Custom Chromium Build to Reverse Engineer Pop-Under Trick

[@ELYESSS]

The popunder developer is gonna put a hit on you

[@neut1121]

HAHAHAHAHAHAHAHAH made my day

[@threeMetreJim]

Except that by showing people how to go about reverse engineering these things, then there will be too many people to put a hit out on. One less programmer won't make a dent, the beauty of sharing the details (assuming it can't help anyone else that might be malicious during the time the bug is being fixed).

[@Alexmagno7]

@@threeMetreJim it was clearly a joke but ok

[@kieranjohn81]

could say he is going to POP a cap 🕶

[@Rudxain]

They're gonna pop a vein lol

[@Pesthuf]

I can't help but admire those people for finding these bugs again and again. Reverse engineering them is one thing, but actually discovering them is really impressive. Don't get me wrong, I hate popunders as much as everyone here.

[@LiveOverflow]

Nono I get that. I’m impressed too! Hating pop under doesn’t mean I can’t appreciate finding crazy creative bugs to do it ;)

[@manuellopes1269]

@@LiveOverflow one question how download all files in the devtools ?i can save one file a time but i need save all files and if only one a time is very bad, is possible multi save files in menu sources?

[@andrisb1]

@@manuellopes1269 Not sure if it's possible in dev tools. I usually use a separate tool. For MacOS there is Site Sucker that clones the entire site. I remember linux had a few similar tools available as part of Kali Linux

[@manuellopes1269]

@@andrisb1 thanks bro , i not have linus only win10

[@ingeralhaosului]

For that debugger trap you can use the "never pause here " feature of the of chromes debugger by right clicking on the line number with the debugger statement.

[@Anonymouspock]

Wow, they really are giving the malware developers the finger. Good.

[@samus543654]

@@Anonymouspock The Chrome dev tools are incredible and most people use less than 1% of what they offer.

[@LiEnby]

haha thx google xD

[@puppy0cam]

that's fairly easy to bypass with a simple call to eval() since it creates a new "script" for that every time.

[@smithwillnot]

Thinking about this makes me realize that there is "battle" between greedy programmers who just want to find exploits to earn money (people who make those pop-under javascript libraries) and guys like you who try their best to quickly figure out their exploits and report them so that they get fixed. Now, every time pop-up/pop-under gets introduced I'll remember this, browsing the internet will never be the same again, at least for me. Thank you for your hard work!

[@quaternaryyy]

Also partly why bug bounty programs are so important!

[@ko-Daegu]

Aleksandar Delic Who also get paid when they report it hmmmmm

[@rabbitdrink]

Yes, security software engineers are constantly at war with greedy software engineers. Reverse engineering is fun, you should try it. It can even end up doing your homework for you, if your homework is on a site that doesn't have properly written code like iready if you have the world's most tedious tests to do too.

[@circuit10]

Hansbald Chromium is open source. It would also help the community

[@gafeht]

Aleksandar Delic Very loose usage of the word "earn" don't you think?

[@jamesherrero7334]

This actually taught me how to debug JavaScript properly 😂!! win win

[@Porama6400]

You are a pure genius! I'm sure those people who make library flips all the table in their office by now. Great job! Thank you for sharing it 😄

[@WolfrostWasTaken]

They are already thinking about a new way, I'm pretty sure, since there is big money involved. It's a constant war

[@Porama6400]

Seem like they having a hard time keeping up 😄😄

[@julius_trifinity]

But we're just having as much fun as they are

[@JohnDoe-hz1yh]

@LiveOverflow. Funny thing is that back in 2012 a ticket was opened to discuss if it would be possible to pass user gestures over postMessage. Back in 2012 it was quickly dismissed as too difficult to implement and too easy to exploit. Fast forward a couple of years and a couple of replies later this feature was implemented regardless and merged into master. So that discussion back in 2012 lead to this exact and predicted issue. bugs.chromium.org/p/chromium/issues/detail?id=161068.

[@LiveOverflow]

that's amazing! thanks for the background info

[@JohnDoe-hz1yh]

Simply put, the user gesture is a token that can be used to verify a event is initiated by the user. These tokens are thrown onto a stack from which privileged actions simply pop the first available token. If the stack is empty then the gesture was already consumed or the method was not user initiated. This verification becomes more difficult when your call stack is asynchronous and running in a diferent context (visualized at ~ 4:55 in the video ).

