News for hackers. Stuff that matters.
Re:Google Chrome to remove detailed cookie and site data con... by duskwuff on Friday September 03, 2021 @04:39PM (#28409138)
This has absolutely been used "in the wild". One particularly nasty strain of ad-block-evasion scripts would detect the developer tools being opened, and would reload the page and disable most of its features to prevent them from being analyzed.
Re:Google Chrome to remove detailed cookie and site data con... by sroussey on Friday September 03, 2021 @05:16PM (#28409516)
Way back when, we thought about this for Firebug. One thing that came out of it was browsers started adding the console object (also because devs forgot to remove the calls on it).

Even so, we added CSS and stuff to highlight elements and that was easily found.

What do people look for today?

Re:Google Chrome to remove detailed cookie and site data con... by duskwuff on Friday September 03, 2021 @05:53PM (#28409840)
The two big ones are:

1. Watching window.innerHeight/innerWidth for sudden, large decreases, indicating that the user just opened the inspector.

2. Logging objects to the console with toString methods and checking if that method gets called.

Re:Google Chrome to remove detailed cookie and site data con... by DaiPlusPlus on Friday September 03, 2021 @09:53PM (#28411394)
1. That could also be triggered by browser sidebar windows opening though. All of my browsers open dev-tools in a separate window so this is far from foolproof.

2. Ahhh, clever!

Re:Google Chrome to remove detailed cookie and site data con... by hutzlibu on Friday September 03, 2021 @07:24PM (#28410544)
1. should be trivial to avoid, by opening dev tools in a new window

but 2. I have no idea, except the browser vendors would add a "stealth dev mode"

Re:Google Chrome to remove detailed cookie and site data con... by petre on Friday September 03, 2021 @11:50PM (#28411922)
2. JSON.stringify(object)
Re:Google Chrome to remove detailed cookie and site data con... by hutzlibu on Saturday September 04, 2021 @06:20AM (#28413760)
But isn't the point that you want to detect what the foreign code does?

So your solution would require inject your code into the code that wants to hide from you ... ?

Re:Google Chrome to remove detailed cookie and site data con... by lmm on Saturday September 04, 2021 @08:47AM (#28414585)
I think the idea is you patch the console to display the objects without calling their toString methods.
Re:Google Chrome to remove detailed cookie and site data con... by BoorishBears on Saturday September 04, 2021 @11:04AM (#28415732)
I don't think that works

I might be off here, but I imagine console.log early exits if there's no console open, so it doesn't call toString

If that's the case you can just write to the console in a loop and immediately know if one is open

Re:Google Chrome to remove detailed cookie and site data con... by lmm on Sunday September 05, 2021 @09:43PM (#28429442)
> I might be off here, but I imagine console.log early exits if there's no console open, so it doesn't call toString

The point is to avoid calling toString when the console is open, by using some other way of displaying logged values.

Re:Google Chrome to remove detailed cookie and site data con... by BoorishBears on Wednesday September 08, 2021 @09:00PM (#28464994)
I'm saying you can't avoid calling toString.

Their code will call console.log(object) every X ticks.

As soon as you open the console, console.log fires instead of early exiting => object.toString is called => they know the console is open

Re:Google Chrome to remove detailed cookie and site data con... by sroussey on Thursday September 09, 2021 @05:35PM (#28474949)
Well… you can on a lot of things. We never did .toString() on a whole lot. However, I was big on .displayName (as an override on .name which is found on functions)

My memory is fuzzy, but I also had a different function I would call if frameworks added it so instead of “Object {}” it was “Backbone.Model {id=1}”.

I put these in and used them in firebug extensions I wrote for frameworks.

Later I asked chrome to add something, which is why there is a “enable custom formatters” option for the console. Really needs to work in the debugger though.

Re:Google Chrome to remove detailed cookie and site data con... by BoorishBears on Sunday September 12, 2021 @04:18AM (#28499459)
Do you not understand that it's not your code and that their code wants toString to be called?

Someone else is writing code that they want to have react to the console opening.

So they will intentionally force the call as soon as the console is open, as a result toString is called regardless of if you yourself have made a call to it.

Re:Google Chrome to remove detailed cookie and site data con... by lmm on Thursday September 09, 2021 @10:26PM (#28477088)
> console.log fires instead of early exiting => object.toString

The point is that you patch the console to not do that.

Re:Google Chrome to remove detailed cookie and site data con... by BoorishBears on Sunday September 12, 2021 @04:19AM (#28499462)
How does "JSON.stringify(object)" patch the console not to do that without first opening the console?
Re:Google Chrome to remove detailed cookie and site data con... by joombaga on Saturday September 04, 2021 @10:34AM (#28415493)
For 2 my first thought is the opposite. Fire the detected method even if devtools isn't opened.
Re:Google Chrome to remove detailed cookie and site data con... by BoorishBears on Friday September 03, 2021 @06:45PM (#28410274)
The ad-block thing is where I first saw it, that and DRM for less-than-legal sites to prevent downloading (stops streaming if the dev console is open)

I mean more specifically taking advantage of the awkward UI to cover up your tracks on local storage, it's something that's just devious enough that if you get caught (which is not difficult) it'll be hard to explain what you were doing, and you'll be trying to explain it to technical people