Reverse Engineering an Eclipse Plugin
0x10f8.wordpress.com
Reverse Engineering an Eclipse Plugin
1–10 of 20 posts
Re: Reverse Engineering an Eclipse Plugin
#2Guess author of the plugin is pretty smart but not smart enough to encrypt the traffic back home or obscure his/her nasty secrets.
I guess it might be keeping the black stuff for some cool down time just after installation. Many malware seem to do there days. We might have got true clicks targeted.
Re: Reverse Engineering an Eclipse Plugin
#3Good writeup on the reverse engineering.
I'm still a little confused as to what the code was doing, though. It gathers statistics about your user machine (none of which seemed too personal - basically IP, OS, country, etc).
But then what is it doing? Opening a virtual browser or simulating clicks to some ad network?
Re: Reverse Engineering an Eclipse Plugin
#4Good writeup on the reverse engineering. I'm still a little confused as to what the code was doing, though. It gathers statistics about your user machine (none of which seemed too personal - basically IP, OS, country, etc). But then what is it doing? Opening a virtual browser or simulating clicks to some ad network?
Seems to me that it is indeed running a hidden browser on a background thread, loading ads, and simulating views/clicks. That is in addition to collecting and sending user and system information (possibly also for ad-serving or information sales or some other nefarious skulduggery).
Re: Reverse Engineering an Eclipse Plugin
#5Thank you for doing this, makes you think how many other highly rated/used s/w is malicious
Re: Reverse Engineering an Eclipse Plugin
#6Original author doing a pretty bad job of explaining himself [0]. Mainly:
Anyone who does not like it, please uninstall this plugin.
I will not explain it anymore.
I'm not interested in stealing your privacy.
[0] https://github.com/cnfree/Eclipse-Class-Decompiler/issues/30
Re: Reverse Engineering an Eclipse Plugin
#7While this was a popular plugin for Eclipse - I'm sure there are plugins for other editors, IDEs and browsers which do the same (or worse).
Yet, we often try a multitude of plugins without a single thought about any unwanted features bundled with the main features.
Re: Reverse Engineering an Eclipse Plugin
#8Guess author of the plugin is pretty smart but not smart enough to encrypt the traffic back home or obscure his/her nasty secrets. I guess it might be keeping the black stuff for some cool down time just after installation. Many malware seem to do there days. We might have got true clicks targeted.
Encrypting the traffic would only have made it marginally more difficult to intercept (https://portswigger.net/burp/help/proxy_options_installingca...). Also, the guy got 400k downloads, sometimes you don't need "smart".
Re: Reverse Engineering an Eclipse Plugin
#9Alternative version:
http://marketplace.eclipse.org/content/enhanced-class-decomp...
Re: Reverse Engineering an Eclipse Plugin
#10Good writeup on the reverse engineering. I'm still a little confused as to what the code was doing, though. It gathers statistics about your user machine (none of which seemed too personal - basically IP, OS, country, etc). But then what is it doing? Opening a virtual browser or simulating clicks to some ad network?
Seems to me that it is indeed running a hidden browser on a background thread, loading ads, and simulating views/clicks. That is in addition to collecting and sending user and system information (possibly also for ad-serving or information sales or some other nefarious skulduggery).
A simple thing would be to trigger a visit to a site using a JS coin miner if it's running JS in the hidden browser.