FYI admins
cross-posted from: https://quokk.au/c/fediverse/p/1066667/tesseract-dev-injects-malicious-code-into-browser-to-illegally-ddos-the-dbzer0-instance
As part of the devs farewell message on their site, they have included malicious code to make each visitor sends 2,000 requests to the dbzer0 servers in an attempt to DDOS and take the instance offline.
I’m confused. dubvee.org is down and the tesseract repo was also pulled. How is this being deployed? What instances are hosting this version of tesseract?
I would like to see this javascript myself because DDOSing with open source code in your name is a whole new level of unwise.
Also wtf is up with the
100 - 1 + 1expression? Is this some weird JavaScript quirk?Dubvee is down down now (server not responding), but prior to that the site had a really bitchy “farewell” message. The DDOS was embedded javascript code your browser would run when you visited dubvee.org and viewed the message.
Archive.org has a snapshot of it, but it still has that javascript embedded so I’m not going to link to it. Here’s a screenshot of the site when this code was included.
If searching online for a JS random number generator code, something like
Math.floor(Math.random() * (max - min + 1) ) + min;is the most common result. If you’re lazy or don’t care, you just fill in theminandmaxand get that100 - 1 + 1I don’t think the DDoS code was FOSS. I think their frontpage index.html was set to a static html file just for the flounce.
So individual tesseract instances all reference the same static remote HTML file hosted by the the tesseract dev instead of one shipped with each instance?