretty big teardown of it -- someone registered a similar name to 4ch's image host, the malware SWF specifically mentions the founder of 8ch and something that sounds like it's related to /pol/, the server hosting up the malware was replying to specific referrers and IP addresses, etc etc.
Re: (Score:2)
Can we get a cleanup on this summary please, from someone who actually passed high school English class?
4chan and 8chan, which fancies itself a wilder 4chan, are like Moe and Curly. Imgur is like Larry and his violin. Reddit just tossed a quarter on the floor, and Larry, Moe, and Curly all went to grab it, yielding the crisp, clean sound of coconuts knocking together.
Old news? (Score:5, Informative)
This was patched yesterday [imgur.com].
Re: (Score:2)
Are you a fucking moron? That shit happens all the time. I'll answer my question for you: yes, you are a fucking moron.
Martin Shkreli, is that you???
Re: (Score:1)
"It seems likely that the malicious Javascript was added by some SJW that works for imgur."
No, this was done by a notorious furfag on 8ch by the name of Bui. The fact that the originating SWF url comes from the /pokepaws/ board is pretty much the dead trigger, since Bui owns that board.
Re: (Score:2)
No, that would be 8chan.
Re: (Score:2)
No, that would be 8chan.
I think you mean that would be Sarah Nyberg or perhaps Dan Olson.
old CIA trick involving hidden i-frames (Score:1)
Some posted how the code worked on Voat a few days ago, word seemed to spread from there. Mentioned it was an old hack developed by the CIA, something about creating off-screen i-frames. My code-fu is very rusty these days but it seemed to make sense. Can't seem to find the post now, forgot which sub it was.
Re: (Score:2)
CIA? Really? This kind of crap has been around since the late 90's and is well described in books dating back decades ago.
Re: (Score:2)
HOLY HECK, Batman! (Score:2)
Some posted how the code worked on Voat a few days ago, word seemed to spread from there. Mentioned it was an old hack developed by the CIA, something about creating off-screen i-frames.
Those dastardly devils at the Culinary Institute of America are so cunning, with their JavaScript kung-fu!
Comment removed (Score:4, Insightful)
Re: (Score:1)
Getting pretty hard to find places where you can speak uncensored. That seems pretty valuable IMO. Especially when bad actors of major websites are doing what they can to take down a low budget server run by a disabled dude.
Re: (Score:1)
This. It amazes me that so many people attack fullchan.
Pro-censorship folks cannot stand the fact that 8chan has relatively lax moderation while still quickly removing things that are actually illegal.
The feelings of SJWs are not protected by law. The real world isn't a safe space.
Awful summary, this was a backdoor targeting 8chan (Score:2)
The javascript downloaded further obfuscated javascript from several servers, registered behind anonymity in Panama and using hacked cloud instances. One of those was 4cdns.org, imitating 4chan's 4cdn.org.
This inserted code into the localStorage object for 8chan, 8ch.net. 8chan was set up to include localStorage on every page.
The code was one that periodically requested further code from a command and control server. The C&C server was inactive whe