6 ms·
Adult sites are stashing exploit code inside svg files
- cheschire 1y agoFinally, a reason why porn in incognito mode is actually a safety mechanism.
- ta1243 1y agoRunning facebook in incognito mode, or at least in a separate container, is also an essential safety mechanism.
- medwards666 1y ago... or just not running Faecesbook at all.
- WarOnPrivacy 1y ago> ... or just not running Faecesbook at all. At one time I agreed and had even deleted my genuine FB acct. But had to create another one briefly in 2021 to find a rental - where I live now. I still have my ancient fake FB acct for Marketplace, etc but it's walled off.
- WarOnPrivacy 1y ago> Running facebook in a separate container is also an essential safety mechanism. Yes!. And that container is in a Ffx instance, accessed as a remote app (here now but diff container).
- bsimpson 1y agoIncognito shares the session, so if you have Facebook and shady sites open in incognito at the same time, you've reintroduced this attack vector. If you want real isolation, user browser profiles.
- ta1243 1y agoYes loading more than one shady sites in private mode allows them to share data. Only do one shady site at a time then close down. But it's certainly good advice to check no other windows have been opened.
- StrauXX 1y agoOriginal article: https://www.malwarebytes.com/blog/news/2025/08/adult-sites-trick-users-into-liking-facebook-posts-using-a-clickjack-trojan https://www.malwarebytes.com/blog/news/2025/08/adult-sites-t... The linked article just regurtitates the source.
- throwaway290 1y agoArs article links to Malwarebytes but Ars article is better. The headline is better, it's most interesting that they run code from svg. Ars also adds context how the same hole was also used before to hijack Microsoft accounts and also by the Russians. Whereas Malwarebytes is mostly about pornsite clickjacking to like Facebook posts (and complains about age verification). However it has a bit more technical details too. Read both I guess?
- lostmsu 1y agoWhat's the hole? Neither appear to say.
- throwaway290 1y agoI guess that obfuscated JS in SVG runs? Then it downloads the script that does shady stuff
- lostmsu 1y agoThat does not explain exactly what is wrong. The site could already run JS. It did not need SVG to do it.
- throwaway290 1y agoYeah I guess the original article is not clear on that. Other cases usually involved email but this is not
- saagarjha 1y agoI'm curious how you can click the like button using JavaScript…
- 55555 1y agoThe user has to click on the image, so I think the SVG is embedding the FB like button onto the page and drawing another element on top of it to hide it.
- deleted 1y ago[deleted]
- michaelt 1y agoI think some people on the SVG design committee were aiming to replace Flash for things like browser games, and wanted animations and javascript and so on to support that role. That lead to the weird situation where browsers have two ways of embedding an SVG into a web page - embed in an <img> tag and the javascript won't run, but embed it in an <iframe> and it will (but of course iframe height can't auto-size...) The javascript also means pretty much no user-generated-content sites allow the upload of SVGs. Wikipedia is the only place I can think of - and even they serve the SVG as a PNG almost everywhere.
- kevin_thibedeau 1y agoYou can also embed in <object>.
- kibibu 1y agoYou can also just throw an SVG element straight into your html
- vaylian 1y agoxmlns namespaces for the win!
- guerrilla 1y agoI miss XML. It made so much sense. XSLT was awesome.
- __david__ 1y agoIt’s still out there and supported. Load this page and then view the source: https://emacsformacos.com/atom/release https://emacsformacos.com/atom/release
- bawolff 1y agoXmlns is not used in HTML5. You use xmlns to embed html in svg, not the other way around.
- QAkICoU7IDNkpFu 1y ago“The user will have to be logged in on Facebook for this to work, but we know many people keep Facebook open for easy access.” Well there's your problem right there.
- mananaysiempre 1y agoBog-standard CSRF is what that is. It’s essentially the second thing you guard against, right after sanitizing inputs to prevent XSS and SQL injection.
- ndriscoll 1y ago> Facebook regularly shuts down accounts that engage in these sorts of abuse. But does not fix the CSRF vulnerability, apparently.
- mathiaspoint 1y agoProbably because they need it themselves for data collection.
- bawolff 1y agoIts not a CSRF vulnerability if its the intended behaviour. In a world where same-site cookies are the default you have to actively opt-in to this sort of thing.
- ndriscoll 1y agoIf the user did not intend to do the action that the malicious site had their browser perform for their account, it is by definition CSRF. The other site forged a request from the user. Facebook might not care, but it is obviously a vulnerability. Sites can forge likes from users (which IIRC appear on timelines?).
