-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The system could use a locally cached image which may actually improve
performance. The retrieval command would do the sanitization and other
checks before caching.
There may be some problems with people who are trying to change an image
to get it "just right". It won't be displayed until the cached copy is
expired. Some more coding could work around this.
Tony Stahler wrote:
If you wanted to use the script to check it, yet not have to retrieve
the image every time you could have your server download the image
during the post request (assuming it was a reasonable size..) ... check
it, and then have the link be local from that point onward.
This would open more possibilities for exploitation as far as denial of
service attacks though (if your server is downloading it each time, or
if it downloads it once), both for your server and for the server you're
requesting it from.
An example: I sign up for a bunch of accounts on one forum, or even
multiple forums using this software - then have all the accounts post at
the same time, with multiple images from the same site... the server(s)
then effectively (D)DOS the target server.
It would also work against your server, but in reverse, using a bunch
of accounts (through proxies if necessary) and requesting as many images
from fast servers as possible..
You'd probably be better off just deciding which image file types you
consider safe for users... i.e. you probably don't want to allow
flash... and only allow images with those extensions. Making sure
images are safe isn't really you're responsibility, it's the
responsibility of the image standard, and the browser displaying the
information.
Just my thoughts,
Tony
Paul Laudanski <zx@castlecops.com> 08/22/05 11:12PM >>>
On Mon, 22 Aug 2005, Christopher Kunz wrote:
Or, you could just disallow remote images altogether. It kinda boils
down to a
security vs. feature set question...
This is very interesting indeed. I was originally approaching this
'problem' from a strictly local host perspective (where the website
resides) rather than from a remote attack.
You're reply set me straight on that one.
There ought to be a more creative way to monitor this stuff than just
moving it from GET to POST (and POST in itself is not fool proof).
I'm going to munch on this.
Paul
http://castlecops.com
________ Information from Computer Cops, L.L.C. ________
This message was checked by NOD32 Antivirus System for Linux Mail
Server.
part000.txt - is OK
http://castlecops.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFDEKQ+vE+JJ/srsxoRAtfJAKDImN8lLXHds819Vk3LnVd3H8JSVwCgvSK2
HJYnXmdZIWuqJXQ9XmEFjac=
=gOkT
-----END PGP SIGNATURE-----
