Anonymous griefers induce epileptic seizures using JavaScript

happygeek 0 348 Views

I am not an easily shockable person. Anyone who knows me, anyone who has seen me, will understand this. Indeed, other than the usual trio of sexual or racial abuse and mindless violence it takes a lot to drop my jaw in shame and despair while browsing the web. However, a bunch of numbnut griefers managed to achieve just that over the weekend when they used a combination of JavaScript coding and flashing animations with the intent to trigger fits amongst the users of an epilepsy support website.

According to reports one user suffered her worst epileptic attack in 12 months when she clicked on an offending post at an Epilepsy Foundation site forum. Confronted by a full screen of rapidly flashing squares in different colours she quickly "locked up" and was rescued by the quick thinking of her 11 year old son who killed the browser process and prevented a full fit from occurring.

The non-profit organisation responded admirably quickly and closed the site briefly on Sunday in order to purge the forums of the messages, and hopefully patch the security holes which allowed them to be posted in the first place.

The hackers responsible posted hundreds of messages via an automated script on Saturday, following up by injecting JavaScript into posts to redirect to another site with even more targeted pages designed to trigger the seizures in viewers suffering from both photosensitive and pattern-sensitive epilepsy.

Wired claims that the attack was perpetrated by members of the informal griefer collective known as Anonymous, perhaps best known for its recent attacks on Church of Scientology sites. The report suggests that it might have been intended to generate anger towards a web site much disliked by its members, and which was referenced in the first batch of postings. It goes on to claim that some forum members had tracked down a now deleted forum thread planning the attack at a site known to be a stronghold of the group.

Dani AI

Generated

This thread underlines two things: attacks that exploit forum posting features can target vulnerable people, and attribution is tricky. Echoing and , site operators should treat this as both a security and an accessibility issue; and, as observed, anonymous posting makes immediate attribution unreliable.

Immediate priorities for forum administrators:

  • Put the board into maintenance or read-only and remove the offending content from the live site (keep an offline copy for forensics).
  • Stop HTML/script rendering for user posts: escape user input or switch to text-only posts until a sanitizer is in place.
  • Apply server-side sanitization with a strict whitelist for tags/attributes; disallow data: URIs and inline scripts/styles.
  • Enforce rate limits, CAPTCHAs for bulk posting, and require manual approval for posts from new accounts or accounts that suddenly post many items.
  • Audit logs, rotate admin credentials, and block offending IP ranges while investigating.

A couple of practical defenses to implement quickly:

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';

and support reduced-motion preference in CSS so users and browsers that request reduced motion are respected:

@media (prefers-reduced-motion: reduce) {
  * { animation: none !important; transition: none !important; }
}

Moderator workflow and user safeguards: require image uploads to be reviewed (or proxy them through a server that strips animation), add a visible “report flashing/unsafe content” button, train moderators to look for mass-post patterns, and publish a short safety notice for visitors explaining how to disable images/scripts or leave immediately. For users with epilepsy: use browser extensions or settings that block scripts/animated media and have a simple plan (close tab, move away, get help) if triggered.

Conservative defaults and clear moderation processes protect both the community and vulnerable visitors.

Member Avatar for copingwepilepsy
copingwepilepsy 0 Newbie Poster

This isn't an isolated event - it isn't the first time the hooligans at 7chan instigated an attack on epilepsy forums. They do it periodically. I issued a press release ( http://www.pr.com/press-release/60959 ) after they attacked CWE ( http://www.coping-with-epilepsy.com/ ) last November. They have attacked the NSE forums ( ) several times over the last couple years.

Member Avatar for happygeek
happygeek 2,411 Most Valuable Poster

It really does beggar belief, doesn't it? :(

Member Avatar for MikePL
MikePL 0 Newbie Poster

Oh man. I'm one of the protesters against the Church of Scientology, and I really don't understand how people could be blaming us for this thing. Anyone can be anonymous on-line, people need to take a look at the websites these griefers operate on. The people who run sites like 7chan are against our protests. Scientology is against its members taking medication to stop them from getting seizures, for example, Tory "Magoo" Christman - http://www.entheta.net/archive/personal_story/tory/affidavit.html

Jocelyn Dorfmann died from an epileptic seizure in Scientology care in France - http://www.whyaretheydead.net/others/Jocelyne_Dorfmann_34.html

Heribert Pfaff died from an epileptic seizure in a Scientology hotel in Clearwater -

James Stewart committed suicide after CoS put in him in a Condition of Doubt for having epileptic seizures in public -

Member Avatar for steven woodman
steven woodman 57 Posting Pro in Training

Dirty son's of b$#%H's. People that do that kind of junk make me sick. Why would anyone want to inflict random suffering on other people. If as many people put their knowledge and obviously wasted time into something of good cause the world would be such a nice place.

Sw

Member Avatar for LegionAnonymous
LegionAnonymous 0 Newbie Poster

I hope we are not still associated with this kind of disgusting thing. Raiding on Habbo is one thing, but this is a completely different thing. And anyone can go onto sites like 4chan or 711chan and post anonymously. That doesn't make them part of the protest group Anonymous.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview