For those not familiar, there are numerous messages containing images being repeatedly spammed to many Threadiverse users talking about a Polish girl named "Nicole". This has been ongoing for some time now.

Lemmy permits external inline image references to be embedded in messages. This means that if a unique image URL or set of image URLs are sent to each user, it's possible to log the IP addresses that fetch these images; by analyzing the log, one can determine the IP address that a user has.

In some earlier discussion, someone had claimed that local lemmy instances cache these on their local pict-rs instance and rewrite messages to reference the local image.

It does appear that there is a closed issue on the lemmy issue tracker referencing such a deanonymization attack:

https://github.com/LemmyNet/lemmy/issues/1036

I had not looked into these earlier, but it looks like such rewriting and caching intending to avoid this attack is not occurring, at least on my home instance. I hadn't looked until the most-recent message, but the image embedded here is indeed remote:

https://lemmy.doesnotexist.club/pictrs/image/323899d9-79dd-4670-8cf9-f6d008c37e79.png

I haven't stored and looked through a list of these, but as I recall, the user sending them is bouncing around different instances. They certainly are not using the same hostname for their lemmy instance as the pict-rs instance; this message was sent from nicole92 on lemmy.latinlok.com, though the image is hosted on lemmy.doesnotexist.club. I don't know whether they are moving around where the pict-rs instance is located from message to message. If not, it might be possible to block the pict-rs instance in your browser. That will only be a temporary fix, since I see no reason that they couldn't also be moving the hostname on the pict-rs instance.

Another mitigation would be to route one's client software or browser through a VPN.

I don't know if there are admins working on addressing the issue; I'd assume so, but I wanted to at least mention that there might be privacy implications to other users.

In any event, regardless of whether the "Nicole" spammer is aiming to deanonymize users, as things stand, it does appear that someone could do so.

My own take is that the best fix here on the lemmy-and-other-Threadiverse-software-side would be to disable inline images in messages. Someone who wants to reference an image can always link to an external image in a messages, and permit a user to click through. But if remote inline image references can be used, there's no great way to prevent a user's IP address from being exposed.

If anyone has other suggestions to mitigate this (maybe a Greasemonkey snippet to require a click to load inline images as a patch for the lemmy Web UI?), I'm all ears.

top 50 comments

sorted by: hot top controversial new old

[–] ptz@dubvee.org 105 points 1 week ago* (last edited 1 week ago) (1 children)

If anyone has other suggestions to mitigate this (maybe a Greasemonkey snippet to require a click to load inline images as a patch for the lemmy Web UI?), I'm all ears.

Tesseract dev here.

For what it's worth, I went back through and checked my DMs from "Nicole" and they're all uploads directly to the home instance the DM came from (e.g. they went through pict-rs, and only the instance admins would be able to see the client IPs in their access logs). So, this doesn't seem like a de-anonymization attack, though all it would take is "Nicole" to start hosting the images somewhere they control to achieve that effect.

Safety Precautions Available in Tesseract

Use Tesseract's Image Proxy

It has the ability to proxy images (separately / better than the Lemmy built-in method) both local and remote (e.g. to outside image hosts). The hosted instance (tesseract.dubvee.org) has that enabled but each user must enable it in settings (Settings --> Media -> Proxy Images).

For Tesseract installs run by other instances, it would need the server-side component enabled by the instance admins before the user setting will show up to be enabled by the user.

If you see the "Proxy Images" options in Settings -> Media, then the admins have enabled the server-side component. If not, you'll need to ask the admins to configure/enable media proxying. If you're self-hosting it, then it may not provide any additional privacy unless you're running it in a cloud server or somewhere other than where you're accessing it.

collapsed inline media

Disable Inline Images

It also has the option to disable inline images (Settings -> Post and Comments -> Inline Images). I've confirmed this also works for DMs. With inline images disabled, instead of the image, the alt text, if available, will be linked to the image. If no alt text, then the image URL will be a clickable link. In either case, clicking the image link will load it in a modal on-demand.

Coming Soon (Released Just Now in 1.4.32)

After reading this post, as a precaution, I'm going to push out a hotfix (hopefully this evening) that will disable inline images in DMs by default. If someone you trust DMs you, you can just click on the image link to view it in a modal (like any other link preview).

Testing this feature now and should have it released this evening. Works like email clients when you disable inline images; a button/switch will appear at the top if it detects there are images / media embedded which will allow you to show the images; defaults to off.

collapsed inline media

Tesseract DM view with inline images disabled by default

collapsed inline media

Tesseract DM view with inline images enabled per-message

[–] SidewaysHighways@lemmy.world 23 points 1 week ago (1 children)

thanks for your time and effort!

[–] ptz@dubvee.org 21 points 1 week ago (2 children)

Not to be snarky (ok, a little snarky lol), but I don't see the Lemmy devs stepping up to do anything about this. Still can't even delete DMs.

[–] Jakeroxs@sh.itjust.works 5 points 1 week ago (1 children)

You could contribute upstream

[–] ptz@dubvee.org 18 points 1 week ago (3 children)

I have absolutely no desire to use or learn Rust and even less desire to deal with those devs.

