The Supreme Backdoor Factory
dfir.it
The Supreme Backdoor Factory
1–10 of 15 posts
Re: The Supreme Backdoor Factory
#2lol that is unexpectable
Re: The Supreme Backdoor Factory
#3Fascinating. The author uncovers a huge web of fake accounts across GitHub and SourceForge which are used to push backdoored versions of legitimate software installers. A good reminder to be cautious when downloading “unofficial builds” and to always check checksums for official ones.
There’s also a really unexpected connection with sneaker-buying bots, which was a surprise to me. I did not know the lengths to which sneakerheads would go to to procure new shoes. I wonder if these backdoor bots are used just to give someone an extra leg up on online auctions and sales of sneakers...that’s some real twisted dedication right there.
Re: The Supreme Backdoor Factory
#4Fascinating. The author uncovers a huge web of fake accounts across GitHub and SourceForge which are used to push backdoored versions of legitimate software installers. A good reminder to be cautious when downloading “unofficial builds” and to always check checksums for official ones. There’s also a really unexpected connection with sneaker-buying bots, which was a surprise to me. I did not know the lengths to which…
The after market for "exclusive" sneakers is at a crazy peak right now. You can buy a $250 shoe and flip it for $500-$1000 nearly instantly. So it's not just old school sneakerheads looking for cool shoes - it's big business.
There are whole sub-industries within this bubble, too. People selling sneakerbot code, people selling purchase alert services, people selling access to private dischord groups that alert you to upcoming sales, etc. It's huge.
Re: The Supreme Backdoor Factory
#5Fascinating. The author uncovers a huge web of fake accounts across GitHub and SourceForge which are used to push backdoored versions of legitimate software installers. A good reminder to be cautious when downloading “unofficial builds” and to always check checksums for official ones. There’s also a really unexpected connection with sneaker-buying bots, which was a surprise to me. I did not know the lengths to which…
The after market for "exclusive" sneakers is at a crazy peak right now. You can buy a $250 shoe and flip it for $500-$1000 nearly instantly. So it's not just old school sneakerheads looking for cool shoes - it's big business. There are whole sub-industries within this bubble, too. People selling sneakerbot code, people selling purchase alert services, people selling access to private dischord groups that alert you to…
yeah the whole hypebeast streetwear black market is huge, especially for shoes and supreme/big drops
the most interesting part is looking at stockx with the charts they have on items, I have shoes/silhouettes that I bought on sale/new through retail that have since sold out and seeing 2x return on investment isnt uncommon
Re: The Supreme Backdoor Factory
#6Fascinating. The author uncovers a huge web of fake accounts across GitHub and SourceForge which are used to push backdoored versions of legitimate software installers. A good reminder to be cautious when downloading “unofficial builds” and to always check checksums for official ones. There’s also a really unexpected connection with sneaker-buying bots, which was a surprise to me. I did not know the lengths to which…
The after market for "exclusive" sneakers is at a crazy peak right now. You can buy a $250 shoe and flip it for $500-$1000 nearly instantly. So it's not just old school sneakerheads looking for cool shoes - it's big business. There are whole sub-industries within this bubble, too. People selling sneakerbot code, people selling purchase alert services, people selling access to private dischord groups that alert you to…
My co-worker and I (he was into sneakers, I was into money) used to have a nice little business arbitraging sneakers. Pretty easy to make 100%-500% returns with a little code and some ebay dedication.
Re: The Supreme Backdoor Factory
#7If you want to find malware with no AV signatures, look at no-name warez of medium popular and niche professional software, and honey-net via unpatched Windows computers on exo-DMZ unfiltered IP addresses. I saw this one sample behavioral analysis of a trojaned well-known firewall product for Mac that tries to download Google Chrome in order to clickbot... no AV signature for it. With the right APT defenses, such as a root priv esc, SIP bypass and process & file cloaking, it would be entirely possible to keep nodes pwned much longer, at the cost of 2-3 sploits... and better use such farm for a big money-maker.
Re: The Supreme Backdoor Factory
#8So what does this mean for the people who have created bots for sneaker sites? I actually used to write code for those sneaker bots and run a slack group (before we all moved to discord), but I've never encountered oddities in the code builds for bots I used. This may be going over my head a bit but does this mean that the builders for the bot installs could contain malicious code?
Re: The Supreme Backdoor Factory
#9So what does this mean for the people who have created bots for sneaker sites? I actually used to write code for those sneaker bots and run a slack group (before we all moved to discord), but I've never encountered oddities in the code builds for bots I used. This may be going over my head a bit but does this mean that the builders for the bot installs could contain malicious code?
In short, yes - could be. The blog shows at least one case where this has happened in practice.
Semi-unrelated, but why did you end up moving from Slack to Discord, if I may ask?
Re: The Supreme Backdoor Factory
#10Sounds like a brothel.