Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Cracked a Keylogger and Ended Up in Someone's Inbox

trustwave.com

Post reply on HN
Print view View original

91–100 of 108 posts

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#91

Post by yowmamasita »

vmp wrote: post #74

I've done this a few times for fun, simply search YouTube for a "game code generator" or something like that, take your pick, download their magic "tool" from the link in the video description and get disassembling with ILSpy [1]. A ton of these "account stealers" are written in VB.NET and seem to be generated from a template. Remember to stay safe and use a sandbox or virtual machine when dealing with malicious code…

Anyone knows a better decompiler for .net other than ilspy? It's a hit or miss for me with ilspy, would like to try something better even if it's paid.

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#92

Post by eddyg »

armandososa wrote: post #90
lossolo wrote: post #16

Website that we were running was under DDOS couple of years ago, what we did is we took ips of servers that made ddos. Then we scanned the ports, found vulnerability in the application that was running on it then get into the server using this vulnerability. We checked open connections and found one used for command and control server (irc server) then we listened to irc channel. DDOSers were talking private things o…

I wish HN had a `save` feature so I don't lose gems like these.

Just up-vote the stories and comments you want to save. When you view your profile on HN, you can see a list of your up-votes.

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#93

Post by Sylos »

nchelluri wrote: post #19
unknown2374 wrote: post #17

I just hope someday the general public realize what a poor job Microsoft has done regarding security on Windows operating systems and embrace other (and more promising) alternatives

broadly speaking, how would you design things? All I can think of doing is putting explicit permission grants on everything, requiring everyone to click a million times as was done with the first version of Vista's UAC, IIRC, which is no solution IMO.

Well, broadly speaking, more Unix-like.

I fully agree that putting administrator permissions on everything is not a solution, as users will start clicking it away without thought, but there's a good number of things in this article where I could not believe that it does not require administrator permissions.

So, simply a clearer separation would be necessary.

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#94

Post by SEJeff »

siculars wrote: post #78
ambivalence wrote: post #75

Earlier quoted context omitted.

Watch out. You laugh at this as if it's some Marvel Universe pop culture thing. In fact, some of the readers here have families that were sent to Siberia during or shortly after WW2. You wouldn't joke about concentration camps. I hope.

My grandfather. 1936.

Uggg sorry if I offended anyone.

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#95

Post by Sir_Cmpwn »

yowmamasita wrote: post #91
vmp wrote: post #74

I've done this a few times for fun, simply search YouTube for a "game code generator" or something like that, take your pick, download their magic "tool" from the link in the video description and get disassembling with ILSpy [1]. A ton of these "account stealers" are written in VB.NET and seem to be generated from a template. Remember to stay safe and use a sandbox or virtual machine when dealing with malicious code…

Anyone knows a better decompiler for .net other than ilspy? It's a hit or miss for me with ilspy, would like to try something better even if it's paid.

Try dotPeek: https://www.jetbrains.com/decompiler/

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#96

Post by aquadrop »

meowface wrote: post #59
seanp2k2 wrote: post #38

Earlier quoted context omitted.

These days I'd be worried about CFAA or otherwise getting V& for this. In the "good old days", it was possible to get away with and laugh about this type of vigilante justice. These days though, you're more likely to wind up in prison. No longer worth it for lulz. Sad times now, but good memories.

What they did at the time would still have definitely been illegal. Probably not any more illegal than it is now. I doubt they'd be prosecuted, but breaking into any system is illegal.

Hitting people in the face is illegal; hitting people in the face in self-defense is legal. So... It would be interesting court case :)

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#97

Post by gryphonshafer »

armandososa wrote: post #90
lossolo wrote: post #16

Website that we were running was under DDOS couple of years ago, what we did is we took ips of servers that made ddos. Then we scanned the ports, found vulnerability in the application that was running on it then get into the server using this vulnerability. We checked open connections and found one used for command and control server (irc server) then we listened to irc channel. DDOSers were talking private things o…

I wish HN had a `save` feature so I don't lose gems like these.

When I use a desktop browser, I just right-click on the post age data and select "Save link as..." or "Bookmark This Link" or whatever.

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#98

Post by GFK_of_xmaspast »

armandososa wrote: post #90
lossolo wrote: post #16

Website that we were running was under DDOS couple of years ago, what we did is we took ips of servers that made ddos. Then we scanned the ports, found vulnerability in the application that was running on it then get into the server using this vulnerability. We checked open connections and found one used for command and control server (irc server) then we listened to irc channel. DDOSers were talking private things o…

I wish HN had a `save` feature so I don't lose gems like these.

Most modern browsers still have bookmarking ability.

Re: How I Cracked a Keylogger and Ended Up in Someone's Inbox

#99

Post by gryphonshafer »

intern4tional wrote: post #34
skraelingjar wrote: post #10

Earlier quoted context omitted.

I agree, it's amazing how stupid criminals can be, even online. It's scary to think what someone as smart as these security researchers could do if they went black hat...

I don't think criminals are stupid; they're simply lazy. They put the minimum amount of effort is into a scam like this in order to make it profitable. An off the shelf key logger is used; a couple of stolen email accounts, and a spammer is used for delivery. There are automated tools that will pack the key logger executable in a word document also. As for the part of the security researcher; reversing .net code isn'…

I don't think criminals are stupid; they're simply lazy. They put the minimum amount of effort is into a scam like this in order to make it profitable.

Criminals come in all shapes and sizes, at all levels of intelligence, skill, and laziness or lack thereof. There are indeed criminals who aren't stupid but are lazy; but in my experience counseling the incarcerated, most criminals (that I spoke to in a non-scientific, non-random sampling) were both stupid and lazy. Of course, maybe that's confirmation bias, because I only spoke to the criminals who got caught.

What I found most fascinating were the criminals who were smart in the short-view, stupid in the long-view, and extraordinarily not lazy. Many young hackers fit into this category. They work long hours and invest a lot of effort in a crime, thinking all the while that the investment had a better return than non-criminal activity over the long-term.

Post reply on HN