Imgur has long been the favored place for Reddit users to dump their jpgs, gifs and pngs, but it was apparently serving up some dangerous code to r/4chan users.
Things get a little technical from there as to what the code actually does. Users reported the injected javascript caused 500+ hotlinked images from the website 8chan to open (if you’re not familiar with 8chan, consider yourself lucky). That led many to speculate the intent was to launch a distributed denial of service attack on 8chan, and strain the website’s servers to the point of crashing.
Other redditors pointed out the script was causing visitors to 8chan to send messages to an unknown server, meaning the goal may have been to create a “botnet” of infected users for possible future attacks.
Whatever the intent or result, what’s disturbing is that Imgur, a site that millions of people visit and look at every day, was apparently compromised to serve malicious code. The company’s Twitter account acknowledged the problem and said they were working on a solution.
Until then, you probably shouldn’t visit 8chan. (A haven for Gamergaters, Men’s Right Activists, and pedophiles, you probably don’t want to visit 8chan even without the malicious code.)
Anyway, to sum up: A content aggregator dedicated to posts about another content aggregator was pulling in bad code from another content aggregator, possibly causing an attack on fourth, different content aggregator.
The Internet in 2015 is the worst.
Update: Imgur has posted on its blog to say it’s patched the vulnerability. It appears it was specifically targeted at visitors of that specific subreddit who also visit 4chan and 8chan, so most people are probably fine. Imgur suggests people clear their browsing data, cookies and local storage, just to be safe.
GET SPLINTER RIGHT IN YOUR INBOX
The Truth Hurts