3

It's a serious concern that while asking questions anybody can post any link or image(may be malicious). What would happen if any user open that malicious link or image file?

So my question is : Is there any system on SE that monitors what is being posted on a site?

2 Answers 2

Reset to default
6

A post on Stack Exchange can contain a link to any website. This is no different from any other website. Like pretty much any website with externally contributed content, even if you trust the site owners, you can't trust all the contributors.

A post on Stack Exchange can embed images. Those images can be hosted on any website. Images are normally not malicious, but this could be a vector for exploits of browser bugs. Today bugs involving JavaScript are much more likely than bugs involving image parsing. Users cannot put custom JavaScript in their posts on most Stack Exchange sites. A few sites (not Security.SE) support Stack Snippets which allows posts to contain custom JavaScript code. Obviously this code is sandboxed so it shouldn't be harmful barring bugs.

Do note that Stack Exchange posts can embed images that are hosted on external servers. This doesn't make them potentially malicious, but it can be a breach of privacy. If you view a post that embeds an image that is hosted on a third-party server, then the administrator of that server will know that your IP address viewed that image on that date.

1
  • I believe there are also hypothetical anonymity issues for Tor users, since an image served on a non-standard port that only one malicious exit node allows in its policy would force the user over that exit. That makes it easier for an attacker to become the middle node and confirm they have done so to mount a guard discovery attack. My point is that there can easily be non-obvious security issues with embedded resources that relate to specific (but not uncommon) threat models.
    – forest
    May 22, 2018 at 1:48
3

There is no system that inspects links. Users must beware.

16
  • So basically we shouldn't open links?
    – daya
    May 18, 2018 at 16:35
  • Inspecting links before clicking is one of the most important and fundamental security skills on the Internet. On the desktop, you hover over the link and read the window telling you the destination. On mobile devices, you long press the link.
    – schroeder Mod
    May 18, 2018 at 16:47
  • It is really helpful, thanks.
    – daya
    May 18, 2018 at 17:15
  • @schroeder Hovering over a link is not reliable. It can be trivially spoofed using JavaScript.
    – forest
    May 21, 2018 at 1:28
  • @forest I have never seen this done in practice. And can you spoof links here in SE? Regardless, it is still the most fundamental skill that everyone should know.
    – schroeder Mod
    May 21, 2018 at 7:54
  • @schroeder I was assuming you meant in general. But yes, you can. Here, have an Apple.
    – forest
    May 22, 2018 at 0:59
  • @forest so you know any other reliable way to inspect links?
    – daya
    May 22, 2018 at 6:45
  • @forest that's punycode. And most browsers adjust for that attack. Again I ask, please provide an example of this being done "trivially" and how one can do it here on StackExchange.
    – schroeder Mod
    May 22, 2018 at 7:27
  • @daya forest gave a bad example. The methods I gave are the most reliable way without using additional tools.
    – schroeder Mod
    May 22, 2018 at 7:28
  • @schroeder Firefox still does not, and Firefox is a very common browser.
    – forest
    May 22, 2018 at 13:24
  • @forest are you still trying to push this? I said "most browsers" and FF represents only 11% of market share. You said it can be trivially spoofed with Javascript and have not responded to my request for an example. And punycode has very limited usefulness as a real threat. This fledgeling infosec student had never heard that one can inspect a link before clicking, and you walk in with a FUD gun and confuse the issue. If you are going to walk in and say that something is not 100% perfect, the least you can do is to offer something that can help people move forward.
    – schroeder Mod
    May 22, 2018 at 13:45
  • @schroeder It's only 11%? That's less than I thought. Anyways I didn't know you were asking about how it can be done with JavaScript. I thought you were asking how it can be done on SE (which is why I mentioned IDN homographs). For doing this when JS is available, see security.stackexchange.com/a/152896/165253. Of course, doing that on SE requires XSS. Without XSS, all you can do is an IDN homograph attack. I was just trying to be thorough.
    – forest
    May 22, 2018 at 13:48
  • @forest then please complete your thorough response by helping daya with the question to you on how to inspect links and steps users can take to click on links more safely. Even if it is not 100% effective.
    – schroeder Mod
    May 22, 2018 at 13:59
  • Unfortunately, there is no simple way to inspect links. On some browsers (11% is still a lot), spoofing is even harder to detect by default. Overall, I'm trying to explain that you can't reliably inspect links. You must always assume that phishing is a possible risk if you click on a user-submitted link.
    – forest
    May 22, 2018 at 14:06
  • @forest I am aware of phishing but the real threat I was worried was the fact that your machine can be compromised by just visiting the malicious site.
    – daya
    May 22, 2018 at 15:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .