There's something fishy happening on Imgur

Reddit users in the subreddit r/4chan (different from the website 4chan) noticed something fishy with some of the links being posted to the forum from image hosting site Imgur.

Imgur has long been the favored place for Reddit users to dump their jpgs, gifs and pngs, but it was apparently serving up some dangerous code to r/4chan users.

The problem was first pointed out in a post on r/4chan Monday night, “Imgur is doing fishy things with 4chan screencaps.” User rt4nyp pointed out unusual javascript code that was running on the Imgur page of screenshots posted in r/4chan.

Things get a little technical from there as to what the code actually does. Users reported the injected javascript caused 500+ hotlinked images from the website 8chan to open (if you’re not familiar with 8chan, consider yourself lucky). That led many to speculate the intent was to launch a distributed denial of service attack on 8chan, and strain the website’s servers to the point of crashing.

Other redditors pointed out the script was causing visitors to 8chan to send messages to an unknown server, meaning the goal may have been to create a “botnet” of infected users for possible future attacks.

Whatever the intent or result, what’s disturbing is that Imgur, a site that millions of people visit and look at every day, was apparently compromised to serve malicious code. The company’s Twitter account acknowledged the problem and said they were working on a solution.

Until then, you probably shouldn’t visit 8chan. (A haven for Gamergaters, Men’s Right Activists, and pedophiles, you probably don’t want to visit 8chan even without the malicious code.)

Anyway, to sum up: A content aggregator dedicated to posts about another content aggregator was pulling in bad code from another content aggregator, possibly causing an attack on fourth, different content aggregator.

The Internet in 2015 is the worst.

Update: Imgur has posted on its blog to say it’s patched the vulnerability. It appears it was specifically targeted at visitors of that specific subreddit who also visit 4chan and 8chan, so most people are probably fine. Imgur suggests people clear their browsing data, cookies and local storage, just to be safe.