> The firm worked with a Facebook engineer and wrote a program that would attach an exploit taking advantage of a flaw in Tails’ video player to reveal the real IP address of the person viewing the video.

Pretty strange. Shouldn’t the computer’s IP be like 192.168.0.1 or something? Maybe it took a traceroute (over public internet) and sent that away?

I assume it didn't "detect" the address so much as it was able to make some kind of a network connection to an external server without going through Tor.