Imgur stated in a blog post that the vulnerability was patched that evening and the site is no longer serving affected images.
MALWAREBYTES ORG CODE
The JS then lies dormant in your local storage until it receives a go code, or a self destruct code that causes it to be replaced with another payload from 8ch.pw. The JS then pings 8ch.pw, the hacker’s domain, (not 8Chan) which can serve it any JS payload it wants. With Malwarebytes, you get AI-powered security with the latest intelligence from our threat detection team. Say hello to smarter, safer protection for all your familys devices. This lets a div containing a script tag finish executing the JS. Protect yourself in real-time, all the time. 8Chan loads the content of your “favorites” on the page, no sanitization at all. The JS then causes your browser to ping 8Chan. (Because the hacker was a chan lurker, the file also contained easter eggs like dancing pokémon and a private key containing the string imsorrybrennan) It then flags the rest of the malicious file as a “favorite”. Flash can create and modify local storage for 8Chan, even if you’ve never visited it. The JS loads an iframe from 8chan, acting as part of a ddos. (Basically, thanks to imgur’s code that lets you link to GIF’s as PNG’s, your browser renders an invisible HTML file containing your image and some invisible JS without telling you) Thanks to a security hole in imgur involving MIME magic, the hacker can inject JS. As one explanation broke the process down: The site was compromised in such a way that viewing certain images uploaded to Imgur would result in opening hundreds of connections to 4chan and 8chan. Imgur was exploited September 21st and was first discovered with a thread on Reddit. For that information, we can piece together the rest of the puzzle. The Learn More link takes you to a generic page on IP Blocking from the company, where as I wish it would explain the reason why a site is being blocked. After the block notice, visitors are directed to with the logo and statement that says “Malwarebytes Anti-Malware has blocked a potentially malicious website.”
0 kommentar(er)
