For those not familiar, there are numerous messages containing images being repeatedly spammed to many Threadiverse users talking about a Polish girl named “Nicole”. This has been ongoing for some time now.
Lemmy permits external inline image references to be embedded in messages. This means that if a unique image URL or set of image URLs are sent to each user, it’s possible to log the IP addresses that fetch these images; by analyzing the log, one can determine the IP address that a user has.
In some earlier discussion, someone had claimed that local lemmy instances cache these on their local pict-rs instance and rewrite messages to reference the local image.
It does appear that there is a closed issue on the lemmy issue tracker referencing such a deanonymization attack:
https://github.com/LemmyNet/lemmy/issues/1036
I had not looked into these earlier, but it looks like such rewriting and caching intending to avoid this attack is not occurring, at least on my home instance. I hadn’t looked until the most-recent message, but the image embedded here is indeed remote:
https://lemmy.doesnotexist.club/pictrs/image/323899d9-79dd-4670-8cf9-f6d008c37e79.png
I haven’t stored and looked through a list of these, but as I recall, the user sending them is bouncing around different instances. They certainly are not using the same hostname for their lemmy instance as the pict-rs instance; this message was sent from nicole92 on lemmy.latinlok.com, though the image is hosted on lemmy.doesnotexist.club. I don’t know whether they are moving around where the pict-rs instance is located from message to message. If not, it might be possible to block the pict-rs instance in your browser. That will only be a temporary fix, since I see no reason that they couldn’t also be moving the hostname on the pict-rs instance.
Another mitigation would be to route one’s client software or browser through a VPN.
I don’t know if there are admins working on addressing the issue; I’d assume so, but I wanted to at least mention that there might be privacy implications to other users.
In any event, regardless of whether the “Nicole” spammer is aiming to deanonymize users, as things stand, it does appear that someone could do so.
My own take is that the best fix here on the lemmy-and-other-Threadiverse-software-side would be to disable inline images in messages. Someone who wants to reference an image can always link to an external image in a messages, and permit a user to click through. But if remote inline image references can be used, there’s no great way to prevent a user’s IP address from being exposed.
If anyone has other suggestions to mitigate this (maybe a Greasemonkey snippet to require a click to load inline images as a patch for the lemmy Web UI?), I’m all ears.
Wait, I’m not the only one who received these strange messages from Nicole? Good thing I ignored them.
That would require cooperation with the servers/dns involved. Though, it would be easy to disprove if people are getting identical image URLs… we should test that!
Good luck, my IP consistently points to an entirely another city.
Sure, but if you also logged into Facebook from that IP it’s a pretty simple match up.
Yeah, I get it (barring the fact that literal Facebook is not even accessible from my IP lol). But whether this is useful, depends on who the attacker is. If we’re talking about, say, a data broker - yeah. But would Jake from accounting have such “IP-account” logs?
Stop using fascist platforms.
That is not my point at all. What I meant is the geographical region of your IP has no bearing on your privacy. It doesn’t matter if you connect to the tor network through a VPN, if you’re just gonna end up logging into accounts or act in manners that a data broker already has connected to you.
Not using fascist platforms like Facebook and X also helps protects your privacy. I’m not disagreeing with you.
deleted by creator
My money says it’s Russia trying to find potential political adversaries (people who don’t agree with them)
Doed anyone know if Nicole has introduced herself to lemmygrad?
Good luck doing that in Portugal the ips are all dynamic here
deleted by creator
We used to do this on the EVE online forums until CCP caught on and banned inline images.
“Man, everyone is on planet earth. How boring”
We were using the IPs and post times to identify accounts, then checking IPs that connected to our VOIP servers so we could identify spies and either remove them or feed them false intel.
Basic counter-intel work and all for a video game heh.
Jesus i miss that time , counter intel was so easy back then
This sounds super cool and interesting, is there like a wiki I can read up about that stuff??
theres a whole documentary about it on youtube, check out the “down the rabbit hole” channel
its very long.
Ty :)
spy
rho s quad best quad
Some days, I am tempted to go back to playing eve. Ive got some good memories.
Interesting hypothesis.
Yes, especially because many Lemmy users have some radical views.
!dull_mens_club@lemmy.world and !dullsters@dullsters.net are at the top of the list.
For real, totally tubular 🤙
Soo pitted
Yup. Especially with digital watermarking by modifying a pixel here or there - something you’d naturally need a computer to detect.
You don’t need digital watermarking got for this. Just host the image at different URLs. evil.lemmy.org/nicole-mbystander.png and evil.lemmy.org/nicole-forrgott.png. (Really you’d use a random string and save in a database.) Then see what IP requests the -mbystander version and which the -forrgottt version, and you have our IP addresses.
Ummm, yeah. What he said.
Lol, though. Just that it’s so, well, me to overthink it! 🤣 But yeah, your idea is so much easier to implement. Just for starters 😝
Steganography. Good point.
( This is how a lot of modern information caches have been dropped too: you can put entire documents in a few pixels. Steganography is just the act of hiding something inside another object. It’s an older spy technique than classic cryptography )
i think so too. And even if they wouldnt be doing this, we should still treat it as if they are and fix the problem of it being even possible to gather information about users using 0-click methods like this.
Might be good to think about fediverse security similar to email security, as they are both federated information sharing systems. Email has spam blocking, allowing for reputation checks and other complex stuff. I wonder if Lemmy instances could collaborate on a SpamHaus type of bad host / bad user list to use and share.
SpamHaus type of bad host
That already kinda exists: https://gui.fediseer.com/
Cool, I hadn’t heard of that. So instance admins can access their lists via API I see. Should be possible to “spam filter” federations that way at least.
Maybe this stuff can be expanded to include a spam list of bad users and links too, for Lemmy servers to parse via API and block.
iCloud Private Relay and similar relay services should also protect against IP tracking.
PSA: check your private relay settings if you haven’t in a while
Mine was on but set to “maintain general area” so local content works.
I’ve been blocking and reporting these nicole accounts as spam bots lately. I hope this doesn’t become as bad as the spam bots in the YT comments.
On my instance (.ml) all of the images are fetched through the image proxy.
What version of lemmy is your instance running?
0.19.6. Could be that there’s some configuration option.
A while back someone mentioned something similar would be possible and as a proof of concept linked to an image that would generate on the fly to include your location.
I miss those old images that would show you your IP address and ISP name, which were generated dynamically based on the request. They were designed just to be a bit frightening. But, because they were rendered on the server side, there was definitely nothing stopping them from recording your IP address too.
In July there were a couple of posts like that here