[–] rozlav@lemmy.blahaj.zone 4 points 1 week ago (2 children)

Those devs meaning ? If there are any issues or links that can make me understand this I would like to know thank you (o･ω･o)

[–] ptz@dubvee.org 7 points 1 week ago* (last edited 1 week ago)

It's a long history of Github, Lemmy, and admin chat interactions that culminate in my desire to never willingly interact with them again. It's just too much and too off-topic to post here.

load more comments (1 replies)

load more comments (2 replies)

[–] wjs018@piefed.social 4 points 1 week ago (1 children)

Wow, I hadn't realized until you pointed it out that you can't delete pm's (I guess without getting admins to fiddle with the db). I still use my lemmy account to moderate some lemmy communities, but I am appreciating using piefed as my threadiverse consumption platform more and more.

[–] ptz@dubvee.org 3 points 1 week ago

Yeah, I'm actually planning to see about trying to migrate from Lemmy to Piefed (as an instance). Rimu said it's technically possible but will need some manual work to ETL the data over. Hoping to start poking around and making some attempts soon-ish. Right now, still just doing my homework and familiarizing myself with Piefed.

[–] Nougat@fedia.io 62 points 1 week ago

The one I got earlier today pleaded:

My dad just lost his job and I have no money for tuition next semester. Please help me raise money so I can keep going to school! Donate anything you can to these bitcoin and litecoin addresses <3

I don't think it's anything more complicated than trying to scam money from people.

[–] comfy@lemmy.ml 21 points 1 week ago

GOOD LUCK WITH THAT IM BEHIND SEVEN PROXIES

[–] SkaveRat@discuss.tchncs.de 20 points 1 week ago

fwiw I got the exact image URL in a DM a couple minutes ago. so at least they are not mapping the uuid of the image to a DMd fedi user

[–] scutiger@lemmy.world 15 points 1 week ago

I've received 4 of them so far, and the images were hosted on lemmy, including reputable instances, but never on the same instance as the message itself came from.

[–] prole@lemmy.blahaj.zone 14 points 1 week ago (1 children)

Thanks, i just doubled checked to make sure my VPN was on for my phone as well... I got fourteen of them today. That's... Weird.

[–] limer@lemmy.dbzer0.com 6 points 1 week ago

Sounds more like a self replicating malware somewhere, probably in some totally unrelated Wordpress plugin on unrelated sites scattered about

[–] 0101100101@programming.dev 14 points 1 week ago

Good stuff. I always thought the image was being used in a nefarious way but haven't had time to investigate

[–] hendrik@palaver.p3x.de 11 points 1 week ago (9 children)

I wonder what the use case is for gathering IP addresses of random internet connections.

[–] FundMECFSResearch@lemmy.blahaj.zone 17 points 1 week ago (2 children)

IP address is often enough to link data to a profile for data brokers. And Lemmy has so much valuable data, not only in posts or comments, but upvotes and downvotes etc. This could be someone making bank of selling data.

[Though other people investigating the url seem to be pretty sure the images don’t have a per user url, so this theory probably doesn’t hold]

[–] hendrik@palaver.p3x.de 5 points 1 week ago (7 children)

I mean for most users worldwide, the IP changes every 24h or so, maybe every few days. So I doubt it's of great value unless you have access to another big database of current logins to match this against. And if you already have that database, I don't see the value of recording the IP again. Only added info is that the user uses Lemmy, if there isn't any identifier in the image URL.

[–] bizarroland@fedia.io 13 points 1 week ago (1 children)

I wouldn't necessarily trust that. I have used Xfinity for a long time and my IP address often went months without changing.

[–] hendrik@palaver.p3x.de 4 points 1 week ago

Yeah, I heard it's different with some providers in north america. But then again, it's not very straightforward to track which IPs belong to which provider, in which timespans they get renewed and then match that to other info.

[–] FundMECFSResearch@lemmy.blahaj.zone 4 points 1 week ago (1 children)

If that were true in general, wikipedia would not bother blocking IPs.

load more comments (1 replies)

[–] OpenStars@piefed.social 4 points 1 week ago (3 children)

Could it potentially be enough to find location - like even if not city, then state or at least country?

And ofc not just these Nicole pics, but any pics at all, across the entire Fediverse. Worse, upload it via posting to a small community with like 5-10 subscribers and get the IPs of all of those who see the content (by downloading the image from your self-hosted server), then correlate with comments in it to map to usernames (I mean narrow down the list to those 5-10 accounts).

I suppose it is fortunate that there aren't any totalitarian regimes anywhere in the world that might be interested in keeping tabs on who isn't using corporate enshittified platforms... Like surely Musk won't deny visas to people in the USA who use Lemmy, r-r-right!?!? (Or deny employment even to people working for corporations that even so much as have a contract with the USA government, regardless of whether the person in question is actually working on it or not, or are even aware that their company has such contracts at all?).

