Been a longtime consideration. I’ve never liked the hot linking and it is a source of legal contention (but then so are single-sentence excerpts and even mere links for some, absurd.) Can’t cache and serve images myself due to copyright, and whitelisting may be too cumbersome both on the user-end and maintenance. Blacklisting is an option, and coupled with an index of all external links within the HTML would allow a process to ex post facto rewrite HTML records to transform live links to dead or vv (dead being a span w/id, live being a/img with id.)
As you know I work for the Fedgov, and the government schooled me pretty well on stuff to look out for: XSS, XSRF, MiM attacks, Link injection, image injection, SQL injection (obviously), and even cross-tab hijacks (which are EXTREMELY devious and VERY inventive) — in which a dead tab of yours is made to mock up a secure login page in your accessible browser visit history. That’s why I never re-login to a page if it expires. I will request a serve-up a new login page if I ever time out. That prevents the attack from the user perspective. The only way to prevent it programmatically is to close all but focused tabs, which is not only difficult but impractical. Of course, a polished firewall and refusing to allow Java helps with that one, too.
Now the one they are using lately is serving up malicious code inside images/videos/music, and hoping that they can hook into editing or ‘playback’ executables. If they can spoof Paint into running something embedded in a picture, for example, they just might get machine code running. It is tricky as hell to pull it off, but I’ve heard of one or two successful hacks using it.
Here’s a mildly interesting and completely defensible, less dangerous technique some hackers are using. It relies too much on user cooperation to get it going. http://www.tgdaily.com/security-features/51056-embedded-malware-hidden-in-image-files
The really tricky ones are the ones that use image software itself as the hook, and they are particularly dangerous if various ‘semi-executable’ templates are used by the user.
It’s probably why Adobe keeps on sending me security patches. LOL
PS: I love talking shop with a fellow professional. :)
Thread hijack! Just a frien’ly lil’ test. “Hopefully not puking on unicode.” Cryptic ain’t it?
Copy-Pasted: “unnecessary”