river582 Posted September 23, 2015 ID:991757 Share Posted September 23, 2015 Malwarebytes has recently started to block Imgur when I try to access it. Imgur was exploited and fixed yesterday but why would it block it today? The exploit is fixed. Link to post Share on other sites More sharing options...
MysteryFCM Posted September 23, 2015 ID:991758 Share Posted September 23, 2015 It's blocked because the root cause of their issues has yet to be identified and resolved. Once this happens and is confirmed, the block will be removed. Link to post Share on other sites More sharing options...
Mashiki Posted September 23, 2015 ID:991760 Share Posted September 23, 2015 It's blocked because the root cause of their issues has yet to be identified and resolved. Once this happens and is confirmed, the block will be removed.It was fixed yesterday FYI. http://imgur.com/blog/2015/09/22/imgur-vulnerability-patched/ What's interesting about it though, is that users need to do a full cleanup of the locally stored data. Since it can still sit live on their machines and still send out information. This is from one of the threads over on reddit about it: Anyhow, I've been following this breach as it's developed over the night and was active in the threads on /g/ decompiling the code. I'm sure there are better explanations in the main thread, but here's a rough rundown on how the breach worked.Thanks to a security hole in imgur involving MIME magic, the hacker can inject JS. (Basically, thanks to imgur's code that lets you link to GIF's as PNG's, your browser renders an invisible HTML file containing your image and some invisible JS without telling you) The JS loads an iframe from 8chan, acting as part of a ddos. The iframe contains a Flash file. Flash can create and modify local storage for 8Chan, even if you've never visited it. It then flags the rest of the malicious file as a "favorite". (Because the hacker was a chan lurker, the file also contained easter eggs like dancing pokémon and a private key containing the string imsorrybrennan) The JS then causes your browser to ping 8Chan. 8Chan loads the content of your "favorites" on the page, no sanitization at all. This lets a div containing a script tag finish executing the JS. The JS then pings 8ch.pw, the hacker's domain, (not 8Chan) which can serve it any JS payload it wants. The JS then lies dormant in your local storage until it receives a go code, or a self destruct code that causes it to be replaced with another payload from 8ch.pw. 6A. The sheer amount of traffic this generated for 8Chan's servers also acts as a DDoS, just as a bonus!It goes without saying that you NEED to clear your local storage if you've been on imgur. Open your browser console (while on imgur, thanks, /u/powerpiglet!) and enter localStorage.clear(). (EDIT: this may not work for some reason, see /u/lucben999's comment for a fix.) Since imgur is safe now, you should be OK. Until you do, attackers could be using your computer to:Transmit your passwords to attackersBecome a piece of a giant DDoSConstantly load ads that pay attackersRequest edgelord-tier child pornography from a honeypot without your knowledgeIf you have any questions about the specifics of the attack, please ask me! I love netsec and this breach is like a great white whale. Link to post Share on other sites More sharing options...
MysteryFCM Posted September 23, 2015 ID:991763 Share Posted September 23, 2015 I'm aware of what happened and how The fact this specific "exploit" has been resolved however, is irrelevant - the root cause that allowed this remains to be identified and resolved, and that is the issue. Link to post Share on other sites More sharing options...
Hawkzon Posted September 23, 2015 ID:991777 Share Posted September 23, 2015 I came by because Reddit keeps showing malicious website for imgur.Now, what do I need to do about it? I don't belong to imgur and only see it when I'm on Reddit.thank you. Link to post Share on other sites More sharing options...
Jaldy Posted September 23, 2015 ID:991782 Share Posted September 23, 2015 While I (or the staff, likely) don't recommend doing it, you can always add it to the exclusions list if you must. But I'm going to trust Malwarebytes on this one and just stay away from imgur/reddit until it's resolved. Link to post Share on other sites More sharing options...
miguelgrado Posted September 23, 2015 ID:991789 Share Posted September 23, 2015 When will be solved?Or should I do something not lock me out? Thanks Link to post Share on other sites More sharing options...
Edisun Posted September 23, 2015 ID:991813 Share Posted September 23, 2015 We just posted a blog about this topic that gives all the information we currently have. We will keep it updated: https://blog.malwarebytes.org/hacking-2/2015/09/imgur-abused-in-ddos-attack-against-4chan/ Link to post Share on other sites More sharing options...
gerik Posted September 23, 2015 ID:991853 Share Posted September 23, 2015 So I just wanted to ask a question of clarification concerning this breach. From what I'm understanding it used a javascript exploit to accomplish this. Is this something that Malwarebytes Anti-Exploit would have blocked? And if so, if we never received a message that an exploit had been stopped we should be safe? Link to post Share on other sites More sharing options...
Recommended Posts