Spy Pixels

business_kid · 02-17-2021, 01:15 PM

https://tech.slashdot.org/story/21/0...become-endemic

Is there a way to remove these things from webmail, or incoming mail. I gather they do have a picture format.

And for those of us in Europe: These things are surely illegal under GDPR; Has any work been done there?

////// · 02-17-2021, 01:26 PM

suricata has rules for pixels :

Code:

# Alert on PNG with 1x1 pixels (tracking)
alert http any any -> any any (msg:"FILE tracking PNG (1x1 pixel) (1)"; filemagic:"PNG image data, 1 x 1,"; sid:8000059; rev:1;)
alert http any any -> any any (msg:"FILE tracking PNG (1x1 pixel) (2)"; filemagic:"PNG image data, 1 x 1|00|"; sid:8000060; rev:1;)

# Alert on GIF with 1x1 pixels (tracking)
# The pattern matches on |00| which is the end of the magic buffer, this way we won't match on 1 x 128.
alert http any any -> any any (msg:"FILE tracking GIF (1x1 pixel)"; filemagic:"GIF image data, version 89a, 1 x 1|00|"; sid:8000061; rev:1;)

it alerts you whenever it sees em. but i dont know if those pixels keep functioning even when suricata alerts of them.

also privoxy has rules for pixels.
https://www.privoxy.org/

those are for web browsing.

dugan · 02-17-2021, 02:24 PM

Wikipedia calls them “web beacons”.

They’re easy to neuter; just make sure your emails are being rendered as plain text and not as HTML or “rich text”.

Sefyir · 02-17-2021, 09:53 PM

A lot of mail clients (web browser or otherwise) don't load remote images unless you have added them as a contact or explicitly permitted it.

robotpenguin · 02-18-2021, 06:05 AM

I'm pretty sure that OpenSnitch would be able to catch these. Little Snitch does under MacOS - for now anyway.