Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can't download this image

youcantdownloadthisimage.online

Post reply on HN
Print view View original

191–200 of 241 posts

Re: You can't download this image

#191

Post by Meph504 »

ravenstine wrote: post #92

There's another way to achieve this in a more malicious way. Granted I haven't tried it in years, but it was possible back in 2017 when I tested it. The idea is to fake the image that's being displayed in the IMG element by forcing it to show a `background-image` using `height: 0;` and `padding-top`. In theory, you could make an IMG element show a photo of puppies and if the person chose to Right-click > Save Image A…

You could also just do like we did for years and check the refer for the image request, and if it wasn't your web server you redirect the file to whatever you want, the end user has know what of knowing. and because the trick is done on the server side then viewing your source won't get around it.

This is the same method used to prevent hot linking to images back in the day.

Re: You can't download this image

#192

Post by ravenstine »

jffry wrote: post #173
ravenstine wrote: post #92

There's another way to achieve this in a more malicious way. Granted I haven't tried it in years, but it was possible back in 2017 when I tested it. The idea is to fake the image that's being displayed in the IMG element by forcing it to show a `background-image` using `height: 0;` and `padding-top`. In theory, you could make an IMG element show a photo of puppies and if the person chose to Right-click > Save Image A…

Yes, this still works just fine! https://gist.github.com/jffry/8906d4fec025c564c7b396324bedaa...

Never gonna give you up...

Re: You can't download this image

#194

Post by rad_gruchalski »

gipp wrote: post #83
stiray wrote: post #51

Earlier quoted context omitted.

I have problem understanding what problem is this solving? When the image is on my screen I can just screenshot it. This is a common problem, using something in insecure environment, thats why companies are going into such extents to encrypt movies on whole train from source to the display and even those are regularly dumped.

It's not "solving" anything, just demonstrating an interesting gimmick

What’s the gimmick because I just save that image to photos on iOS?

Re: You can't download this image

#195

Post by soheil »

Moru wrote: post #155
soheil wrote: post #123

Earlier quoted context omitted.

An image virus? Please do elaborate.

"Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)" [0] [0] https://docs.microsoft.com/en-us/security-updates/SecurityBu...

It's bizarre to claim image viruses exist today when you link to a nearly 20 year old article about a buggy OS.

Re: You can't download this image

#196

Post by kevin_thibedeau »

Andrew_nenakhov wrote: post #115
progman32 wrote: post #110

This is a perfect (if maybe unintentional) example of how to get help from otherwise disinterested technical folk: Make an obviously technically-incorrect claim as fact, and watch as an entire army comes out of the woodwork giving you technical evaluations :)

Cunningham's Law [1]: "the best way to get the right answer on the internet is not to ask a question; it's to post the wrong answer". [1]: https://meta.m.wikimedia.org/wiki/Cunningham%27s_Law

With Google search so broken sometimes the only way to discover things is through nerd baiting.

Re: You can't download this image

#197

Post by bentcorner »

jcims wrote: post #189
chunkyks wrote: post #141

Earlier quoted context omitted.

We have a security proxy at work that gives you the bits, but then holds the connection open while it does a scan, then resets the connection if it doesn't like something inside. Both Chrome and Firefox [haven't tried IE/Edge, but I assume that they'll do something that the proxy vendor would want] infer [or are told?] that the connection broke and delete the interim file. Unfortunately, with zip files, the header is…

Those controls on a proxy are to protect against the careless and the clueless. No competent security team will rely on them to prevent ingress/egress of data or malicious code by skilled individuals.

Correct - this is an attack on the other side of the airtight hatchway (i.e., you must persuade the user to run wget in a certain fashion and run the resulting exe, and if you don't need to persuade the user you could have done something simpler).

https://devblogs.microsoft.com/oldnewthing/20170130-00/?p=95...

Re: You can't download this image

#199

Post by LordDragonfang »

Fnoord wrote: post #178
unfocused wrote: post #100

In Chrome, you can just do as the author says, right click and "Save Image As". Then just go to the folder where it is being downloaded, and copy/paste the file "lisa.jpeg.crdownload" to "lisa.jpeg.crdownload copy". Rename to "lisa.jpeg" and cancel the download. You now have the image. What's interesting is that you ARE actually downloading this image. It's just that they don't terminate the connection.

Whatever your browser shows, is shown from cache. So the picture should be in your cache, too.

(Most) browsers actually start displaying an image before it's fully downloaded. In fact, many image formats/renderers are specifically designed with this property in mind, like jpeg which will render progressively less blurry versions of an image as the browser receives progressively higher-frequency components of the Fourier transform.

While the bytes are there temporarily, just like with all the other methods discussed, chrome at least eventually give up on downloading the "whole" image and displays a broken image sign in place of the Mona Lisa (and presumably prevents it from being cached and deletes what was there)

Re: You can't download this image

#200

Post by Moru »

soheil wrote: post #195
Moru wrote: post #155

Earlier quoted context omitted.

"Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)" [0] [0] https://docs.microsoft.com/en-us/security-updates/SecurityBu...

It's bizarre to claim image viruses exist today when you link to a nearly 20 year old article about a buggy OS.

If it happened in the worlds most used client OS 20 years ago, it's clearly not impossible it can happen again. Not that much has happened with computers since then.

I remember being like you, believing no virus could come from an image or other data. I have been proven wrong enough times since then. We keep assuming things as programmers and sometimes we get it wrong and then there is a new wulnerability.

Post reply on HN