Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse Engineering an Eclipse Plugin

0x10f8.wordpress.com

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Reverse Engineering an Eclipse Plugin

#11

Post by contravariant »

philbarr wrote: post #6

Original author doing a pretty bad job of explaining himself [0]. Mainly: Anyone who does not like it, please uninstall this plugin. I will not explain it anymore. I'm not interested in stealing your privacy. [0] https://github.com/cnfree/Eclipse-Class-Decompiler/issues/30

The only acceptable explanation would be that they weren't aware and didn't intend for this to happen.

Any other scenario means that they intentionally and secretly included code into their compiled binaries which posed a security and privacy risk.

Re: Reverse Engineering an Eclipse Plugin

#12

Post by nerdponx »

contravariant wrote: post #11
philbarr wrote: post #6

Original author doing a pretty bad job of explaining himself [0]. Mainly: Anyone who does not like it, please uninstall this plugin. I will not explain it anymore. I'm not interested in stealing your privacy. [0] https://github.com/cnfree/Eclipse-Class-Decompiler/issues/30

The only acceptable explanation would be that they weren't aware and didn't intend for this to happen. Any other scenario means that they intentionally and secretly included code into their compiled binaries which posed a security and privacy risk.

I wonder about the nature of this scam. It almost looks like it's designed to spoof ad clicks, not direct the user to them.

Re: Reverse Engineering an Eclipse Plugin

#13

Post by nerdponx »

jjjensen90 wrote: post #4
hiram112 wrote: post #3

Good writeup on the reverse engineering. I'm still a little confused as to what the code was doing, though. It gathers statistics about your user machine (none of which seemed too personal - basically IP, OS, country, etc). But then what is it doing? Opening a virtual browser or simulating clicks to some ad network?

Seems to me that it is indeed running a hidden browser on a background thread, loading ads, and simulating views/clicks. That is in addition to collecting and sending user and system information (possibly also for ad-serving or information sales or some other nefarious skulduggery).

I wonder if this was actually an attempt to scam the advertisers into thinking they were receiving genuine add traffic, in order to get affiliate revenue. Using actual customer data might have prevented the advertisers from getting suspicious.

Re: Reverse Engineering an Eclipse Plugin

#14

Post by guildan »

The plugin that is inspected in this article is now delisted in the Eclipse Marketplace. You can't download it from there anymore (Checked with STS 3.9.0.RELEASE). A new fork without the ad related code as been publish and you can inspect the code on https://github.com/ecd-plugin/ecd .

It's nice to see the community stepping in to "fix" the situation.

Re: Reverse Engineering an Eclipse Plugin

#16

Post by 0xfeba »

nerdponx wrote: post #12
contravariant wrote: post #11

Earlier quoted context omitted.

The only acceptable explanation would be that they weren't aware and didn't intend for this to happen. Any other scenario means that they intentionally and secretly included code into their compiled binaries which posed a security and privacy risk.

I wonder about the nature of this scam. It almost looks like it's designed to spoof ad clicks, not direct the user to them.

Should contact the ad providers, they'd be happy to chargeback with proof of fraud.

Re: Reverse Engineering an Eclipse Plugin

#17

Post by slig »

lsaferite wrote: post #10
jjjensen90 wrote: post #4

Earlier quoted context omitted.

Seems to me that it is indeed running a hidden browser on a background thread, loading ads, and simulating views/clicks. That is in addition to collecting and sending user and system information (possibly also for ad-serving or information sales or some other nefarious skulduggery).

A simple thing would be to trigger a visit to a site using a JS coin miner if it's running JS in the hidden browser.

It would be more efficient and simple to just run a miner in Java.

Re: Reverse Engineering an Eclipse Plugin

#18

Post by 0xfeba »

nerdponx wrote: post #13
jjjensen90 wrote: post #4

Earlier quoted context omitted.

Seems to me that it is indeed running a hidden browser on a background thread, loading ads, and simulating views/clicks. That is in addition to collecting and sending user and system information (possibly also for ad-serving or information sales or some other nefarious skulduggery).

I wonder if this was actually an attempt to scam the advertisers into thinking they were receiving genuine add traffic, in order to get affiliate revenue. Using actual customer data might have prevented the advertisers from getting suspicious.

By and large, that's exactly what it was doing, getting ad revenue. The second part also sounds plausible, but it would need to use this as the user agent during the actual clicks.

Re: Reverse Engineering an Eclipse Plugin

#19

Post by 0xfeba »

contravariant wrote: post #11
philbarr wrote: post #6

Original author doing a pretty bad job of explaining himself [0]. Mainly: Anyone who does not like it, please uninstall this plugin. I will not explain it anymore. I'm not interested in stealing your privacy. [0] https://github.com/cnfree/Eclipse-Class-Decompiler/issues/30

The only acceptable explanation would be that they weren't aware and didn't intend for this to happen. Any other scenario means that they intentionally and secretly included code into their compiled binaries which posed a security and privacy risk.

From an earlier response in the same thread:

> These codes never worked on user machine. They were used for patching plugin bugs.

Uh huh. If it was such a benign use, why wasn't it in the repository, or mentioned in the marketplace page?

Re: Reverse Engineering an Eclipse Plugin

#20

Post by lvoudour »

jjjensen90 wrote: post #4
hiram112 wrote: post #3

Good writeup on the reverse engineering. I'm still a little confused as to what the code was doing, though. It gathers statistics about your user machine (none of which seemed too personal - basically IP, OS, country, etc). But then what is it doing? Opening a virtual browser or simulating clicks to some ad network?

Seems to me that it is indeed running a hidden browser on a background thread, loading ads, and simulating views/clicks. That is in addition to collecting and sending user and system information (possibly also for ad-serving or information sales or some other nefarious skulduggery).

I'm surprised he wasn't mining bitcoins on the side :)
Post reply on HN