You can't download this image • Hacker News Board

Re: You can't download this image

#141

Post by chunkyks » Sat, Nov 27, 2021, 10:49 PM UTC

unfocused wrote: post #100

In Chrome, you can just do as the author says, right click and "Save Image As". Then just go to the folder where it is being downloaded, and copy/paste the file "lisa.jpeg.crdownload" to "lisa.jpeg.crdownload copy". Rename to "lisa.jpeg" and cancel the download. You now have the image. What's interesting is that you ARE actually downloading this image. It's just that they don't terminate the connection.

We have a security proxy at work that gives you the bits, but then holds the connection open while it does a scan, then resets the connection if it doesn't like something inside. Both Chrome and Firefox [haven't tried IE/Edge, but I assume that they'll do something that the proxy vendor would want] infer [or are told?] that the connection broke and delete the interim file. Unfortunately, with zip files, the header is at the end; so it can't do scanning until the whole file is down.

For me, the easiest way to mitigate it turned out to be to use wget [with an appropriate user-agent... say, the same as my desktop browser]. wget Gets the bits, but doesn't in any way molest the "partial" download when the connection resets. Then it tries to download the rest using the "Range" HTTP header, and the server says "oh, dude, you already got the whole thing"; wget declares success, and all the bits are in my download folder.

I believe that we pay, like, a lot for this proxy, which is annoying on two counts: 1) If I can get past it trivially, then presumably competent attackers can, too, and 2) Sometimes it takes a dislike to legitimate stuff, which is how I was forced to learn how to get around it.

Re: You can't download this image

#142

Post by chunkyks » Sat, Nov 27, 2021, 10:51 PM UTC

lgats wrote: post #130

soheil wrote: post #123

Earlier quoted context omitted.

An image virus? Please do elaborate.

using "filename" within the "Content-Disposition" header, you could theoretically trick a user into downloading a non-image file despite the url containing lisa.jpg I think certain browsers have security limits on the file-extensions you download, which may include when image->"save as" is used.

Don't forget that you can literally concatenate jpegs and zipfiles [header at start of jpeg, but at end of zipfile], so the valid jpeg can also be a valid zipfile.

Combine that with something like Safari's insistence at automatically exploding zipfiles on download, and you got yourself a party.

Re: You can't download this image

#143

Post by hdjjhhvvhga » Sat, Nov 27, 2021, 10:52 PM UTC

ducktective wrote: post #62

hdjjhhvvhga wrote: post #41

Earlier quoted context omitted.

I hate it when people do that. You can wonder for hours why something obvious doesn't work as it should and in the end discover someone decided to implement something substandard, often for no good reason.

that's every distro and *nix derivation

Well, Windows too. I recently had to set up something simple on a Windows 10 machine, I quickly checked by tab-completion if a python binary is available so I copied by setup script only to discover someone smart decided to redirect the binary to the Windows Store. Yes, I know the rationale behind this, but still. Just like hijacking nxdomain.

Re: You can't download this image

#144

Post by marcelotournier » Sat, Nov 27, 2021, 10:52 PM UTC

iOS Safari saved the image in my photos, as any regular picture that I do a long tap on.

Re: You can't download this image

#145

Post by Andrew_nenakhov » Sat, Nov 27, 2021, 10:54 PM UTC

codesections wrote: post #138

Andrew_nenakhov wrote: post #115

Earlier quoted context omitted.

Cunningham's Law [1]: "the best way to get the right answer on the internet is not to ask a question; it's to post the wrong answer". [1]: https://meta.m.wikimedia.org/wiki/Cunningham%27s_Law

Though note that Cunningham disavows the law attributed to him: > Cunningham himself denies ownership of the law, calling it a "misquote that disproves itself by propagating through the internet." https://en.m.wikipedia.org/wiki/Ward_Cunningham

His opinion on this matter is not of any importance, as confirmed by a great many people who have found an unlikely fame. Just ask mrs. Streisand.

Re: You can't download this image

#146

Post by elorant » Sat, Nov 27, 2021, 11:02 PM UTC

Andrew_nenakhov wrote: post #115

progman32 wrote: post #110

This is a perfect (if maybe unintentional) example of how to get help from otherwise disinterested technical folk: Make an obviously technically-incorrect claim as fact, and watch as an entire army comes out of the woodwork giving you technical evaluations :)

Cunningham's Law [1]: "the best way to get the right answer on the internet is not to ask a question; it's to post the wrong answer". [1]: https://meta.m.wikimedia.org/wiki/Cunningham%27s_Law

I've tried that a gazillion times over the years. It works like a charm.

Re: You can't download this image

#147

Post by dorkwood » Sat, Nov 27, 2021, 11:07 PM UTC

alpaca128 wrote: post #129

dorkwood wrote: post #102

Earlier quoted context omitted.

Oh, you're right! I guess you'd have to disable the context menu too.

Which doesn't help either because in the Inspect view you can just click "Screenshot node" on the HTML element.

I'm learning a lot today.

Re: You can't download this image

#148

Post by ReactiveJelly » Sat, Nov 27, 2021, 11:08 PM UTC

kuroguro wrote: post #22

The problem with leaving connections open is that there's a limit on how many you can have on the server... I think the author has committed self-DoS :) https://en.wikipedia.org/wiki/Slowloris_(computer_security)

Yep. Although with the right language, even on cheap hardware, that limit might be 1,000 or so.

Re: You can't download this image

#149

Post by dillondoyle » Sat, Nov 27, 2021, 11:09 PM UTC

brodock wrote: post #126

dillondoyle wrote: post #111

Another idea is canvas: https://jsfiddle.net/dvg45pcz/ But I don't know how to get it to not appear in network sources. Or wasm but I don't know how to write that.

You could likely pack.and unpack from websockets...

that's a great idea. * i also thought could just load a jsonp file with the string in it but no matter what, maybe can't get around it, when i put the string as image.src = '' it puts it into chrome network under media

Re: You can't download this image

#150

Post by dillondoyle » Sat, Nov 27, 2021, 11:10 PM UTC

cmaggiulli wrote: post #128

dillondoyle wrote: post #111

Another idea is canvas: https://jsfiddle.net/dvg45pcz/ But I don't know how to get it to not appear in network sources. Or wasm but I don't know how to write that.

Does WebRTC show in the network console?

that's a great idea. found this sounds like chrome has a not great way https://stackoverflow.com/questions/17530197/how-to-do-netwo...