[@LiveOverflow]

yeah, that's kind of how I imagined it to work. keeping track of that is easy in a synchronous call, but as soon as it could run at anytime, it gets awful.

[@JohnDoe-hz1yh]

For anyone interested, the full scope of this issue can be in the following google doc. It also great practical information on how race conditions are created and the problems cause. docs.google.com/document/d/16BfnRRzCtd5nEyTp7vTI8qbCBMFAls0EKz5s0nJ5vKc/edit#heading=h.tkbr16in6mdm

[@hex7329]

As of December 2018 they are still using tab unders in Chrome 71. Nice work.

[@rajkhattar2830]

Even after watching so many of your videos , I'm still boggled by the way you think and approach security, bugs and programming in general. It just seems like second nature .... You find out what is to be done and boom! It's implemented. As a beginner , I still get stuck in implementing simplest of tasks, not able to "get" how I can implement something I want to in code , especially when I'm not familiar with the language ...It's highly motivating to watch experienced people like you as it inspires me to work hard till the time I can be as fluent as you are ...till the time code becomes second nature. Amazing video :)

[@LiveOverflow]

It is just experience over a long time ;)

[@dexterman6361]

@@LiveOverflow How long, if I may ask? Is it too late to start at 23?

[@bravosk8erboy]

Not many people on KZbin can say this but you actually make the internet a better place. Thank you

[@kyriii23]

Not only are you doing good work by finding these bugs. But you are also explaining and educating the process to get there. This so so entertaining and interesting! Thank you so much for sharing your thought process.

[@zeroangelmk1]

I'm no developer, but i'm glad this video popped under my recommendations.

[@7027-s6f]

Pope Ocelot not yet!

[@almarc]

LO - That totally makes sense! How didn't i understand that earlier? Me - Yeah, damn right. *Molten brain dripping down to floor*

[@definesigint2823]

Yeah, and I thought it was L0, not LO, so short for "level 0" (like a ring 0 message) until I read your comment. :/

[@smithwillnot]

You are the hero we need, but not the one we deserve!

[@georgigeeksky8349]

Thank you for that interesting video! And some people i'm sure are angry for that, but keep up the good work!!

[@BasiliskHill]

I mean, the people getting angry would also probably be going directly against the ToS and what the developers of the software want to have happen. So yeah, anger them; help out the devs.

[@Ariana-dn4mm]

Oh wow such a simple but effective method, was also expecting something completely insane.

[@EmanuelFrias]

Awesome!! Just in time when I should study for my finals!

[@daanvz2612]

The amount of work that you put into these video's is incredible. You are probably my favourite channel on KZbin right now. I'm currently studying cyber security and recommending your channel to everyone!

[@95mcat]

If I'm not mistaken you can right click on the number of the line in the dev tools and and choose "Never stop here" to get rid of the debugger

[@LiveOverflow]

It’s dynamically created (eval) code. Unfortunately this doesn’t work there

[@lifebarier]

Whoever is finding these chrome pop-under exploits - full respect. I would never think of anything like that.

[@DaffyDaffyDaffy33322]

1 minute of video watched and a quick glance at your other videos earned you an instant subscribe. This stuff is awesome.

[@cannuhlar8229]

If you clone the repo using --depth 1 arg you will end up with much smaller source code. ~4.5 GB

[@Xerdies]

I am somewhat sorry to hear that you went through all the trouble of compiling chrome. Still pretty cool :) Also subscribed - Guess I will watch more from you now.

[@LiveOverflow]

Don’t be! I was happy to have a reason to try it. Learned more stuff!

[@Xerdies]

Thats the best reply one could have given by far. Good view on such things :)

[@christiancastellanos4347]

I love your explanation process, each step is very detailed and your thinking methodology is well documented. Keep up the good work!

[@SkrekkLich]

What a great thriller! 10/10 would watch again!

[@xYouTubax]

Wow already fixed and integrated into chrome 67. Too few big players respond to bug reports that quick. Really nice to see. The library makers now need to sell as much licences as they can before chrome 67 hits :D

[@itsxxxiang3865]

In-page push is an extremely interesting ad format! I use MonadPlug in-page push, and cannot believe how much I am making just on this ad format only. Its most certainly the ad format of the future!!

