Is RuDostup — Обход блокировки YouTube в Северной Корее safe?

Medium risk

RuDostup fetches a remote proxy script from ytprx.ru and routes all of the user's browser traffic through a server-controlled proxy.

On startup and on every page navigation, the extension contacts ytprx.ru and installs the PAC (proxy auto-config) script it returns browser-wide, so every site you visit can be directed through the operator's servers, not just YouTube. The proxy rules are re-fetched continuously and can be changed remotely at any time, and if the secure endpoint is unreachable the extension falls back to fetching the same configuration over plaintext HTTP from a hardcoded IP. The server response also drives extra behavior, including injecting a remotely-configured iframe into the YouTube watch page, opening server-supplied URLs in new windows on certain sites, and writing unsanitized HTML into the extension's own popup.

RuDostup.ruv1.2.2Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityCRITICAL
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

Server-Controlled PAC Script Routes All Browser Traffic via Remote Proxy

The service worker contacts ytprx.ru on every startup and navigation.

When it responds proxy.active=true, the extension installs a server-supplied PAC script browser-wide unvalidated, so every request follows the server's rules.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension or navigate to a new page in your browser.

The extension did this

The extension contacts ytprx.ru, receives a JavaScript proxy ruleset, and installs it as the active proxy configuration for all browser traffic, with no user notification.

The proxy scope is 'regular', which applies to every website the browser visits, not only YouTube-related traffic.

02EvidenceCODE COMPARE
The code that does this

The proxy installation function and its remote-config trigger

What it actually does
proxyConnect — applies server-supplied PAC datasw.js
async function proxyConnect(pac)
{
	var config = {
	  mode: "pac_script",
	  pacScript: {
	    data: pac
	  }
	};		
	
	await chrome.proxy.settings.set(
		    {value: config, scope: 'regular'},
		    function() {});
		    
}
Condition that activates the proxy (inside runDostup)sw.js
if(text.proxy.active) {
	await chrome.proxy.settings.get(
	{'incognito': false},
		async function(config) {
		
			let toconnect = false;
			
			try
			{	
				if(config.value.pacScript.data != text.proxy.pac ) toconnect = true;
			}
			catch(e) { toconnect = true; }
			
			if(toconnect) await proxyConnect(text.proxy.pac);
							
		}
	);
} else {
	await proxyDisconnect();
}
Navigation listener — re-polls server on every page loadsw.js
chrome.webNavigation.onBeforeNavigate.addListener(async ({ parentFrameId }) => {
	if (parentFrameId != -1) return;
		runDostup();
});
03EvidenceFIELD TABLE
What the extension sends to ytprx.ru/sttt.php on each poll:
FieldValueWhy it matters
Extension version
1.2.2The installed extension version string, sent on every request.
Partner voucher code
partnerA partner/affiliate attribution token stored in local storage and sent with every poll.
Disagreed flag
trueWhether the user has acknowledged a terms-of-service dialog inside the extension.
04EvidenceTHIRD PARTY LIST
Endpoints involved in proxy configuration:
  • ytprx.ru

    Primary command-and-control endpoint. Supplies the PAC JavaScript, the site-injection list, and the popup redirect URL on every poll.

  • 45.82.254.40

    Bare-IP fallback endpoint (port 8900) contacted when ytprx.ru is unreachable. No TLS on the fallback path (mode: 'no-cors', HTTP).

  • report.ytprx.ru

    Receives host-reachability reports: when the extension cannot reach a test URL supplied by the server, it POSTs the hostname to this endpoint.

05EvidenceTEMPORAL PATTERN
When this fires
On every browser startup

runDostup() fires once at service-worker startup (sw.js:359) and again on every top-level page navigation (chrome.webNavigation.onBeforeNavigate). On an active browser session this means the PAC configuration is refreshed continuously with no minimum interval.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Server-Designated Sites Trigger Remote-URL Popup on First Mouse Click

On server-listed sites, the extension intercepts your first mouse release and opens a window to a URL chosen by ytprx.ru.

Target URL, gated-site list, frequency cap, and timing come from the same server poll that controls the proxy config.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You visit a website whose hostname matches a server-supplied pattern and release the mouse button.

The extension did this

A new browser window opens to a URL supplied by the ytprx.ru server, without any prompt or disclosure.

The destination URL, the list of gated sites, the per-session snap count cap, and the time window are all values the server can change at any time.

02EvidenceCODE COMPARE
The code that does this

The mouseup handler that opens the remote URL

What it actually does
addDisclamer — injected into matching pagessw.js
async function addDisclamer(tog, lim, hours, pechenka) {
	// tog = server-supplied target URL (disclamer.gate)
	// lim = server-supplied snap count cap (disclamer.lim)
	// hours = server-supplied cooldown hours (disclamer.wait)
	// pechenka = per-user snap state from chrome.storage.local

	var PechenkaShow = function() {
		if (!check) {
			check = true;
			var snapsCount = pechenka.snaps?.val ?? 0;
			var newCount = (snapsCount == null) ? 1 : parseInt(snapsCount) + 1;
			// ... update pechenka state in chrome.storage.local ...
			// Open server-supplied URL in new window when snap count > 1
			if (newCount > 1)
				window.open(tog, '_blank', 'width=...,toolbar=1,...');
		}
	}

	document.body.onmouseup = function () {
		if (snapsCount < lim && !snapCooledDown)
			PechenkaShow();
	};
}
onDOMContentLoaded — gating check against server-supplied site listsw.js
// Fires on every top-frame DOMContentLoaded
// Checks if current URL matches server-supplied regex (appStore.sites)
// If it does, injects addDisclamer with the server-supplied gate URL and caps
var sitePattern = new RegExp('^http[ps]+:\/\/(' + appStore.sites + ')\/', 'i');
if (sitePattern.test(url) && appStore.disclamer) {
	chrome.scripting.executeScript({
		target: { tabId },
		func: addDisclamer,
		args: [appStore.disclamer.gate, appStore.disclamer.lim, appStore.disclamer.wait, appStore.pechenka]
	});
}
03EvidenceSTORAGE DUMP
What's stored on your device

The server writes these each poll. 'disclamer.gate' is the popup URL; 'sites' is the regex deciding whether to inject the handler.

Locationchrome.storage.local keys: disclamer, sites
Contents (JSON)
{
  "sites": "youtube\\.com|vk\\.com|ok\\.ru",
  "disclamer": {
    "lim": 3,
    "gate": "https://ytprx.ru/redirect?r=some-affiliate-url",
    "wait": 24
  }
}
04EvidenceTHIRD PARTY LIST
Server that controls the popup destination:
  • ytprx.ru

    Supplies disclamer.gate (the URL the popup window opens), the site-match regex, the snap-count cap, and the cooldown period. These values can be changed server-side at any time.

Data recipients

ytprx.ru45.82.254.40
Updated 17 September 2026pblihioifhoagjnimnpemflllkeigeoi