Why you should be using VPN on MPGH [IP leaking Proof of Work and how to fix it]

[Zaczero]

Hello MPGH!

Recently I found a way to leak IP addresses of the MPGH users and here is my proof of work.
I'm also providing a quick and easy fix for the staff members.

Let's start with the way how MPGH handles user images and signatures.
What it does is simply include the image in the HTML (no cdn, no proxy, just a direct connection).
There is nothing bad in this by itself but I found a smart way of matching the request with the mpgh username.



Every request sends the referrer header with the url where the file is loaded from.


Knowing this you can create a bot which checks the Who's Online page (https://www.mpgh.net/forum/online.php)
and looks for people who are viewing our XYZ thread where the image has been loaded from.

For optimal performance you can sort the list by "Last Activity" entry by adding ?sort=time parameter.


The last step is to include the dummy image in your signature or thread and gather data.

Data which you can gather using this method:
* Thread id
* Time
* User id
* Username
* IP address
* Country
* Browser used

And here goes my proof of work:


How efficient it is?
By running the bot for 3 days I was able to dump ~2000 users multiple times (25.000 requests).

How effective it is?
Sometimes you get false results so in order to make them more trustworthy you should dump a user at least 3-4 times.
Success rate is around 80%

How to fix it (easy way)
Add referrer-policy header on server response which will restrict data being send from the client inside the referrer.
I suggest using strict-origin-when-cross-origin.
Read more here: https://developer.mozilla.org/en-US/...eferrer-Policy
* note: it still will be possible to gather data using who's online but success rate will fall to around 10%
* note2: for full fix I'd suggest disabling who's online feature for normal users

How to fix it (hard way)
Create cdn server which will redirect all media requests through it.

Final words
Please don't ban me lmao. This data is available for everyone anyways and I'm just showing the problem so it can be fixed quickly :3
Also I want to show that you are not safe on the internet without VPN even if you visit trusted sites only.
Also please consider switching to Tor https://www.torproject.org/ <3

Donate for my small research and making MPGH a safer place for all of us ?
BTC: 1NjW3K26ZPZeveW4st4sC249MfyW2w5ZP8
ETH: 0x56b4ED755b7bDD75A954e168EB96f4501F75342d

[Silent]

this is old news, and I'm suppose to be working on an image proxy but have been busy. I'll get around to it next week.

This is no longer an issue. This has temporarily been fixed until I complete the image proxy.

[Ferris Bueller]

Damn this is pretty involved good work man!

Not sure if it's a good idea to post exactly how to leak all these ip addresses though

[Trash]

Not really that concerned unless they're DDoSing me like the skids they are.

[Hector]

Not really that concerned unless they're DDoSing me like the skids they are.

why should they ddos a trash can LMAO

[Lupin]

I know people who got banned for using VPN's on here

[[MPGH]Cursed]

I know people who got banned for using VPN's on here

Who? I proposed to admins that we disallow VPNs, like lf did, to cut down on the scamming... But was rejected due to how many users use and need to use VPNs on this site. I've been on a VPN while browsing MPGH hundreds of times...

[Danny]

I know people who got banned for using VPN's on here

Using private VPNs is fine like Nord

[niggo]

I know people who got banned for using VPN's on here

idk if it really was due to a vpn or maybe something else

[Lupin]

idk if it really was due to a vpn or maybe something else

He was told to stop using VPN's cause there were too many different IP's from different countries logging on which would make scam reports a mess

[niggo]

He was told to stop using VPN's cause there were too many different IP's from different countries logging on which would make scam reports a mess

never seen anyone being banned for that, also you can see which IPs are from vpns and which is his main IP

i wouldnt wanna know how my account would look like cause i have to change vpn server every 10mins due to IP bans when im doing some work in giveaways or the MP itself

[Trash]

why should they ddos a trash can LMAO

Ask my ISP. Got no answers for my blackouts for Wi-Fi specifically.

[Janitor]

Thanks for this, excellent breakdown on the issue and nice explanation.
You should more of these tbh. Revive Programming section !?

[RespectNF]

I know people who got banned for using VPN's on here

From my knowledge we don't ban people for using a vpn, even staff members use them.

We only require you to post your marketplace threads from your real ip so we can verify you are not a ban evader, after that you can use a vpn however you like.

Using private VPNs is fine like Nord

What do you mean by private ? All IP addresses on a VPN are available to everyone who wants to use them. If you are talking about dedicated ip which is dedicated exclusively to one person(And you have to pay more for it), then they are treated the same as a regular vpn on mpgh. It will still be recognizable that it's a VPN and a person must submit the thread from his/her actual IP. People can use Dedicated ip or public VPN addresses how they like as long as they are not posting marketplace threads from those.

[Danny]

What do you mean by private ?

I must've been misinformed then, I remember being told using any premium VPN (not private my bad) would be fine and using a public free one would put me at risk of accidental bans which when disputed you'd be able to tell its a vpn and unban.