[@JonathanGray89]

I'll be honest, I was quick in figuring out it was an async callback trick (as soon as I fully comprehended the timeline shown at 4:00). I expected you to look into using postMessage to open the popups as soon as you found it as the originator at 6:53. Very nice work though, keep it up.

[@fission1110]

This was so good. You're the batman of pop under bugs.

[@rajshah8143]

aweosme and unique tutorials...thanks for these videos...when most channels focus on using the pentesting tools...this channel really teaches us what underlying hacking is all about...one of my best channels on KZbin

[@metalpachuramon]

Awsome! Although I'm suspecting this type of videos will become a popular and requested entry in your channel

[@vonforum]

While I agree with you saying that you hate pop-unders, I still love them because I love seeing you reverse engineer obfuscated JS.

[@Kitsudote]

I always feel so ashamed when i overlook something obvious like the async functions.. glad to see it happens to the best :)

[@darkscissors1458]

These videos are so interesting, you should make more videos where you try to look at malicious code that is obfuscated and try to recreate it like this.

[@flaffen1902]

I've always thought something like Chromium source code is for gurus only. But when I watch how you just casually say "So I've decided to look into Chromium source code to figure out what's happening" and then actually make something useful out of this idea not knowing how it even works inside I get stunned. You seem to view it not as source code, but as a tree of abstractions. And you find and use these abstractions really well. My approach here would be to look for some articles on how Chromium works internally, maybe read Chromium docs, try to finally look at the source code and fail miserably. It's just too big. Plus I'm extremely unexperienced, maybe that's the reason I still look at source code with a bit of uncertainty and frustration. "Will I understand how it works? Do the devs provide good documentation? What if the source code is a mess" and so on. But watching your videos made me think about how I approach such tasks. Thank you, great work!

[@LiveOverflow]

I totally understand! I stopped being afraid of code and just looked into it. Sometimes it can be very complex and then I give up, but most of the time there is a simple function with a logical name somewhere.

[@TheAkashicTraveller]

It looks like it helps a lot knowing about frameworks like dom so that, when the dev's use them at least, you don't have to try guessing what such and such dev' decided to call it.

[@victornpb]

Usually the way I approach it is to look bottom-up and top-down, and try to guess and fill the in between, when trying to figure out how unknown code base works. Very similar to sources and sinks mindset.

[@JoJoModding]

Most programmers look at other code and read about programming, so there tends to be a common mindset about how to write and structure software. If you think about how you would structure your project if you were to try and build something similar, the result is quite likely going to be rather close to the thing you're trying to mimic. Also, if you look at class names and a few methods, you can often spot a few design concepts and then work from there.

[@protowalker]

Well, he knew he needed DOM, so he looked up what chromium's dom engine was and found that file. Then he ctrl f'd for create element. Code is usually broken up into pieces and it becomes a lot easier to understand after you isolate down to the level you need.

[@PhrontDoor]

That's why I used custom builds all the time (when I can).. it lets me get around DEBUG checks and lets me control how much detail I can view.

[@cristianiiacob]

Awesome work! Thanks for your contribution to us all chrome users.

[@not-yourbusiness]

U are incredibly strong into Brower Code and technnics gg can't wait to see what will be next

[@TF2Gaming101]

ignoring the pop-up blocker? you are a genius

[@austinmartin9515]

I know this is old, but you can use Burp to remove any debugger() statements so you can still use the Chrome debugger functionality

[@TonyVirelli]

You are the hero the world needs!

[@CsBence98]

LO was like, "I better download & build Chromium" and then "Oh cool, I didn't need it after all". I'd have been outraged :P Also, since you checked out Chromium, you are able to fix it up for yourself :D

[@TNothingFree]

Amazing work! JS can be really tricky, especially when trying to secure websites :)

[@Jellyg00se]

Well done mate, that was some good investigation work. Keep at it :)

[@felchore]

Very interesting video, I like how you present your thoughts and how your process information. Nice work !

