Slashdot Mirror
Imgur Exploited To Channel Botnet Attacks At 4chan
An anonymous reader writes: Imgur has been compromised by attackers looking for an opportunity to direct large volumes of traffic to 4chan. A Reddit thread explains that "when an Imgur image is loaded from /r/4chan [...] imgur loads a bunch of images from 8chan, which causes a DDoS to those sites." Meaning that if a user clicks an Imgur link on /r/4chan, it automatically makes around "500 requests" for one image from imageboard 4chan.org/8chan.
Can we get a cleanup on this summary please, from someone who actually passed high school English class?
The short version: someone served up malicious javascript on 8chan by hosting it on imgur as images, revealing that imgur does not actually check to make sure its images are images. Some Flash on 8chan loads the javascript from the localstorage object, breaking same-origin. Once again the DOM is proven to be a horrible house of cards.
Does anyone really care?
There is no such thing as 4chan.org/8chan.
It returns a 404.
This was patched yesterday.
Can we please get a DDoS attack against 4chan using C4, SEMTEC, hydrogen bombs, or some other high explosive, please? Think of the children.. er.. the Internet, that is!
They say they patched it, but it very likely isn't.
I won't even remotely be surprised to see it spring up again in the very near future.
Thanks GifV! Worst idea in history.
The people doing these hacks aren't stupid and Imgur are underestimating them.
Also, fun fact, this was also partly possible because 8chan allows ANY source to read it globally. There is literally no reason for that flag to even be set to *.
So many people think this is associated with the new 4chan takeover. Morons.
Then further stupid shit, like associations with the 8ch owner and him, military associations, FBI and other stupid stuff like that.
Hilarious.
As I understand it the attack targets 8chan, not 4chan. That's a seperate site.
On a side note, 8chan is a popular target for social "justice" types because it serves as a hub for things they hate, e.g. Gamergate discussions. They're frequently under attack.
> imageboard 4chan.org/8chan
Wut?
Some posted how the code worked on Voat a few days ago, word seemed to spread from there. Mentioned it was an old hack developed by the CIA, something about creating off-screen i-frames. My code-fu is very rusty these days but it seemed to make sense. Can't seem to find the post now, forgot which sub it was.
Comment removed based on user account deletion
Some posted how the code worked on Voat a few days ago, word seemed to spread from there. Mentioned it was an old hack developed by the CIA, something about creating off-screen i-frames.
Those dastardly devils at the Culinary Institute of America are so cunning, with their JavaScript kung-fu!
Actually I wonder if 4chan is really a botnet under the costume of a image forum.
Getting pretty hard to find places where you can speak uncensored. That seems pretty valuable IMO. Especially when bad actors of major websites are doing what they can to take down a low budget server run by a disabled dude.
>In the United States, as late as the 1880s most States set the minimum age at 10-12, (in Delaware it was 7 in 1895).[8] Inspired by the "Maiden Tribute" female reformers in the US initiated their own campaign[9] which petitioned legislators to raise the legal minimum age to at least 16, with the ultimate goal to raise the age to 18. The campaign was successful, with almost all states raising the minimum age to 16-18 years by 1920.
Feminists should be killed.
Imgur for some reason ran malicious javascript.
The javascript downloaded further obfuscated javascript from several servers, registered behind anonymity in Panama and using hacked cloud instances. One of those was 4cdns.org, imitating 4chan's 4cdn.org.
This inserted code into the localStorage object for 8chan, 8ch.net. 8chan was set up to include localStorage on every page.
The code was one that periodically requested further code from a command and control server. The C&C server was inactive when this was discovered. In the minutes this was tracked down, the "further javascript" was changed on the fly - the person doing this was basically responding to the investigation as it happened.
The end result was that every user of 8chan had a rudimentary back door, which through the localFavorties object requested code to run at every page refresh from a C&C server to be activated at some time in the future.
Excuse me? This could have had a huge impact on the entire Pepe economy. We're lucky it went by without much happening.
This. It amazes me that so many people attack fullchan.
Pro-censorship folks cannot stand the fact that 8chan has relatively lax moderation while still quickly removing things that are actually illegal.
The feelings of SJWs are not protected by law. The real world isn't a safe space.
Enough said
christ, you neck beards have really gotten cantankerous in your old age.