The ONLY reason I'm sharing this information is because this no longer works on FriendRewind. It did for a bit, but I brought this to D3fect's attention and got it patched as soon as I found out it was possible.
The History
Ah, the old MySpace IP tracker. A method used by a handful of people back in the early 2000's to do some nifty little tricks. At that time I was still pretty new to coding. I would hang out mainly in the HTML Masters group where people would share interesting snippets of code and have layout battles to see who could come up with the coolest designs. As I said, I was only just beginning to learn the basics of html/css, but if you wanted to learn these were the people to talk to.
IP trackers were a known thing. A handful of us knew how to do it, but we tried not to mention it because it was technically against the rules. It was a fairly well guarded secret among those who knew, but honestly it wasn't that hard to figure out. Nobody ever actually told me how to do it. It was pretty much forbidden to talk about in the group, but I got lucky when somebody was bragging in a post about how he got some troll's IP address after the group was attacked. As soon as he mentioned that, I went straight to his code to see what I could see.
How it Worked
There were 2 common ways to achieve this. Changing the source of an image tag.
<img src="https://yourWebsite/yourFile.php" />Changing the url of css backgrounds.
body { background-image: url('https://yourWebsite/yourFile.php'); }
When someone's profile was loaded, it would silently hit your php file on your personal website, which could then do a few different things. Tracking your IP (obviously) or detecting what browser you are using. Possibly even cookie manipulation. I never really dug too deep into it so I can't tell you everything that could be done, but the cool thing I found out when playing around with it was that you could make arrays of urls and with a little random number generation on your server, you could send back a random url and force the profile to load random background images from your list. So each person that viewed your profile would have their own unique experience and see a different image each time.
Flash players were big back then too. In fact, there were some pretty amazing flash profiles towards the end of those days. But my point about the flash player is that you could also send random urls to a music player so it would play a random song each time the profile was loaded. It was pretty cool.
The Reality
Some of you may be upset with me for asking D3fect to patch this. I may have killed random backgrounds and songs on FriendRewind, but it's definitely something that could be used for the dark side of the force, so it needed to be done. Maybe D3fect could add a toggle to the music player to play random songs? wink wink ;) I was actually very impressed with how fast this got fixed once I pointed it out. I tried this method on Spacehey as well (no it doesn't work there) but I guarantee if I had found it was possible and reported it, my report would have been completely ignored over there. FriendRewind for the win!
Well, that's it. That's your history lesson for the day. Now go smash goals.
Comments
Displaying 8 of 8 comments ( View all | Add Comment )
ExMachina
(edited)
Report
You actually did a good thing. I remember cookie stealing was such a pain in the ass on Hi5 (I wasn't as active on MySpace). People would suddenly lose their accounts without falling for phishing emails or the usual stuff, then the attackers would change the email and password, since it was that easy.
It was easier to embed on a YouTube video because you were most likely to hover over it, specially if you had set it to autoplay.
I felt it was worth mentioning. MySpace was notoriously bad about fixing bugs. Especially in groups. Groups were like the wild west.
by sudofry
Site Supporter;
;
Report
Genxennial
I remember using IP trackers on my MySpace page. I was being stalked online by my exhusband’s crazy wife (she’s now his ex) at the time. Every time I’d blocked her she’d make a new profile just to see what I was doing, saying, who my friends were, steal my kids pictures. Oh it was a mess. So I knew her IP address and I blocked every account she made.
I've been in similar situations before. Not for a long time though. Hopefully all that is over and done with now?
by sudofry
Site Supporter;
;
Report
Yes it is, thank goodness
by Genxennial; ; Report
rillo
wow, didn't realize it went that far. i ran a small website and forum at the time, and hosted one of the images on my profile on my own server. it was cool to see where all of my views were coming from in my server log. sometimes i'd match them with the initiating user just for a little personal challenge. but never anything more than that, and I never talked about it. when i arrived at spacehey, i noticed all img src's were routed through their server, so i never bothered. when i arrived here i wondered if it was a thing, but didn't bother with it. always wondered how others would use it to exploit but didn't do any research on the matter.
I also remember when I hosted my own images and this guy stole my layout code and left the hotlinked image urls without re-uploading the images himself. Since I had control of the url's, I swapped all the images out with images that said "I stole this layout". He messaged me within a day and said "Sorry man, lesson learned!" lol.
by sudofry
Site Supporter;
(edited);
Report
by rillo; ; Report