6 ms·

Blocking Image Hotlinking, Leeching and Evil Sploggers with Url Rewrite

49 points by shawndumas 13y ago

thomaslutz 13y ago
The only new thing in this post here is how to do this in IIS, but I guess nobody is using IIS here.
- junto 13y ago
  Your guess is wrong :)
pi18n 13y ago
We seen opportunistic vultures use the DMCA to lawlessly enforce their censorship, but when a case it's actually designed for comes up... Maybe he already thought of it, but it might also help to send DMCA notices to Google as well as the website's registrar and host. I'd love to see a bad guy get taken down by the good guys for once.
- pdwetz 13y ago
  Agreed that DMCA can also be used, but that only applies to US hosts/sites. His approach lets you handle other cases and also takes effect immediately.
  - pi18n 13y ago
    I was not thinking of that and you are absolutely right.
hawleyal 13y ago
You're breaking the internet.
- krapp 13y ago
  You can have everyone's images when you're willing to pay them for the bandwidth. The internet has changed (unfortunately.)
- chollida1 13y ago
  How so? I mean this as an honest question. how does this "break the internet"? I configure my browser to send the referrer as the site I'm currently on as I don't believe a site has the right to know where I've come from. Does this also break the internet?
  - twistedpair 13y ago
    Three cheers. Never trust a "referrer" header. But now you're a "hacker," right?
- AJ007 13y ago
  For smaller sites it is not unusual for a hot linked image to use more bandwidth than the rest of an entire site many times over. This isn't an issue for me any more, but I had some ideas over the years - 1) Make hotlink images serve pictures with a massive watermark. This way you get free branding/advertising. 2) Serve specific images to specific problem hot linkers, for example "Pinterest sucks (insert favorite word)." 2) If you are more malicious, make the behavior random so it isn't immediately evident to the site owner/moderator what is going on. Image attribution gets little respect, just take a look at what happened to Google Images. The service went from being obvious (to the mass market user) where the image was coming from (assuming it was being published by the original owner) to now it just looks like Google has their own stock photography service. Irregardless of your opinion on copyright, everyone agrees on attribution when it comes to code. As far as I believe the same is true for images. Hotlinking is the tip of a very problematic iceberg.
- Steuard 13y ago
  How? Hotlinking of images on someone else's site has been viewed as inappropriate as long as I can remember (was it okay before 1995?). It's not wise design in any case: what if they remove it or reorganize their site? (Hyperlinks to other peoples' pages have always been okay, but that's not what we're talking about here.)
Ricapar 13y ago
Thank you for using a specific blacklist on HTTP_REFERER. Worst I've seen done is when sites will throw the stupid "No Hotlinking" message image when they don't see a matching referrer from the same domain. In other words, a "fuck you" to anyone who decides to configure their browser to not send referrers.
- warcode 13y ago
  Configure your browser to send the target domain as the referrer and you won't have that issue. In fact it even makes any hotlinking filters set up like this not work at all, and serve you the picture normally.
deleted 13y ago
[deleted]
blantonl 13y ago
I use this simple rewrite rule to prevent user submitted images from being used on other sites... <Directory /images> RewriteEngine On RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER} !mydomain.com RewriteRule .*\.(gif|jpg|png)$ http://images.mydomain.com/no.gif [NC] </Directory>
- krapp 13y ago
  I've used this method too. But I thought the image type you were supposed to serve as an alternative had to use a nonstandard extension (like .jpe)?
  - deleted 13y ago
    [deleted]
program 13y ago
Unfortunately this approach does not work in HTTPS world. See https://tools.ietf.org/html/rfc2616#section-15.1.3 https://tools.ietf.org/html/rfc2616#section-15.1.3 Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.
- RKearney 13y ago
  This only will not work if your page is loaded over HTTPS and your assets are done over HTTP. If your site and all of the linked/embedded assets are HTTPS, it will work as intended.
bhartzer 13y ago
In a few rare cases, I've allowed image hotlinking where the site's URL or copyright shows in the image. And because I wanted the image to rank really well in image search.
deleted 13y ago
[deleted]
davidgerard 13y ago
Of course, Jason Scott already won at this. http://ascii.textfiles.com/archives/1011 http://ascii.textfiles.com/archives/1011