- bawolff 1y ago> Facebook might not care Facebook does care. Allowing like buttons on third party sites was (at least historically) a major part of their business. Its not like they are just being apathetic here - they actively want people to be able to like things from outside of facebook and put in effort to make that happen.
- ndriscoll 1y agoThey're clearly aware of the vulnerability if they close accounts for exploiting it. Techniques to prevent it are well-known and allegedly they have lots of skilled engineers. But those techniques would increase friction a little bit, so they've evidently decided they don't care about the vulnerability.
- mananaysiempre 1y ago> The Scalable Vector Graphics format is an open standard for rendering two-dimensional graphics. It would be nice if we had one of those, but SVG is not it, at least not unless you’re willing to gloss HTML as “an open format for rendering reflowable text”. SVG is a full platform for web applications with fixed-layout graphics and rich animations, essentially Flash with worse development tools. There have been some attempts to define a subset of SVG that represents a picture, like SVG Tiny, but that feels about as likely to succeed as defining JSON by cutting things out of JavaScript. (I mean, it kind of worked for making EPUB from HTML+CSS... If you disregard all the insane feature variation across e-readers that is.) Meanwhile, other vector graphics formats are either ancient and not very common (CGM, EPS, WMF/EMF) or exotic and very not common (HVIF, IconVG, TinyVG). (My personal benchmark for an actual vector format would be: does it allow the renderer to avoid knowing the peculiarities of Arabic, Burmese, Devanagari, or Mongolian?)
- mouse_ 1y agoI still miss Flash
- jonplackett 1y agoMe too. Adobe just murdered it. All they had to do was convert the exporter to html5 but they messed it up. The best thing about flash was that it let non-coders create interactive things. The editor with a timeline + code you could stick to objects was the best feature. I had to learn to code properly after flash died, which probably was a good thing, but I still miss that way of making things.
- dvfjsdhgfv 1y ago> The best thing about flash was that it let non-coders create interactive things. But you are not missing flash, you are Missing Macromedia Director and co. These were wonderful tools, intuitive and easy to use. Flash was an abomination of a format, and it was dragging the web down, also security wise, it's good that Apple and Google killed it.
- 1y ago
- ajross 1y agoSVG really is just an awful format. What the market wanted was a clean, easily parseable specification for vector image data based on a solid rendering specification. What it got was an extensible HTML-like scripting language where all the vector stuff was ad hoc and poorly implemented, and where (this is the bit that absolutely drives me up the wall) the actual image data is not stored in the metadata format they chose. You have to parse this entirely different string format if you want to extract the points on your curve or whatever!
- esprehn 1y agoTo be fair the format was invented in an era before gzip compression. The very compact format and silly attribute names like d are from optimizing for that.
- ajross 1y agoNot sure I've heard that angle before. I'm tempted to agree, but then the choice of *xml* as the enclosing format argues strongly that efficiency wasn't at the forefront of the design criteria. Also the dates don't work. HTTP/1.1 with gzip/compress/deflate encodints was live in browsers and servers with inline compression well before the standard was published in RFC 2068 in 1997. SVG's spec was four years behind that, and IIRC adoption being pretty glacial as far as completeness and compliance.
- deleted 1y ago[deleted]
- lostmsu 1y agoThis makes no sense. How does SVG click Facebook like button? Is there a vulnerability? The post doesn't say anything like that. Why are they clicking like buttons instead of stealing money from bank accounts then?
- zb3 1y agoYeah, at first I thought this was about a browser 0day.. but no, so where is the vulnerability? Is Facebook vulnerable?
- lemoncookiechip 1y agoAll the more reason to block all JS by default with add-ons like NoScript or uBO and manage a whitelist. It's a bit annoying the first few days, but then the usual sites you frequent will all be whitelisted and all that's left are random sites you come across infrequently.
- mindslight 1y agoInvesting in NoScript can actually make pages faster, even if you end up enabling a bunch of javascript for functionality. For example, I remember having to whitelist only about half the resources used by homedepot.com. The rest was just shameless surveillance bloat, continually backhauling gobs of data as you were merely viewing the page. The site loaded and scrolled much quicker without it.
- bogwog 1y agoFYI, uBlock Origin has javascript blocking features just like NoScript, so if you're already using it as your ad blocker, you don't need a separate extension to block javascript too
- lemoncookiechip 1y agoThis is absolutely true. But personally I find NoScript's UI more intuitive to use for JS domain blocking (mostly because I've been using it for years now). I also used to use uMatrix by the same author as uBO before it was deprecated on Chromium browsers.
