Lesson 3 of 4 in The Bug Between Two Features · 3 min left in this chapter

What You Would Log To Notice It

There is exactly one weak signal available, and weak is different from absent.

2 min read

Not yet reviewed

The attack itself is invisible to the forum, so detection cannot watch for the theft. It can only watch for the setup — somebody pointing an avatar at a server they control — and that signal is genuinely weak, because most remote avatars are innocent.

Weak is not the same as absent, and this is the difference between a site that could investigate a report and one that could only apologise.

1Avatar host, recorded per member, at the moment it is set
2Hosts used by exactly one member across the whole site
3An avatar host changing shortly before a rise in profile views

Line 1Cheap, and worth storing whether or not anybody ever alerts on it. You cannot investigate a pattern you never recorded, and this is the only place the information exists at all.
Line 2The strongest of the three. Innocent avatars cluster on a handful of image hosts; a domain serving exactly one member's picture is unusual enough to look at.
Line 3The behavioural version, which catches somebody who registered a plausible-looking domain. It also has the most false positives, so it is a report to read rather than an alert to page on.

Note

None of these is an alert. They are a report somebody reads weekly, and that is the honest register for a signal this weak — a pager that fires on innocent behaviour is a pager people turn off.

The detection that actually worked

In the real incident, none of the above found it. A member noticed that somebody who should not have known where they lived, did — and worked backwards. That is worth saying plainly, because it is how a large share of privacy failures are actually discovered.

Take care

Which makes the reporting path part of your detection. If there is no obvious way for a member to say *"I think somebody has worked out who I am"*, and no expectation that it will be taken seriously, you have removed the only detection mechanism that was ever going to fire.

Which signal is most worth recording, given the attack cannot be seen directly?

The lab for this chapter puts you on the other side: a logger, a visitor panel, and one person to identify.