Samy Kamkar

Might not be it but maybe Samy Kamkar is who you are looking for? https://samy.pl/

> Doesn't work if DevTools is undocked and will show false positive if you toggle any kind of sidebar. This annoys me every time because I use Tree Style Tab, and a website tries to detect DevTools. See Samy Kamkar's website [0]. [0]: https://samy.pl/

Reminds me of Samy's website. For a fun time, try to view the page source: https://samy.pl/

I can't remember much about images - but basically filtering out question-marks and equals symbols (i.e. ...thing.php?some=value) in a lot of places. I remember getting Facebook and when they first started their API it was a bit better thought out, so they loaded images on the user's behalf. Some great reading about 'hacking' myspace at the time: https://samy.pl/myspace/

That's a good question. Is there anything to stop a disreputable advertiser/tracker hijacking the EME DRM scheme for tracking? The evercookie project doesn't appear to leverage EME, for what that's worth. https://samy.pl/evercookie/

Yep. Not only is HTTPS stripping still a problem, but active attackers can do all sorts of other nasty things as well, like force the user's browser to initiate plaintext HTTP requests to non-HSTS sites and then use that to steal cookies from third party domains, or achieve persistent XSS by poisoning the user's browser cache. See https://samy.pl/poisontap/ for a great example of that attack in action.

> site showing the ads could easily fake Yes, that's what I mean by "unable to verify"; If the site is honest, everyone would be just as happy, but there is already so much fraud, even with (relatively) trustworthy Google and Facebook, that everyone wants some ability to verify; If all the traffic goes only through the site, that ability is lost. > Assuming that the advertising site would just have a proxy that tunnelled everything to the ad server, would the ad server not get the exact same traffic? Not exactly - the wide-sense-cookies[0] that allow the ad server to track users across different web sites would not be. Fingerprinting[1] would still work subject to advertisers trusting the proxy. [0] including flash objects, etags, localstorage, etc, see https://samy.pl/evercookie/ for a 7-year-old discussion. [1] https://panopticlick.eff.org/

I would highly recommend looking into this (seemingly-obscure) technique for NAT hole punching: https://samy.pl/pwnat/ It would allow for a "magic wormhole"-style system without the need for a MITM (trusted or otherwise).

A lot of them, yes. But there are techniques like browser profiling or persistent cookies[1] that still manage to trump a lot of them. The best blocker I've come across is ublock, amazingly memory efficient, fully customizable and featuring so many good block lists that it should block at least as much as ghostery or disconnect (if not more). Just the GUI looks a bit .. functional [1] http://samy.pl/evercookie/

The "source code" of http://samy.pl is quite interesting /* No source for you! *// /.source.replace(/.{7}/g,function(w){document.write(String.fromCharCode(parseInt(w.replace(/ /g,'0').replace(/ /g,'1'),2)))});

> Simply put, this is a proxy server that works behind a NAT, even when the client is behind a different NAT, without any 3rd party or network changes. > There is no middle man, no proxy, no 3rd party, no UPnP/STUN/ICE required, no spoofing, and no DNS tricks. http://samy.pl/pwnat/ The FAQ is great too :) Ok, so does this really work? Yes. Try it! I'm confused. This can't work. You should be, and it does work. But it can't. My NAT blocks incoming packets and so will the other. I know.

while I fully agree with your last part, the first part of your argument is dubious at best. it would be trivial to get away with a malicious access point in an airport. they helpfully provide charging stations for your electronics, and all it takes is an identically sized and shaped power brick to drop in a malicious access point. see http://samy.pl/keysweeper/ but modified with wifi instead of bluetooth and you get the idea.

Looking at the list of projects also done (by going to root of url) is quite impressive. http://samy.pl/

While on the topic of clever UDP-based NAT traversal techniques, I think my favorite to date is pwnat [http://samy.pl/pwnat/]. Uses ICMP in a clever way, requires no 3rd party.

This rendrers Tor ineffective if you're behind a Wifi router and have Javascript enabled. This guy's track record is impressive. He wrote the Myspace worm, PWNAT (client-server NAT to NAT penetration), the evercookie, and more. http://samy.pl/

I think disabling third-party cookies (via your browsers preference) would accomplish this (though it's no VM), with the added benefit of not needing to re-log in for each tab/window. This doesn't, however, block all tracking scripts, as some may get your IP via an embedded 1x1 gif or other request. There's still the issues of super-cookies, or Flash cookies, or scripts that embed a unique image in your cache and then read it out, etc. So for this I recommend AdBlock or Ghostery. Edit: Here's aseful link on this topic: http://samy.pl/evercookie/

