3

It's a serious concern that while asking questions anybody can post any link or image(may be malicious). What would happen if any user open that malicious link or image file?

So my question is : Is there any system on SE that monitors what is being posted on a site?

7

A post on Stack Exchange can contain a link to any website. This is no different from any other website. Like pretty much any website with externally contributed content, even if you trust the site owners, you can't trust all the contributors.

A post on Stack Exchange can embed images. Those images can be hosted on any website. Images are normally not malicious, but this could be a vector for exploits of browser bugs. Today bugs involving JavaScript are much more likely than bugs involving image parsing. Users cannot put custom JavaScript in their posts on most Stack Exchange sites. A few sites (not Security.SE) support Stack Snippets which allows posts to contain custom JavaScript code. Obviously this code is sandboxed so it shouldn't be harmful barring bugs.

Do note that Stack Exchange posts can embed images that are hosted on external servers. This doesn't make them potentially malicious, but it can be a breach of privacy. If you view a post that embeds an image that is hosted on a third-party server, then the administrator of that server will know that your IP address viewed that image on that date.

  • I believe there are also hypothetical anonymity issues for Tor users, since an image served on a non-standard port that only one malicious exit node allows in its policy would force the user over that exit. That makes it easier for an attacker to become the middle node and confirm they have done so to mount a guard discovery attack. My point is that there can easily be non-obvious security issues with embedded resources that relate to specific (but not uncommon) threat models. – forest May 22 '18 at 1:48
3

There is no system that inspects links. Users must beware.

  • So basically we shouldn't open links? – daya May 18 '18 at 16:35
  • Inspecting links before clicking is one of the most important and fundamental security skills on the Internet. On the desktop, you hover over the link and read the window telling you the destination. On mobile devices, you long press the link. – schroeder May 18 '18 at 16:47
  • It is really helpful, thanks. – daya May 18 '18 at 17:15
  • @schroeder Hovering over a link is not reliable. It can be trivially spoofed using JavaScript. – forest May 21 '18 at 1:28
  • @forest I have never seen this done in practice. And can you spoof links here in SE? Regardless, it is still the most fundamental skill that everyone should know. – schroeder May 21 '18 at 7:54
  • @schroeder I was assuming you meant in general. But yes, you can. Here, have an Apple. – forest May 22 '18 at 0:59
  • @forest so you know any other reliable way to inspect links? – daya May 22 '18 at 6:45
  • @forest that's punycode. And most browsers adjust for that attack. Again I ask, please provide an example of this being done "trivially" and how one can do it here on StackExchange. – schroeder May 22 '18 at 7:27
  • @daya forest gave a bad example. The methods I gave are the most reliable way without using additional tools. – schroeder May 22 '18 at 7:28
  • @schroeder Firefox still does not, and Firefox is a very common browser. – forest May 22 '18 at 13:24
  • @forest are you still trying to push this? I said "most browsers" and FF represents only 11% of market share. You said it can be trivially spoofed with Javascript and have not responded to my request for an example. And punycode has very limited usefulness as a real threat. This fledgeling infosec student had never heard that one can inspect a link before clicking, and you walk in with a FUD gun and confuse the issue. If you are going to walk in and say that something is not 100% perfect, the least you can do is to offer something that can help people move forward. – schroeder May 22 '18 at 13:45
  • @schroeder It's only 11%? That's less than I thought. Anyways I didn't know you were asking about how it can be done with JavaScript. I thought you were asking how it can be done on SE (which is why I mentioned IDN homographs). For doing this when JS is available, see security.stackexchange.com/a/152896/165253. Of course, doing that on SE requires XSS. Without XSS, all you can do is an IDN homograph attack. I was just trying to be thorough. – forest May 22 '18 at 13:48
  • @forest then please complete your thorough response by helping daya with the question to you on how to inspect links and steps users can take to click on links more safely. Even if it is not 100% effective. – schroeder May 22 '18 at 13:59
  • Unfortunately, there is no simple way to inspect links. On some browsers (11% is still a lot), spoofing is even harder to detect by default. Overall, I'm trying to explain that you can't reliably inspect links. You must always assume that phishing is a possible risk if you click on a user-submitted link. – forest May 22 '18 at 14:06
  • @forest I am aware of phishing but the real threat I was worried was the fact that your machine can be compromised by just visiting the malicious site. – daya May 22 '18 at 15:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .