4

As we all know, many forums allow users to set profile pictures, post images, or put images in signatures.

Could a user create an img tag that points to their own site with a link that no one would type in (example.com/placeholder/ping/ip/holder/record.php) and just record the ip address of every client that loaded the picture?

Is there any protection against this in web browsers? Is there any way to prevent this except by forcing all images on a website to be hosted by the site?

Improve this question
2
  • 2
    This technique is commonly used in email marketing and spam. Each email sent as part of a campaign has a unique code included in the image URL. If a user opens the email and their email client requests the image, then the server can log which unique code was used. This is used more to track email addresses than IP addresses, but it is also giving you a valid email address associated to an IP address. This is why most modern email clients won't automatically display images in an email unless it is from a trusted source.
    – Steven Mulkerrins
    Commented Mar 8, 2016 at 9:52
  • It's worth noting that even if a user got all the IPs that viewed their profile, they might have difficulty correlating that with anything else. Though this could probably be done by having a different link in each thread (or looking at referrers), and looking at post timestamps.
    – SomeoneSomewhereSupportsMonica
    Commented Mar 8, 2016 at 20:07

2 Answers 2

Reset to default
1

Could a user create an img tag that points to their own site with a link that no one would type in (example.com/placeholder/ping/ip/holder/record.php) and just record the ip address of every client that loaded the picture?

Yes.

Is there any protection against this in web browsers? Is there any way to prevent this except by forcing all images on a website to be hosted by the site?

Well, you can't force the website to do anything, and hosting images on different servers is standard practice (and if it's just a cdn).

What you can do is to set your browser up to only load images from the original domain you are visiting. In firefox this would eg be done via permissions.default.image=3.

There are likely plugins for your favorite browser that make this a bit easier to manage (eg that allow additional image loading with your permission, that let you whitelist some URLs, etc), but that's more of a product recommendation and off-topic.

Improve this answer
0

Fact is: by visiting Website S hosted bye party X you trust X to not exploit the weaknesses you expose as a result of the visit:

  • sending your public IP to X
  • executing Code controlled by X (e.g. malicious JavaScript that installs malware on your System)
  • accepting cookies that can be used to track you across Websites
  • X providing information it collected about you behind the scenes (e.g. showing users a list of IPs that visited their profiles)
  • and so forth...

The best countermeasure one can take against this is using TOR and a VPN. Risk remains and it one does Not want his/her IP exposed he/she should avoid using the intenet.

-You can disable all images. That, howevery, does not stop attackers from sending HTTP requests to their servers (e.g. via XSSed XHR requests). If you want to hide your IP, use TOR and/or a VPN.-

Improve this answer
5
  • Are you are saying that it is impossible to prevent other users of forums from getting your ip(Excluding VPNs/Proxies)
    – Stoud
    Commented Mar 8, 2016 at 0:35
  • Why are you worried about your public IP showing? Setting a cookie is a much more effective way of tracking someone.
    – wireghoul
    Commented Mar 8, 2016 at 9:53
  • @wireghoul but not anyone can just set a cookie, and not anyone just has XSS. But almost anyone can include an image on any number of websites (such as this one). I think the risk here is incredibly small, but one could imagine some far-fetched scenarios where this is not desired (eg someone doesn't like you on here, they place an image, get you to visit their profile, and try to attack your computer, as they now have your IP - and likely also an approximate location).
    – tim
    Commented Mar 8, 2016 at 10:12
  • Compared to a round of good old fashioned doxing your IP address is of little concern. If you're web hosting an image and can view logs, you can also set a cookie. Xss has nothing to do with it
    – wireghoul
    Commented Mar 8, 2016 at 11:48
  • @Stoud yes, that is what i am saying. If you disable all external content but the raw HTML the website hoster still has your IP and can tell anyone else.
    – marstato
    Commented Mar 8, 2016 at 16:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .