3 ms·

> without any proxying (did I get that right and has the author studied it carefully enough?). Most likely, since the user-agent rotation code is in the app it

by judge2020 5y ago

> without any proxying (did I get that right and has the author studied it carefully enough?). Most likely, since the user-agent rotation code is in the app itself. If it were a Telegram proxy, the proxy would do its own UA and IP hopping and the clients would use their default UAs. At a certain point, I wonder why Google's abuse team don't simply look for 3+ occurrences of User Agent strings because UA rotation is rarely used for legitimate purposes.

skinkestek 5y ago
These days Google isn't up to much on a technical level ;-) They cannot even fix the old verbatim feature that they broke a few years ago, so how should should they be able to stop this without breaking something else? Yep, this is somewhat hyperbolic but I'll write it anyway. I want my old Google back.
- ehPReth 5y ago
  Tools -> All Results -> Verbatim is confirmed broken? I thought something was fishy...
  - skinkestek 5y ago
    Hasn't worked consistently for me for years. To be precise: I think it work sometimes, but I know it doesn't work most of the time unless verbatim means something completely different from what I think ;-) You can verify this quickly by searching for something slight unusual or very specific, apply verbatim and verify that most of the results still doesn't contain your words.
Const-me 5y ago
> UA rotation is rarely used for legitimate purposes It’s not uncommon for hundreds of users to share a single public IPv4 IP address through an ISP-provided NAT. The same applies to corporate LANs with a single uplink channel. These users gonna have random UA corresponding to market share of web browsers and operating systems, all coming to the same web server from a single IP address.
- judge2020 5y ago
  I mean on the play store side, where they scan app submissions for TOS violations before they even hit the store. UA rotation on the client side is rarely used for good.
  - fao_ 5y ago
    HTML requests are just text, how would you even go about scanning for that?
    - judge2020 5y ago
      As from the blog post, the source is public[0] and the Android review process is almost entirely automated static/dynamic analysis of apps submitted, so it wouldn't be super hard to find UA-like strings and have some elevated manual review if there are a lot of them (if they decided to implement this sort of abuse policy). 0: https://github.com/DrKLO/Telegram/blob/c1c2ebaf4690fd91c116d80db653289c9447ef7a/TMessagesProj/src/main/java/org/telegram/ui/Components/TranslateAlert.java#L1066 https://github.com/DrKLO/Telegram/blob/c1c2ebaf4690fd91c116d...
      - fao_ 5y ago
        Google very likely only scans the input application, I'm not sure why you would bother with an automated system to detect a code repo for it when the majority of applications on the Play Store are closed-source and there's a low confidence if the builds are not repeatable. Anyway, regardless of that it sounds like it would be easily defeated with the following C format string: "%s-%s: %s/%s (%s) %s/%s %s/%s" with argument list: "User", "Agent", "Mozilla", "5.0", "X11; Ubuntu; Linux x86_64", "Gecko", "2010000", "Firefox", "90.0" For bonus points you can make those floating points, too, and split it up a bit further. Now nobody can scan for this without a lot of false positives (The strings are going to display in anything that embeds a web browser or references it, lol) and you get ultimate flexibility.
  - Const-me 5y ago
    I think that’s only possible if they ban TCP/IP for play store apps, enforce that in the OS kernel (SELinux can probably do), and instead expose the one and only high-level HTTP API for apps.

skinkestek 5y ago

These days Google isn't up to much on a technical level ;-) They cannot even fix the old verbatim feature that they broke a few years ago, so how should should they be able to stop this without breaking something else? Yep, this is somewhat hyperbolic but I'll write it anyway. I want my old Google back.

ehPReth 5y ago
Tools -> All Results -> Verbatim is confirmed broken? I thought something was fishy...
- skinkestek 5y ago
  Hasn't worked consistently for me for years. To be precise: I think it work sometimes, but I know it doesn't work most of the time unless verbatim means something completely different from what I think ;-) You can verify this quickly by searching for something slight unusual or very specific, apply verbatim and verify that most of the results still doesn't contain your words.

Const-me 5y ago

> UA rotation is rarely used for legitimate purposes It’s not uncommon for hundreds of users to share a single public IPv4 IP address through an ISP-provided NAT. The same applies to corporate LANs with a single uplink channel. These users gonna have random UA corresponding to market share of web browsers and operating systems, all coming to the same web server from a single IP address.

judge2020 5y ago
I mean on the play store side, where they scan app submissions for TOS violations before they even hit the store. UA rotation on the client side is rarely used for good.
- fao_ 5y ago
  HTML requests are just text, how would you even go about scanning for that?
  - judge2020 5y ago
    As from the blog post, the source is public[0] and the Android review process is almost entirely automated static/dynamic analysis of apps submitted, so it wouldn't be super hard to find UA-like strings and have some elevated manual review if there are a lot of them (if they decided to implement this sort of abuse policy). 0: https://github.com/DrKLO/Telegram/blob/c1c2ebaf4690fd91c116d80db653289c9447ef7a/TMessagesProj/src/main/java/org/telegram/ui/Components/TranslateAlert.java#L1066 https://github.com/DrKLO/Telegram/blob/c1c2ebaf4690fd91c116d...
    - fao_ 5y ago
      Google very likely only scans the input application, I'm not sure why you would bother with an automated system to detect a code repo for it when the majority of applications on the Play Store are closed-source and there's a low confidence if the builds are not repeatable. Anyway, regardless of that it sounds like it would be easily defeated with the following C format string: "%s-%s: %s/%s (%s) %s/%s %s/%s" with argument list: "User", "Agent", "Mozilla", "5.0", "X11; Ubuntu; Linux x86_64", "Gecko", "2010000", "Firefox", "90.0" For bonus points you can make those floating points, too, and split it up a bit further. Now nobody can scan for this without a lot of false positives (The strings are going to display in anything that embeds a web browser or references it, lol) and you get ultimate flexibility.
- Const-me 5y ago
  I think that’s only possible if they ban TCP/IP for play store apps, enforce that in the OS kernel (SELinux can probably do), and instead expose the one and only high-level HTTP API for apps.