[@x0acake]

I admire the bravery in diving into Chrome source code but FYI you should always assume its unnecessary. window/document/elements are all instances of the EventTarget prototype. So you can intercept every event listener with just: const orig = EventTarget.prototype.addEventListener; EventTarget.prototype.addEventListener = function(){ const [eventName, fn, capture] = arguments; console.log('someone tried to create event listener', eventName, 'for', this, 'with function ', fn); orig.apply(this, arguments); } If you run this in a userscript (with tampermoney) with @run-at document-start, it will capture event listeners before any other javascript has had a chance to load. I use this technique to modify web-based games.

[@hgbugalou]

You are doing God's work. People who lean on these techniques to 'advertise' are the scum of the earth. Seriously, who has ever, ever, made a purchase from a pop under ad? The lengths they go to these days makes me have zero sympathy for sites I use ad block on. Your methods of advertisement via annoying and tricking the end user are just reprehensible. Site owners that rely on ads need to reevaluate their designs that rely on these shady techniques.

[@yoshi314]

80gb of disk space to build chromium? that is insane! i haven't built it in years, but it was never this bad - at least on linux.

[@triularity]

Another option that might have been possible is to break the link to the script doing the popup (e.g. rename the key/function it's under) and hope whatever is referencing it to be triggered later aborts with an error.

[@gerot]

nice i think they might just updated it unless it already been out awhile just got the green update required sign on chrome =) i got it almost instantly while watching this video, great content as always!

[@MilMike]

78 GB of source code???? holy crap.... holy crap man. and god bless you for finding that annoyance, you are a hero!

[@LiveOverflow]

pure source code is much less. But you need this much disk space to build/compile it. It will generate massive amounts of intermediate build stages.

[@subcinericius]

Doing gods work right here!

[@flflflflflfl]

This channel is so much fun!

[@hblaub]

Cat and mouse in the browser ;-) awesome detective work

[@florianm.5128]

Amazing work and write-up. You are a hero :)

[@digitzero3613]

Amazing work as always Sir !

[@weiwenang1302]

This website teaches me more practical stuff than my university

[@s0lanav]

You really inspire me, thank you for making videos

[@khalidmkhan]

Nearly 100k subs! I thought I'd better sub and help you on your way! Great content.

[@morwar_]

Man this is amazing. Great video.

[@trieulieuf9]

Yayyy, Popunder is just tab-under now.

[@bulzika]

Why not call the original setTimeout function in the modified one, so that you log the function call and also do not break the code. This can also be applied to other interesting JavaScript functions, to get something like JavaScript instrumentation.

[@ealugovoy]

Amazing work, dear!

[@abe_is_live]

doing the lords work son

[@baldyardigan]

can the same things even be found using firefox? From watching this video I found out the Firefox developer tools are quite different.

[@AneeshDogra]

You are so cool LiveOverflow. Amazing video.

[@tommytomtomtomestini3894]

For the longest time, I've wanted a setting in browsers that would suppress ALL open tab/window functions no matter where the call came from. This setting should be easily accessible so I can allow popup for say, the bank or better yet, create a white list of domains for it. Thought of hacking it together into a custom built Firefox, but then I got lazy because I thought of all the FF updates and I'd have to rebuild and maintain the feature.

[@victornpb]

this is easily doable with built-in blocker rules, I suppose

[@tommytomtomtomestini3894]

Yeah I know about that feature, but it still lets a lot of popups through. My implementation would be more blunt by just returning from window.open() method in C++ codebase without executing anything at all.

[@essamal-mansouri2689]

You can probably do that with a plugin or something that inserts window.open equal to some function that doesn't do anything at the top of every page visited. Also, if you actually did have to custom build Firefox, the process of merging new changes, rebuilding and installing the updates on your PC could be largely automated.

[@Sypaka]

You mean "Permissions" on JavaScript? Do it!

[@TheTrueSmitch]

Amazing work!

[@GameCode64]

@LiveOverflow why dont you use Alert() as an breakpoint when the script stops the debugger?

[@LiveOverflow]

Mmhmhmhmmhmhmhhmhmmhmhmmhm. Never thought about that :D

[@confuseh]

removing debugger break behavior would be handy but keeping up with the repo updates could be a pain

[@omri9325]

It has some limitations. After you call alert native events stops propagating. It might be true for postMessage too.