49 points by shawndumas 13y ago

thomaslutz 13y ago

The only new thing in this post here is how to do this in IIS, but I guess nobody is using IIS here.

junto 13y ago
Your guess is wrong :)

pi18n 13y ago

We seen opportunistic vultures use the DMCA to lawlessly enforce their censorship, but when a case it's actually designed for comes up... Maybe he already thought of it, but it might also help to send DMCA notices to Google as well as the website's registrar and host. I'd love to see a bad guy get taken down by the good guys for once.

pdwetz 13y ago
Agreed that DMCA can also be used, but that only applies to US hosts/sites. His approach lets you handle other cases and also takes effect immediately.
- pi18n 13y ago
  I was not thinking of that and you are absolutely right.

hawleyal 13y ago

You're breaking the internet.

krapp 13y ago
You can have everyone's images when you're willing to pay them for the bandwidth. The internet has changed (unfortunately.)
chollida1 13y ago
How so? I mean this as an honest question. how does this "break the internet"? I configure my browser to send the referrer as the site I'm currently on as I don't believe a site has the right to know where I've come from. Does this also break the internet?
- twistedpair 13y ago
  Three cheers. Never trust a "referrer" header. But now you're a "hacker," right?
AJ007 13y ago
For smaller sites it is not unusual for a hot linked image to use more bandwidth than the rest of an entire site many times over. This isn't an issue for me any more, but I had some ideas over the years - 1) Make hotlink images serve pictures with a massive watermark. This way you get free branding/advertising. 2) Serve specific images to specific problem hot linkers, for example "Pinterest sucks (insert favorite word)." 2) If you are more malicious, make the behavior random so it isn't immediately evident to the site owner/moderator what is going on. Image attribution gets little respect, just take a look at what happened to Google Images. The service went from being obvious (to the mass market user) where the image was coming from (assuming it was being published by the original owner) to now it just looks like Google has their own stock photography service. Irregardless of your opinion on copyright, everyone agrees on attribution when it comes to code. As far as I believe the same is true for images. Hotlinking is the tip of a very problematic iceberg.
Steuard 13y ago
How? Hotlinking of images on someone else's site has been viewed as inappropriate as long as I can remember (was it okay before 1995?). It's not wise design in any case: what if they remove it or reorganize their site? (Hyperlinks to other peoples' pages have always been okay, but that's not what we're talking about here.)

Ricapar 13y ago

Thank you for using a specific blacklist on HTTP_REFERER. Worst I've seen done is when sites will throw the stupid "No Hotlinking" message image when they don't see a matching referrer from the same domain. In other words, a "fuck you" to anyone who decides to configure their browser to not send referrers.

warcode 13y ago
Configure your browser to send the target domain as the referrer and you won't have that issue. In fact it even makes any hotlinking filters set up like this not work at all, and serve you the picture normally.

deleted 13y ago

[deleted]

blantonl 13y ago

I use this simple rewrite rule to prevent user submitted images from being used on other sites... <Directory /images> RewriteEngine On RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER} !mydomain.com RewriteRule .*\.(gif|jpg|png)$ http://images.mydomain.com/no.gif [NC] </Directory>

krapp 13y ago
I've used this method too. But I thought the image type you were supposed to serve as an alternative had to use a nonstandard extension (like .jpe)?
- deleted 13y ago
  [deleted]

program 13y ago

Unfortunately this approach does not work in HTTPS world. See https://tools.ietf.org/html/rfc2616#section-15.1.3 https://tools.ietf.org/html/rfc2616#section-15.1.3 Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.

RKearney 13y ago
This only will not work if your page is loaded over HTTPS and your assets are done over HTTP. If your site and all of the linked/embedded assets are HTTPS, it will work as intended.

bhartzer 13y ago

In a few rare cases, I've allowed image hotlinking where the site's URL or copyright shows in the image. And because I wanted the image to rank really well in image search.

deleted 13y ago

[deleted]

davidgerard 13y ago

Of course, Jason Scott already won at this. http://ascii.textfiles.com/archives/1011 http://ascii.textfiles.com/archives/1011