- gruez 1y ago>It's a bit annoying the first few days, but then the usual sites you frequent will all be whitelisted and all that's left are random sites you come across infrequently. How does this work in reality? Do you just whitelist every site you come across if it's broken? What's the security advantage here? Or do you bail if it requires javascript? What about the proliferation of sites that don't really need javascript, but you need to enable it anyways because the site's security provider needs it to verify you're not a bot?
- johnisgood 1y agoWhere is the SVG only?
- shazbotter 1y agoPeople still have Facebook accounts? I genuinely don't know why anyone does at this point. If you are a woman, did you know Facebook has been stealing menstruation data from apps and using it to target ads to you? If you take photos with your smartphone, you know meta has been using them to train their ai? Even if you haven't published them on Facebook? To say nothing of Facebook's complicity in dividing cultures and fomenting violence and hate...
- Havoc 1y agoA ton of friends still use Facebook messenger as their primary way to reach them
- WarOnPrivacy 1y ago> People still have Facebook accounts? Facebook Marketplace supplanted a number of earlier sites - like Hotpads for rentals and Craigslist for cars. In mid 2021 there were hundreds of applicants per rental listing - even on Marketplace. No one had a luxury of listing preference.
- deleted 1y ago[deleted]
- zahlman 1y ago> Security firm Malwarebytes on Friday said it recently discovered that porn sites have been seeding boobytrapped .svg files to select visitors. When one of these people clicks on the image, it causes browsers to surreptitiously register a like for Facebook posts promoting the site. I think I'm missing something; if you can embed arbitrary JavaScript in the SVG, why is a click necessary to make that JavaScript run? And if JavaScript on your page can exploit CSRF on Facebook, why is embedding it in an SVG necessary?
- mathgeek 1y ago> I think I'm missing something; if you can embed arbitrary JavaScript in the SVG, why is a click necessary to make that JavaScript run? And if JavaScript on your page can exploit CSRF on Facebook, why is embedding it in an SVG necessary? A human clicking something on the site tends to get around bot detection and similar systems put in place to prevent automation. This is a basic “get the user to take an action they don’t know the outcome of” attack.
- jonplackett 1y agoYeah browser often blocks clicks on things without them originating from a true user click. Eg you can’t enable sound on a webpage without a real click.
- varelse 1y ago[dead]
- bsimpson 1y agoI'm shocked this attack works. I thought the last 15 years of browser dev were largely isolating domains from each other to prevent cross-site attacks, and introducing consent flows for little used and/or dangerous platform features. Running JS inside an image format sounds like a thing they could add permissions for (or a click-to-play overlay), especially if it can talk to other sites.
- bapak 1y agoI want to make something clear: <img src=file.svg> will not execute any scripts nor load foreignObject. For this to work, the SVG has to be loaded in an iframe or in a new tab. Or it could be inlined in the HTML. Nothing special about SVG really as long as you (Facebook) treat SVG files as images and don't inline it. The SVG part only really comes in as a way to hide script tags from anyone looking at the network requests, but even then it seems that the specific SVG was crafted to download further scripts. So what's the issue here exactly? It seems that Facebook is still somehow affected by XSS? Neat.
- Symbiote 1y agoThe Malwarebytes article[1] explains that the users downloaded (possibly automatically) the SVG files and then opened them in the default viewer, which is MS Edge. [1] https://www.malwarebytes.com/blog/news/2025/08/adult-sites-trick-users-into-liking-facebook-posts-using-a-clickjack-trojan https://www.malwarebytes.com/blog/news/2025/08/adult-sites-t...
- lostmsu 1y agoThat doesn't explain anything. Then what?
- bapak 1y agoThanks! Yes that would work, just like an .html file would work. The advantages of SVG in this case are - the OS previews it as an image, but on click it opens a website (which to be fair, once you click on a downloaded file, you're already done) - SVGs are allowed in any "image/*" form, bypassing certain filters
- neilv 1y ago> it causes browsers to surreptitiously register a like for Facebook posts promoting the site. Wouldn't that be discovered pretty quickly, when Bob's family and friends see porn promoted to them because John apparently liked it on Facebook. Eventually, one of them would mention it to him. "Y'know, Bob, you probably don't want to be liking that on your main Facebook account... Are you feeling OK?"
- lofaszvanitt 1y agoThat's why you run compartmentalised sessions so your real life wouldn't bleed into the porn habits you have.
- mass_and_energy 1y ago"[...] porn sites have been seeding boobytrapped .svg files [...]" I see what you did there ;)