0

I have a PC using Windows 7 that I realize should be upgraded. I'm using the Windows Defender antivirus that came with the computer.

I recently joined a discussion forum. Member profiles there allow for a personal photo to be uploaded through the site. "Upload" button on profile, which when clicked opens the C drive on my computer so that I may select an image from pictures file or downloads.

If I upload a picture from my pictures file will the site be able to "find" my computer or link back to my machine in any way?

Improve this question

4 Answers 4

Reset to default
1

Besides the points made in other answers, you should check if the exif data of the photos you're uploading have any identifying information (geotags, names, etc). This can be done using exiftool.

As for the security risks of photo uploading, that's more of a risk to the host server than to you (as someone could upload a reverse shell).

Improve this answer
0

Yes an No.

In order to upload an image, or just browse the site in general, you need to connect to the server. That means you send some data there, and they send you a response. In order to be able to send you a response, they need to know your IP address. This isn't a security flaw, this is just how the internet works.

However, most servers don't interact with you any more than answering your requests. Your IP will probably be logged somewhere on tge server, compressed and stored on some archive server, never to be looked at again.

What about file uploads?

Generally, uploading files to a server is way more dangerous to the server than it is to you. In fact, I can't think of a single way to compromise a host by allowing them to upload a file to a server. Of course, that doesn't mean there are no ways, it just means that it isn't a common thing.

So, what now?

Running on Windows 7 is risky, and it gets riskier every day. Microsoft will no longer patch any vulnerabilities, so any possible way to hack your computer that is found tomorrow (or has already been found) will be exploitable forever.

In other words, move to an OS that actively receives security patches. Now!

Improve this answer
3
  • Realizing this is perhaps to be construed as a second 'unrelated' question in response to your last piece of advice, what OS is best in that regard? And thank you for your response to my initial question.
    – TinyOcean
    Mar 17, 2021 at 2:29
  • 2
    the best os is one that gets updates and can run the application you need well.
    – Jasen
    Mar 17, 2021 at 3:41
  • @TinyOcean I second Jasen's advice. Windows 10 is fine, so is any reputable Linux distribution or MacOS. I didn't want to start an OS war, hence why I purposefully omitted a specific OS recommendation.
    – user163495
    Mar 17, 2021 at 9:05
0

If you upload images with JFIF tags that geolocate you it may attract Theives, eg: if they know you have nice stuff and know where you live and also know you are out of town, that's a good time to take your nice stuff.

So, in brief, don't share documents that contain information that you want to keep secret.

Improve this answer
0

As others have stated the only real identifying information will be your IP address which will be a public IP address that gets assigned to you and your local network by your ISP. Without getting into the weeds here and making it more confusing, there is a specific type of protocol called NAT which stands for Network Address Translation.

So the reason I am discussing this is because NAT provides a means for your local device, whether that be your smart phone or PC(using a private IP address) to communicate over the internet(using a public IP address). The server in this instance will only see your public IP address. So the server itself does not have a way to "link" back to your device per se, however it does know the public IP address you were using to reach it just not the private/internal IP address of the sending device. Your home router is running NAT, if it weren't you wouldn't be able to communicate over the internet unless you were using IPv6.

Improve this answer
2
  • "... So the server itself does not have a way to "link" back to your device per se..." I understand the point you're trying to make, but the paired ports created for your device to traverse the NAT does indeed "link" it with the server. It's necessary to function.
    – user10216038
    Mar 17, 2021 at 20:32
  • @user10216038 In that case though the server will know the destination port that it needs to send data back to and destination public IP associated with it during the connection. We don't know if PAT is in use as well. It has a "link" back yes, there are many links back. But in my opinion that pairing of the public IP and port number isn't enough to compromise the security of the internal host, which is what OP was trying to get at I think.
    – EternalBlue
    Mar 18, 2021 at 2:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .