5 ms·

Building a Botnet on ServiceWorkers

37 points by Capira 10y ago

comboy 10y ago
I opened the js fiddle and I can't see any Service Workers running in chrome inspector. Also, since that seems to be an actual image, how does the JS get executed? I see a Link header, but why would something get executed because of it? Edit: Oh, it's running indeed ( chrome://inspect/#service-workers )
- Aaron1011 10y ago
  IIRC, service workers allow you to intercept all requests made by the page, for the purposes of implementing offline caching.
  - comboy 10y ago
    Right, but you need to execute some JS to set them up, and the example only shows img tag.
    - detaro 10y ago
      No, the Link-tag with rel=serviceworker on the image response installs the service worker. Not clear (to me) if that's part of the origin trial or not.
      - comboy 10y ago
        That seems to be the case, it seems really weird that it's allowed though, especially from a different domain.
      - youngtaff 10y ago
        The link tag with rel=serviceworker behaviour here is part of 'Foreign-Fetch' - an experiment too allow third-parties to install a serviceworker e.g. analytics provider could install a SW that handles analytics offline so a developer doesn't need to. I think the origin-trial for this expires early next year. https://developers.google.com/web/updates/2016/09/foreign-fetch https://developers.google.com/web/updates/2016/09/foreign-fe... https://groups.google.com/a/chromium.org/forum/#!topic/Blink-dev/sIzHpZVhmBE https://groups.google.com/a/chromium.org/forum/#!topic/Blink...
lowglow 10y ago
Just launched Wolfpack, a little botnet (distributed task-based agents). You can check it out here: https://github.com/dpgailey/wolfpack https://github.com/dpgailey/wolfpack
chadscira 10y ago
I can't believe its delivered via headers Link:</sw?728997763>; rel="serviceworker"; scope="/646166204" Origin-Trial:AglMWHYLtMNT8FVZp9u368r0HZPKh7Pjfm7WYEyHwKz4zwaSznv682Bckrz903mz54CVZQACD5ZlSrLpuh8CKQIAAABYeyJvcmlnaW4iOiAiaHR0cHM6Ly90cnVlZmFjdG9yLmlvOjQ0MyIsICJmZWF0dXJlIjogIkZvcmVpZ25GZXRjaCIsICJleHBpcnkiOiAxNDg0OTM2NzI3fQ== Scary stuff, I havent had a chance to play with any of this stuff yet... https://developers.google.com/web/updates/2016/09/foreign-fetch https://developers.google.com/web/updates/2016/09/foreign-fe... Can chrome revoke your origin trial token?

37 points by Capira 10y ago

I opened the js fiddle and I can't see any Service Workers running in chrome inspector. Also, since that seems to be an actual image, how does the JS get executed? I see a Link header, but why would something get executed because of it? Edit: Oh, it's running indeed ( chrome://inspect/#service-workers )

Aaron1011 10y ago
IIRC, service workers allow you to intercept all requests made by the page, for the purposes of implementing offline caching.
- comboy 10y ago
  Right, but you need to execute some JS to set them up, and the example only shows img tag.
  - detaro 10y ago
    No, the Link-tag with rel=serviceworker on the image response installs the service worker. Not clear (to me) if that's part of the origin trial or not.
    - comboy 10y ago
      That seems to be the case, it seems really weird that it's allowed though, especially from a different domain.
    - youngtaff 10y ago
      The link tag with rel=serviceworker behaviour here is part of 'Foreign-Fetch' - an experiment too allow third-parties to install a serviceworker e.g. analytics provider could install a SW that handles analytics offline so a developer doesn't need to. I think the origin-trial for this expires early next year. https://developers.google.com/web/updates/2016/09/foreign-fetch https://developers.google.com/web/updates/2016/09/foreign-fe... https://groups.google.com/a/chromium.org/forum/#!topic/Blink-dev/sIzHpZVhmBE https://groups.google.com/a/chromium.org/forum/#!topic/Blink...

lowglow 10y ago

Just launched Wolfpack, a little botnet (distributed task-based agents). You can check it out here: https://github.com/dpgailey/wolfpack https://github.com/dpgailey/wolfpack

chadscira 10y ago

I can't believe its delivered via headers Link:</sw?728997763>; rel="serviceworker"; scope="/646166204" Origin-Trial:AglMWHYLtMNT8FVZp9u368r0HZPKh7Pjfm7WYEyHwKz4zwaSznv682Bckrz903mz54CVZQACD5ZlSrLpuh8CKQIAAABYeyJvcmlnaW4iOiAiaHR0cHM6Ly90cnVlZmFjdG9yLmlvOjQ0MyIsICJmZWF0dXJlIjogIkZvcmVpZ25GZXRjaCIsICJleHBpcnkiOiAxNDg0OTM2NzI3fQ== Scary stuff, I havent had a chance to play with any of this stuff yet... https://developers.google.com/web/updates/2016/09/foreign-fetch https://developers.google.com/web/updates/2016/09/foreign-fe... Can chrome revoke your origin trial token?