RE: I was auto-outed by an IMG tag in HTML spam
This can also happen with embedded tags in news messages, if you use Netscape to read news while 'autoload images' is turned on. It's an interesting form of entrapment. Peter
-----Original Message----- From: Anonymous [SMTP:anon@anon.efga.org] [Trei, Peter] [edited] They sent a message to my off-site address (along with those of other critics about whom they wanted to know more). It was an HTML message with an embedded IMG tag.
When Netscape saw that IMG tag, it happily connected to marketing's "customer" tracking server, and downloaded the keyed graphic.
My boss just let me see the log he got from the marketing VP, showing clearly that my workstation read the message.
| > -----Original Message----- | > From: Anonymous [SMTP:anon@anon.efga.org] | [Trei, Peter] [edited] | > They sent a message to my | > off-site address (along with those of other critics about whom | > they wanted to know more). It was an HTML message with an | > embedded IMG tag. | > | > When Netscape saw that IMG | > tag, it happily connected to marketing's "customer" tracking | > server, and downloaded the keyed graphic. | > | > My boss just let me see the log he got from the marketing VP, | > showing clearly that my workstation read the message. What exactly did that log say? oops.netscape.com - - [15/Feb/1998:13:55:53 +0200] "GET /sekrit/tracilords.gif" ???? Doesn't clearly show anything. Theres IPspoofing. Theres log spoofing. There's being forwarded the message by a buddy (or someone avoiding the entrapment by forwarding the mail (anonymously) to cypherpunks, thus getting hundreds of people who are totally uninvolved to see it. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume
participants (2)
-
Adam Shostack -
Trei, Peter