Hacker News Reader

Hacker News

Comment by jtjj222 | Hacker News Reader

Full thread

jtjj222

I am not sure that it is safe to open devtools on a sketchy website. There is a lot of extra attack surface there.

View on HN

Why does opening devtools on any sites is not safe?

What can a website do just from opening dev tools that it can't do without opening them?

it can basically fork bomb the user

The websites I've seen (and was referencing in the Gist) basically do this. But it's a very simple anti-debugger technique that uses an IIFE containing a `while` loop with a `debugger;` statement in every iteration. You can circumvent it by opening DevTools on another website and toggling it to "skip all breakpoints."

I'm sure there are more advanced anti-debugger techniques with different denial-of-service vectors. And I'm sure that the attack surface for actual exploits (beyond just DOS) is also greater than browsing a website without DevTools open. But it's not like browser vendors grant super-permissions to websites when the user has DevTools open; any exploit would depend on a high severity vulnerability.

I do agree that it's probably smart to browse sketchy websites in an isolated browser, and ideally one inside a VM.

> I'm sure there are more advanced anti-debugger techniques with different denial-of-service vectors.

Just rename debugger to banana.

Edit: I see you have posted it below already!

https://www.nullpt.rs/evading-anti-debugging-techniques

while i agree, 2 things come to mind to assist this: - browsers should have a user-input string for the debug statement that is manually accepted before the debugger runs every time devtools launches (and should be randomly generated each time that devtools is opened) - browser plugins help: check out Netmon (though sadly its yet-another-plugin and js-bloat for the browser to handle)

edit: format i hope

This researcher [0] found the optimal solution was to use a custom build of Firefox with the `debugger` keyword changed to something else :)

[0] https://www.nullpt.rs/evading-anti-debugging-techniques

yes i remember reading something about somebody compiling it to a unique word! wanted to do similar myself (but didnt fall down that rabbit hole yet) - i feel it should be a set-able in the browser (per tab or whatever) - not to sound like a broken record ha

browsers are supposed to be a tool we humans use, not be controlled by

edit: format maybe one day ill get it right

Usually the sketchy websites are the one you open from an ephemeral VM anyway.

Who would open those on their main desktop?

i'd argue any website with a 3rd party ad is a sketchy website. but any site can do it

check out https://github.com/AEPKILL/devtools-detector

Reply on news.ycombinator.com