3 ms·

How can you detect it? Which websites refuse to activate their features if the debugger is active?

by _gyhb 4y ago

hericium 4y ago
I've had the opposite experience: parts of websites broken by tracking blocker started working after popping debugger up.
runlevel1 4y ago
The one I've seen before does the following: A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open. Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.
- _gyhb 4y ago
  I'm unsure if that would work for this extension. Do you have a link to an implementation?
  - runlevel1 4y ago
    I'm not familiar with what happens when `debugger` is eval'd while attached using the debugger API. If it ignores it, you're fine. This method and a few others are described in this paper: https://www.usenix.org/system/files/sec21-musch.pdf https://www.usenix.org/system/files/sec21-musch.pdf The debugger timing method is described on page 10.
    - _gyhb 4y ago
      I don't think that method would work for detecting extension debugging.
  - VWWHFSfQ 4y ago
    There are a bunch of sophisticated ways to obfuscate it, but it basically boils down to: <script> setInterval(function() { try { let before = new Date().getTime(); // This will pause the program execution if debugging is enabled. // If debugging isn't enabled this statement is a no-op. debugger; let after = new Date().getTime(); // Detect if the program was paused or not. if (after - before > 0.01) { // > 10ms difference? The program was (most likely) paused by the debugger. document.body.innerHTML = "<h1>Debugging started</h1>"; } } catch(e) {} }, 1000); </script> There are some other ways to detect it by implementing various prototype methods and continually logging the object to the console. The methods are only invoked if the dev console is opened.
    - _gyhb 4y ago
      Doesn't seem like this work for detecting the extension.
      - VWWHFSfQ 4y ago
        I'm able to get it to trigger on about ~10-20% of page reloads with your extension activated. Never when it isn't. Maybe it's just a matter of tuning the interval and detection threshold?
  - TechBro8615 4y ago
    I don’t have a link offhand but I’ve seen this code while debugging some pirate sports streams. The next upcoming one to check would be an NBA game from “nba bite” (Google it, it’s the offshoot of the banned sports streaming subreddits.) I think you’re probably right that it wouldn’t detect presence of your extension, since that code runs in its own context and I assume doesn’t actually call the debugger. If your extension injects a script into the page, then that could be detected with this technique or similar.

How can you detect it? Which websites refuse to activate their features if the debugger is active?

by _gyhb 4y ago

How can you detect it? Which websites refuse to activate their features if the debugger is active?

I've had the opposite experience: parts of websites broken by tracking blocker started working after popping debugger up.

runlevel1 4y ago

The one I've seen before does the following: A javascript file, whose name changes with every refresh, is loaded. The script calls the `debugger` keyword, which only functions when you have DevTools open. Meanwhile, a tickers is running. If a tick takes too long, it interprets that as the debugger having been called.

_gyhb 4y ago
I'm unsure if that would work for this extension. Do you have a link to an implementation?
- runlevel1 4y ago
  I'm not familiar with what happens when `debugger` is eval'd while attached using the debugger API. If it ignores it, you're fine. This method and a few others are described in this paper: https://www.usenix.org/system/files/sec21-musch.pdf https://www.usenix.org/system/files/sec21-musch.pdf The debugger timing method is described on page 10.
  - _gyhb 4y ago
    I don't think that method would work for detecting extension debugging.
- VWWHFSfQ 4y ago
  There are a bunch of sophisticated ways to obfuscate it, but it basically boils down to: <script> setInterval(function() { try { let before = new Date().getTime(); // This will pause the program execution if debugging is enabled. // If debugging isn't enabled this statement is a no-op. debugger; let after = new Date().getTime(); // Detect if the program was paused or not. if (after - before > 0.01) { // > 10ms difference? The program was (most likely) paused by the debugger. document.body.innerHTML = "<h1>Debugging started</h1>"; } } catch(e) {} }, 1000); </script> There are some other ways to detect it by implementing various prototype methods and continually logging the object to the console. The methods are only invoked if the dev console is opened.
  - _gyhb 4y ago
    Doesn't seem like this work for detecting the extension.
    - VWWHFSfQ 4y ago
      I'm able to get it to trigger on about ~10-20% of page reloads with your extension activated. Never when it isn't. Maybe it's just a matter of tuning the interval and detection threshold?
- TechBro8615 4y ago
  I don’t have a link offhand but I’ve seen this code while debugging some pirate sports streams. The next upcoming one to check would be an NBA game from “nba bite” (Google it, it’s the offshoot of the banned sports streaming subreddits.) I think you’re probably right that it wouldn’t detect presence of your extension, since that code runs in its own context and I assume doesn’t actually call the debugger. If your extension injects a script into the page, then that could be detected with this technique or similar.