5 ms·

His other article is really interesting in what data they collect https://smitop.com/post/whiteops-data/ https://smitop.com/post/whiteops-data/

deleted 5y ago
[deleted]
TechBro8615 5y ago
Has anyone done a MITM analysis of 3rd party clients like Apollo? I assume that using them affords a significant level of protection from any client-based Reddit tracking measures, but that’s only assuming Apollo doesn’t do something like add a unique User-Agent to each user’s request (and of course, Reddit can still collect the server-side IP/networking fingerprints).
- shostack 5y ago
  I'm likewise curious. I'm terrified to update for fear of what has been ruined next. But likewise am not sure putting this trust in a 3rd party is any better.
nimbius 5y ago
oof. running IE11 exploits (feels illegal here...), elevating to vbscript, testing the boundaries of the JIT, checking for screenshotting, observing for brave browser and communicating with two shady blank page sites... not since the port scanning from ebay have i seen something this reprehensible
- lawl 5y ago
  > not since the port scanning from ebay have i seen something this reprehensible That was the same company/script btw.
  - saruken 5y ago
    WhiteOps/HUMAN was behind the eBay thing too?
- amanzi 5y ago
  I know this may seem like a technical nit-pick, but it wasn't eBay specifically going out of their way to port scan your local machine. It's just that they decided to use one of the many third-party products in the marketplace to scan for bot activity that uses this technique. Protecting against bots is big business and the companies offering these services do all sorts of seemingly shady things to figure out if it's a bot or human visiting a site.
  - deleted 5y ago
    [deleted]
deleted 5y ago
[deleted]
eternityforest 5y ago
That's an amazing analysis!
superasn 5y ago
Wouldn't somebody running an actual Chrome/FF browser in Xvfb pass most of these tests - while use them as bots anyway? Pretty sure a t3 micro spot instance can run those so cost may not be an issue. Also, why would anybody running a bot use IE11 - which this code is trying to exploit? Pretty sure this bot is just an excuse for ads and retargeting.

deleted 5y ago

[deleted]

TechBro8615 5y ago

Has anyone done a MITM analysis of 3rd party clients like Apollo? I assume that using them affords a significant level of protection from any client-based Reddit tracking measures, but that’s only assuming Apollo doesn’t do something like add a unique User-Agent to each user’s request (and of course, Reddit can still collect the server-side IP/networking fingerprints).

shostack 5y ago
I'm likewise curious. I'm terrified to update for fear of what has been ruined next. But likewise am not sure putting this trust in a 3rd party is any better.

nimbius 5y ago

oof. running IE11 exploits (feels illegal here...), elevating to vbscript, testing the boundaries of the JIT, checking for screenshotting, observing for brave browser and communicating with two shady blank page sites... not since the port scanning from ebay have i seen something this reprehensible

lawl 5y ago
> not since the port scanning from ebay have i seen something this reprehensible That was the same company/script btw.
- saruken 5y ago
  WhiteOps/HUMAN was behind the eBay thing too?
amanzi 5y ago
I know this may seem like a technical nit-pick, but it wasn't eBay specifically going out of their way to port scan your local machine. It's just that they decided to use one of the many third-party products in the marketplace to scan for bot activity that uses this technique. Protecting against bots is big business and the companies offering these services do all sorts of seemingly shady things to figure out if it's a bot or human visiting a site.
- deleted 5y ago
  [deleted]

deleted 5y ago

[deleted]

eternityforest 5y ago

That's an amazing analysis!

superasn 5y ago

Wouldn't somebody running an actual Chrome/FF browser in Xvfb pass most of these tests - while use them as bots anyway? Pretty sure a t3 micro spot instance can run those so cost may not be an issue. Also, why would anybody running a bot use IE11 - which this code is trying to exploit? Pretty sure this bot is just an excuse for ads and retargeting.