Embedding URL call into an image / movie

Question

Is there a way to embed a URL call in the raw data of an image or movie file, such that when the image or movie is opened, it makes a call to a webserver? I want to be able to obtain someone's external IP by sending an image to them, and then having the image make a call back to a webserver I control.

I just wonder if some PHP script could be embedded into the image file.

Answer 1

Any such functionality is dependent on the player or viewer used. I know of no image formats that require any kind of interaction from the viewer, but some video formats do (or, rather, did) use it.

In addition to Quicktime mentioned by 0xea, the Windows Media/ASF format allows embedding of script commands, and one of them is opening an URL:

http://support.microsoft.com/kb/828026

When a content owner creates an audio or a video stream, that content owner can add script commands (such as URL script commands and custom script commands) that are embedded in the stream. When the stream is played back, the script commands can trigger events in an embedded player program, or they can start your Web browser and then connect to a particular Web page. This behavior is by design.

However, this behavior:

• relies on the player supporting it (e.g. I don't think VLC or mplayer support it)
• can be disabled by the user

So, I would not rely on it.

EDIT

Speaking of images, I've just realized that SVG is using XML. XML files may contain references to extenal URLs, such as DTDs or schemas. Additionally, SVG itself supports referring to other elements in the same document or sometimes external ones:

http://www.w3.org/TR/SVG/struct.html#Head

I've just tried it and opening the following SVG results in a fetch to the remote server in Opera, but not IE:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg width="8cm" height="3cm" xmlns="http://www.w3.org/2000/svg" version="1.1">
  <desc>Local URI references within ancestor's 'defs' element.</desc>
  <defs>
    <linearGradient id="Gradient01">
      <stop offset="20%" stop-color="#39F" />
    </linearGradient>
  </defs>
  <!-- reference to a local definition -->
  <rect x="1cm" y="1cm" width="6cm" height="1cm" 
        fill="url(#Gradient01)"  />

  <!-- this element triggers a fetch of the specified URL in Opera -->
  <rect x="1cm" y="1cm" width="6cm" height="1cm" 
        fill="url(http://example.com/test1)"  />
</svg>

So, once again it's viewer-specific but you probably have more chance of this working.

Answer 2

What you ask for would be very near remote code execution, which is usually a security no-no. Tho there are some formats that allow similar things.

As far as i remember MOV file format allows you to embed urls or aliases in it for alternative versions of the movie. I think it's usually used for streaming purposes, so that a player can request a higher or lower quality movie and similar things.

I do not know many details about this, but you can check out MOV file format. The atom that contains urls is DREF. Apple should have more info. Check out QuickTime File Format specifications for details.

For example , here's the sample file (from mplayer samples database, which has proven to be a very valuable resource for all sorts of media files) that actually contains only the reference to another file, hosted at http://stream.qtv.apple.com/events/jan/cat_power/cat_power_ref_28.mov. The server will definitely be able to determine the client's IP address this way.