I think we may need to expect the worst, moving forward, then be pleasantly surprised if it doesn't happen, rather than 100% count on the best happen for certain, like our very lives depended upon it.

@rimu@piefed.social how does PieFed fare in this regard?

[–] hendrik@palaver.p3x.de 2 points 1 week ago* (last edited 1 week ago)

Location would be possible. For me it's a few 100km off, but usually the GeoIP databases are more accurate.

Piefed doesn't do much image caching or proxying. It only keeps thumbnails around. Once you open a post with more than a thumbnail in it (a full picture), your IP is revealed to the image hoster.

load more comments (2 replies)

load more comments (4 replies)

load more comments (1 replies)

load more comments (8 replies)

[–] Kolanaki@pawb.social 10 points 1 week ago (1 children)

If all they can get is an IP address I don't know why they need this ruse or what good it would do. Very few people are going to be coming from an IP that resolves to their actual residency, even if they're not using VPNs or proxies.

[–] bane_killgrind@slrpnk.net 7 points 1 week ago

The more normies start using this, the more default config/ old as dirt routers will have some exploitable thing.

More than 10 years ago, I logged into the router of some guy on IRC and changed his pppoe username and password to 'pleaseinvestigateme 'iamapedophile' or something.

The IP he connected from was his home network, the router had default username and password. He disconnected when I hit save.

The guy was a pedo, fyi. Or trolling by saying he was.

[–] SparrowHawk@feddit.it 9 points 1 week ago

It's definetely something shady, someone is planning bad stuff for the fediverse

[–] JPAKx4@lemmy.blahaj.zone 7 points 1 week ago (1 children)

Here is the URL of the one I was sent: https://lemmy.doesnotexist.club/pictrs/image/44f99f51-2ae9-49b0-b0c8-4ae4cb989690.png

It's potentially unique and not from a service by my instance or imgur, so the attack is feasible.

[–] randombullet@programming.dev 5 points 1 week ago

Same url as mine

https://lemmy.doesnotexist.club/pictrs/image/44f99f51-2ae9-49b0-b0c8-4ae4cb989690.png

[–] land@lemmy.ml 7 points 1 week ago (1 children)

I received two messages. The first one was on March 3rd, and the second one was on March 8th. I also received one a few months ago.

[–] FundMECFSResearch@lemmy.blahaj.zone 4 points 1 week ago (2 children)

I’ve recieved about 8 messages over the past few months.

[–] SharkAttak@kbin.melroy.org 4 points 1 week ago (1 children)

She really wants you bro

load more comments (1 replies)

[–] land@lemmy.ml 3 points 1 week ago

Dayummmm

[–] gandalf_der_12te@discuss.tchncs.de 7 points 1 week ago

yeah it could well be that something shady is going on here. maybe it would be a good idea to limit how many messages a user account may send to, let's say, 500 or sth.

that would make these scams/ads less doable.

[–] sunzu2@thebrainbin.org 6 points 1 week ago (1 children)

Does each message get a unique URL for the photos?

[–] tfm@europe.pub 6 points 1 week ago (1 children)

Apparently not https://europe.pub/comment/40270

[–] sunzu2@thebrainbin.org 4 points 1 week ago (1 children)

Right then I am not following how it would be possible to de anon anyone.

At best the threat actors gets a list of IPs that opened its message with out being able to link to specific message send.

What am I missing here?

[–] tfm@europe.pub 2 points 1 week ago

That's the big question. But it looks intentional.

[–] blazeknave@lemmy.world 6 points 1 week ago

Has anyone raised the argument that the "plus" of Lemmy being public and detailed to the vote and forever, is a "negative"?

[–] RangerJosey@lemmy.ml 6 points 1 week ago (2 children)

I got such a message but didn't reply. Seemed like a bot to me.

[–] SkaveRat@discuss.tchncs.de 16 points 1 week ago (3 children)

the problem with this potential issue (if it indeed is one) is, that you don't need to reply. just opening the DM is enough

[–] sunzu2@thebrainbin.org 2 points 1 week ago (2 children)

Yeah threat actor gets your IP but if you are not on VPN that's kinda bad but it doesn't link that IP to any specific account?

This is the same risk when using any internet with no condom on

load more comments (2 replies)

[–] tfm@europe.pub 10 points 1 week ago

These are phishing bots. Never interact with them.

[–] Lost_My_Mind@lemmy.world 5 points 1 week ago (3 children)

Me: reads entire post

I have no idea what's being discussed here. Are you saying they're stealing your bank account numbers?

[–] tfm@europe.pub 18 points 1 week ago

When the image of "Nicole" is loaded, your computer/phone connects to another server and transfers your IP address. But it currently looks like it's not that big of a problem. Still a fix will be implemented soon to prevent this.

load more comments (2 replies)

[–] poVoq@slrpnk.net 4 points 1 week ago (5 children)

Lemmy does have a functional image proxy, but due to the storage and bandwidth requirements many larger instances have chosen to not enable it.

load more comments (5 replies)

load more comments