{"action":"created","issue":{"url":"https://api.github.com/repos/evilsocket/bettercap/issues/118","labels_url":"https://api.github.com/repos/evilsocket/bettercap/issues/118/labels{/name}","comments_url":"https://api.github.com/repos/evilsocket/bettercap/issues/118/comments","events_url":"https://api.github.com/repos/evilsocket/bettercap/issues/118/events","html_url":"https://github.com/evilsocket/bettercap/issues/118","id":130090599,"number":118,"title":"Why is bettercap making outgoing connections to advertisers...?","user":{"login":"taoeffect","id":138706,"avatar_url":"https://avatars.githubusercontent.com/u/138706?v=3","gravatar_id":"","url":"https://api.github.com/users/taoeffect","html_url":"https://github.com/taoeffect","followers_url":"https://api.github.com/users/taoeffect/followers","following_url":"https://api.github.com/users/taoeffect/following{/other_user}","gists_url":"https://api.github.com/users/taoeffect/gists{/gist_id}","starred_url":"https://api.github.com/users/taoeffect/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/taoeffect/subscriptions","organizations_url":"https://api.github.com/users/taoeffect/orgs","repos_url":"https://api.github.com/users/taoeffect/repos","events_url":"https://api.github.com/users/taoeffect/events{/privacy}","received_events_url":"https://api.github.com/users/taoeffect/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-31T06:21:01Z","updated_at":"2016-01-31T11:22:52Z","closed_at":"2016-01-31T07:13:27Z","body":"Installed bettercap 1.3.3 and was trying to test it using the sparkle bug [per these instructions](https://www.evilsocket.net/2016/01/30/osx-mass-pwning-using-bettercap-and-the-sparkle-updater-vulnerability/).\r\n\r\nThen noticed that it started to make outgoing connections to a bunch of advertising networks (via Little Snitch) and it reports them in the logs too:\r\n\r\n```\r\n[I] [OSX SPARKLE] Getting 'http://get.videolan.org/vlc/2.2.1/macosx/vlc-2.2.1.dmg' file size ...\r\n[I] Acquired 1 new target :\r\n\r\n  [NEW] 192.168.1.5 : MAC_ADDR_WAS_HERE ( Apple )\r\n\r\n[I] [OSX SPARKLE] FTP server started on ftp://192.168.1.4:2100/ ...\r\n[I] HTTP Proxy started on 192.168.1.4:8080 ...\r\n[192.168.1.12] GET http://mpx.mopub.com/imp?ad_domain=lyft.com&ad_id=1... ( text/html ) [200]\r\n[192.168.1.12] GET http://ads.mopub.com/m/imp?appid=&cid=65f831aaaeb64... ( text/html ) [200]\r\n[192.168.1.12] GET http://ads.mopub.com/m/ad?v=8&udid=ifa:C91E9487-5A0... ( text/html ) [200]\r\n[192.168.1.12] GET http://ads.mopub.com/m/ad?v=8&udid=ifa:C91E9487-5A0... ( text/html ) [200]\r\n```\r\n\r\n(Note that IP and MAC addresses have been changed.)\r\n\r\nSo... wtf is going on?\r\n\r\nSeparate issue was that checking for updates in VLC did nothing. So never was able to get `osxsparkle.rb` working."},"comment":{"url":"https://api.github.com/repos/evilsocket/bettercap/issues/comments/177470857","html_url":"https://github.com/evilsocket/bettercap/issues/118#issuecomment-177470857","issue_url":"https://api.github.com/repos/evilsocket/bettercap/issues/118","id":177470857,"user":{"login":"evilsocket","id":86922,"avatar_url":"https://avatars.githubusercontent.com/u/86922?v=3","gravatar_id":"","url":"https://api.github.com/users/evilsocket","html_url":"https://github.com/evilsocket","followers_url":"https://api.github.com/users/evilsocket/followers","following_url":"https://api.github.com/users/evilsocket/following{/other_user}","gists_url":"https://api.github.com/users/evilsocket/gists{/gist_id}","starred_url":"https://api.github.com/users/evilsocket/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/evilsocket/subscriptions","organizations_url":"https://api.github.com/users/evilsocket/orgs","repos_url":"https://api.github.com/users/evilsocket/repos","events_url":"https://api.github.com/users/evilsocket/events{/privacy}","received_events_url":"https://api.github.com/users/evilsocket/received_events","type":"User","site_admin":false},"created_at":"2016-01-31T11:22:52Z","updated_at":"2016-01-31T11:22:52Z","body":"Set bettercap as your proxy."}}