The Forum has been Updated
The code has been upgraded to the latest .NET core version. Please check instructions in the Community Announcements about migrating your account.
There is a new method for phishing for forum users. This often comes with in P.M's, however may as well work for normal threads, which may include Snitz as well.
This method uses putting an image link as with in [img]... It is method for asking for authentication on a server (such as password protected directories etc.) or password protected FTP's... Users who are not aware or familiar with web that much falls into this since they think it is their forum password/username. As they type it, it logs user/pass on attackers domain or IP.
I wonder if there is any solution for it. Ofcourse disabling images on boards might as well stop it but definitely not a solution.<
This method uses putting an image link as with in [img]... It is method for asking for authentication on a server (such as password protected directories etc.) or password protected FTP's... Users who are not aware or familiar with web that much falls into this since they think it is their forum password/username. As they type it, it logs user/pass on attackers domain or IP.
I wonder if there is any solution for it. Ofcourse disabling images on boards might as well stop it but definitely not a solution.<
Posted
Another member here on Snitz educated me on another issue ... again with images.
He said that someone can post a bogus link to an image that is supposed to be on the server that the link says the image is on but is not. Beforehand, they have programmed their .htaccess file to intercept all requests for that image. When your forum member clicks on the link to that post, your server goes to their server looking for the image, and their .htaccess redirects you to a new url on another site. It all happens seemlessly, so the person who clicks on the link doesn't even know what has happened.
I suppose the same thing could happen in your situation where they could do the same but redirect the person to a mock up of the site that they are using at the time, and then require a username and password for access. After "logging in" they are redirected back to the site they are supposed to be on, and they never know anything different. Yet, the perp now has their credentials.
I'm looking into disabling images for my sites.<
He said that someone can post a bogus link to an image that is supposed to be on the server that the link says the image is on but is not. Beforehand, they have programmed their .htaccess file to intercept all requests for that image. When your forum member clicks on the link to that post, your server goes to their server looking for the image, and their .htaccess redirects you to a new url on another site. It all happens seemlessly, so the person who clicks on the link doesn't even know what has happened.
I suppose the same thing could happen in your situation where they could do the same but redirect the person to a mock up of the site that they are using at the time, and then require a username and password for access. After "logging in" they are redirected back to the site they are supposed to be on, and they never know anything different. Yet, the perp now has their credentials.
I'm looking into disabling images for my sites.<
Posted
Good method fighting against this, would be checking image width and size before showing it to user. But I don't know any fast way for doing that. May be server to check images after every post? Would be easy with client side javascript but not that sure with server-side.
Normally, with .htaccess, you can't redirect pages if link is with in "<img src=" code though.<
Normally, with .htaccess, you can't redirect pages if link is with in "<img src=" code though.<
Posted
I wonder that even if the image did exist on the other server, could their .htaccess file override the request for the file and still do the redirect?<
Posted
with htaccess, you can redirect image to another image. Best example is doubleclick ads. However, no matter how redirection is made, they can't redirect entire web page if it is place on image tags. I do it on my server a lot for load balancing.
Like if it is <img src="x.jpg"> and if you redirect x.jpg to another html file or web page, people will just see an image placefolder, error that is not loading properly. Because browser will not able to render URL inside as an image.
if Image exists and if you can take image size and width on other server, that means you are not required authentication even it is redirected it IS an image and harmless...<
Like if it is <img src="x.jpg"> and if you redirect x.jpg to another html file or web page, people will just see an image placefolder, error that is not loading properly. Because browser will not able to render URL inside as an image.
if Image exists and if you can take image size and width on other server, that means you are not required authentication even it is redirected it IS an image and harmless...<
Posted
This other fellow was saying that when his forum members clicked on a topic, that they were entirely removed from his site and landed on eBay for an auction different than the one which the post listed. Say, for instance, if one person posted an auction in the starting topic, and then someone posted a reply, but in the reply post, they had an image that wasn't there. He said that the replying member's .htaccess file redirected the unknowing visitor to the reply author's ebay auction.<
It did not work. It may something else, like a Flash SWF? Embedded Object? Not sure if forum owner allowed such extensions (like Video extension etc.).<
<