[@0xbenedikt]

Why can't you just do a search & replace of all debugger statements and delete them?

[@LiveOverflow]

The debugger statements are inside obfuscated strings that get decrypted and evaled etc.

[@solidsnake8392]

You are a beast! Great video 😄

[@Mynameisfrancesco96]

I would like to see one of your videos about code virtualization and obfuscation. For example VMProtect on windows or any other software that virtualize and obfuscate the assebly of an executable. I obiously don't ask for a guide to reverse it, but just a quick analisys and explaination on how they works. It would be interesting to me. Thank you and great work with this channel.

[@RobertGallop]

Awesome game of cat and mouse going on, GOOD WORK!

[@DiThi]

3:50 I would then call the actual timeout function, but only when it's not calling debugger. There's many ways you can identify the unwanted calls. Maybe just ignoring the calls with 5000 ms. (editing comment as I watch the video) 7:00 That's obviously a web worker. 14:25 Huh, no web worker necessary?

[@janliebrecht1994]

Really great work, highly aprreciate it =)

[@pomelopy]

seem like that use artistscope to protect video, have firefox custom aplication

[@Itneesh]

That's just one awesome video :) Thank you

[@f1ggyc]

Could you use the custom build to disable the debugger statement?

[@cjreek]

I'm curious how Google would fix that. Disallow postMessage in onclick-Handlers? Disallow window.open in the message-eventlistener? Both seem to come with possibly unwanted sideeffects that might break harmless code.

[@liteoner]

They've fixed it already: bugs.chromium.org/p/chromium/issues/detail?id=833148

[@cjreek]

Nice! I might view the diffs and try to understand how they fixed it.

[@nolifeorname5731]

Great video! Nice find

[@firstlast9251]

What font were you using in Sublime?

[@planktonfun1]

postmessage allows javascript to send messages from page to tab, page to page, page to locally, doesnt work on IE though.

[@MihkelKukk]

doing gods work here

[@waqarahmed4200]

Fabian God mode activated ✔️

[@jasondads9509]

what is a popunder?

[@GottZ]

dude. just create a stack trace in settimeout and check if it matches the debugger location. you could also tostring the callback and check if it matches.

[@RaduPopescu000]

Great find! (and a nice trick)

[@lels3618]

How about creating a webworker and he triggers 2 meesage events which then trigger popups?

[@LiveOverflow]

I don’t know, try it ;)

[@boem231]

Why not do a popup but the popup is the same website and the old website changes

[@Trankass]

This channel is awesome

[@mariustancredi2192]

His code is obfuscated with an open source obfuscation engine, there are a few template that the engine uses to detect unminimization and tampering of anti-debugging code, the templates are here, could help you recognize a few code pattern that this engine generates: github.com/javascript-obfuscator/javascript-obfuscator/tree/master/src/templates Basically, the code will match a few small functions with RegExp and enters an infinite loop or just throw an error if the test fails. The template code tries to decoy itself as a library (e.g. cookie manipulation functions), also sometimes it uses Unicode to mask difference in two strings, a lot of good tricks.

[@abc32167]

I just set option in browser to always open everything in new tab. I just don't see any reason to have multiple browser windows. Never have any problem with popups.

Got curious if popupunder works for current chrome v77 but I cant find its homepage. :D Hilarious! Good work!

[@kabal321321]

"Fixed, will request a merge to M67 on Monday."

[@lolxnn]

but why it still works? Haven't they fixed it

[@NefzaouiAhmed]

dude u got me subscribed after watching 1 minute in

[@mikelinsi]

Wow, nice work 👍

[@samfoxman7046]

You could modify V8 to change the debugger keyword to something else, the anti-debugger wouldn't work and you could add the custom keyword to trigger the debugger

[@LiveOverflow]

yeah, that was also an Idea I had. Maybe looking into that next time ;)

[@MuscleTeamOfficial]

Do it.

[@dantenotavailable]

Aaand 5 days after the initial report there's a patch commited to the repo... Props to all. I love this continuing battle between popunder libraries and LiveOverflow.

[@jagc2206]

That's some crazy build time, about 5 times of firefox on my I 975k

[@ms2649]

The popunder "owner " must hate you really badly for doing this 😆