That's circumstantial evidence at best. Here's more useless analytical evidence to suggest that most people don't know everything: when Samy Kamkar[0] first demonstrated geolocation via BSSIDs, I tried out every wireless router in my house, including one that had not been plugged into a wall in over 4 years and never at my current residence, long before Google started wardriving for street maps and well before the first iPhone came out. He was able to accurately map it to my old residence. That means that sometime before December of 2006, someone or something was able to snatch my BSSID from someplace, accurately note it's physical location in the world, and store that away in some database that was used almost 4 years later. I can guarantee you it was not Apple, and I'd be damned surprised if it was Google at that time. [0] http://samy.pl/mapxss/

I thought I was smart by doing "curl https://samy.pl/". :(

For those who may be curious, how two very similar products (USBNinja and the O.MG Cable) exist, there is a bit of history. Both products are based on the concept of a HID attack: most modern OSs (MacOS, Linux, Windows, Android...) trust HID (Human Interface Devices) implicitly. This means that when you plug in a Keyboard, Mouse, Storage device or Network device, they work instantly. You don't need to install drivers or explicitly enable them. The newly attached devices work instantly - even on a locked device. The advantage here is obvious. The disadvantage is more subtle, but was exploited by the Hak5 "Rubber Ducky". By emulating a HID device (or even worse, multiple HID devices simultaneously..) - you could essentially control a computer and deploy / execute anything, as if you had full control of the device. "The Classic" PoC is the Windows "Creds" attack [1] - which unlocks locked windows machines - later turned very, very nuclear by Samy Kamkar with PoisonTap [2], which essentially exfiltrates data, exfiltrates cookies and credentials, and permanently backdoors a locked PC. The idea of moving from a dedicated device (Rubber Ducky) to an embedded device first came to surface with the BadUSB device [3]. The idea of moving it into a cable came from the NSA, a device called COTTONMOUTH [4][6], which was leaked during the NSA document dumps [5]. MG, the designer of BadUSB, built a prototype of this with today's resources. RRG, the company behind the latest iterations…

This Wizard https://www.samy.pl/

See it here in action: http://samy.pl/

Even if patched/depracated, still a websocket to any ip-address with the packets as long as it can send the packet. Literally any chat applet. Torrent files, pretty much anything. It's not that scary at the moment. Browsers can do it now. It's an age old 'feature' -> https://github.com/garywill/LAN-port-scan-forbidder uBlock apparently blocks your browser from reaching out to your LAN though, but; no 'sandbox escapes' needed, just javascript being loaded. Our browsers could have been exploiting things behind NAT this entire time. Smart TVs, Smart watches, phones, anything pingable on your LAN. Go here and see it in action: http://samy.pl/webscan/

Isn't NAT slipstreaming a "real" vector? https://samy.pl/slipstream/

Samy Kumar did a project about 10 years back, where he worked out how to brute force a 12 bit garage door code in under 10 seconds, using a childs toy: http://samy.pl/opensesame/ My garage door opener uses a 12 but dip switch config (and my last place used an 8 dip switch config, and I'm pretty sure still does). Re reading that OpenSesame post was fun. It reminded me of a few names I need to go find out what they're up to these days (Travis Goodspeed and Michael Ossmann are names I remember seeing doing/writing-up some really cool stuff), and that the Mattel IM-ME toy he was using uses that same CC1110 "sub gHz"

For a bad actor, this is easily work-around-able using various local persistence mechanisms like evercookie. https://samy.pl/evercookie/

You can read about some things they did, and didn't! https://samy.pl/myspace/tech.html

I'll share a couple: - Branch prediction https://danluu.com/branch-prediction/ - How fast are Linux pipes anyway? https://mazzo.li/posts/fast-pipes.html - NAT Slipstreaming v2.0 https://samy.pl/slipstream/

Disabling UPnP makes your system more secure, but unless you also disable all NAT ALGs in your router, you're still exposed to its dangers. I don't think most routers have a setting for that, so if infected devices are part of your security model, it would be wise to assume NAT is entirely non-functional because of [NAT slipstream attacks](https://samy.pl/slipstream/). An infected device can modify the router's NAT table to effectively act like UPnP, except they don't provide a user interface for you to audit. If you're NAT free (i.e. only use IPv6) disabling UPnP can be a decent security measure if you're willing to manually do all of your firewall exclusions, but honestly host firewalls are the only reliable protection method for most people these days.

> Use a SIP Application Layer Gateway. This is a horrible feature offered by some routers. Basically, it deep-packet-inspects your SIP traffic, rewrites the headers, and creates port forwards on-the-fly to make sure the inbound audio stream makes its way to your device. SIP ALGs are a total hack and notoriously buggy. Yes, these hacky ALG features also allowed internet users to access internal IPs on arbitrary services (!); named “remote arbitrary firewall pinhole control”. The attack was published in 2020 and named NAT slipstreaming [1]. [1] https://samy.pl/slipstream/

https://unix.stackexchange.com/a/420281 Also: https://samy.pl/pwnat/