Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github scam investigation: Thousands of “mods” and “cracks” stealing data

timsh.org

Post reply on HN
Print view View original

81–90 of 165 posts

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#81

Post by avodonosov »

Aurornis wrote: post #75

These repos post to Discord webhooks to notify of newly compromised systems. I’ve found Discord to be responsive to abuse complaints in the past. If someone wrote a simple script to download these repos and extract the Discord webhook links I bet you could get Discord to shut down their accounts. In my past experience Discord was aggressive about this, going so far as to ban the accounts of people who had participate…

> going so far as to ban the accounts

The responsible thing would be also to release all related data, icluding personal information (IP adresses, emails, list of contacts, chat logs) to investigation (police, etc)

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#82

Post by anoncow »

avodonosov wrote: post #81
Aurornis wrote: post #75

These repos post to Discord webhooks to notify of newly compromised systems. I’ve found Discord to be responsive to abuse complaints in the past. If someone wrote a simple script to download these repos and extract the Discord webhook links I bet you could get Discord to shut down their accounts. In my past experience Discord was aggressive about this, going so far as to ban the accounts of people who had participate…

> going so far as to ban the accounts The responsible thing would be also to release all related data, icluding personal information (IP adresses, emails, list of contacts, chat logs) to investigation (police, etc)

We could lock such repos. No access (not even read-only) and disable accounts. That could also be semi automatic.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#83

Post by Thorrez »

>Yes, Redox creates and starts sqlite to gather all the data in a good-looking way.

Is that saying it creates a sqlite database? I kind of doubt it. I think more likely is it uses sqlite to read from existing sqlite databases that exist on disk, to steal data from them.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#84

Post by EVa5I7bHFq9mnYK »

linwangg wrote: post #69

This raises a big question: How effective is GitHub’s abuse reporting system against large-scale malware campaigns? If 1,000+ malicious repos can persist for months, does this mean GitHub lacks automated scanning or relies too much on user reports?

Automated scanning is easily bypassed - just fine-tune the submission until it passes the checks.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#85

Post by avodonosov »

nomilk wrote: post #47

We could make an open source database. Then very simple browser extension to place a very prominent warning on any GitHub repo page that happens to be suspected malware. I guess the problem is that only helps those who already know they need to watch out for this sort of thing, not the users most likely to be pwned.

Lets do it.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#86

Post by encom »

Aurornis wrote: post #75

These repos post to Discord webhooks to notify of newly compromised systems. I’ve found Discord to be responsive to abuse complaints in the past. If someone wrote a simple script to download these repos and extract the Discord webhook links I bet you could get Discord to shut down their accounts. In my past experience Discord was aggressive about this, going so far as to ban the accounts of people who had participate…

Let's shut down Discord instead, for the good of all mankind.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#87

Post by Thorrez »

KomoD wrote: post #25

Fun fact: if you come across one of these discord webhooks you can delete them. Just curl -X DELETE https://discord.com/api/webhooks/ [...]

Interesting. Looks like this specific one has already been deleted:

    curl -X DELETE https://discord.com/api/webhooks/1050437982584324138/VJByvmBKESSUv4fYn0LIjlBR4VzMRTEPOKVJoWFvCeHd7o3LtclQMJDMuiLzT57iqn7B
    {"message": "Unknown Webhook", "code": 10015}

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#88

Post by vegadw »

I think to an extent Microsoft is the guilty party here. For may cracks Windows Defender will trip saying "Win32/Keygen" even if there's no actual malware https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo...

This trains people that do a lot of piracy to be used to turning off their antivirus to let something through, which is fine until it's not. It's like drugs, if we know a subset of the population will do them no matter what, we should make it safe for them to the extent we can. False positives, causing people to ignore actual positives, creates a market for these things.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#89

Post by Thorrez »

sylware wrote: post #24

[flagged]

>You are still on microsoft github

Who is on microsoft github? The article is about malware distributors using github to distribute malware. Are you suggesting that malware authors should avoid github because it's not noscript friendly? Malware authors care about how to distribute the most malware, not about whether their distribution site is noscript friendly.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#90

Post by wil421 »

kennysoona wrote: post #28
Galanwe wrote: post #19

Earlier quoted context omitted.

That's MSDN, and these "senior hobbyists" were given a badge by MS to look credible: "MVP" (most valuable professional). Cherry on top: you used to pay to have an MSDN membership and access this wonderful community. To be fair though, the early MSDN was really good, and in a distant past MVP was a real achievement (say early 2000s). Now it's a weird mix real issues and "my printer blinks red, how to fix?" I don't thi…

I wasn't even talking about people who paid for a cert, just people signing up to try and help. They are generally more annoying then helpful to people who can do anything more than install and uninstall programs. Without a doubt every search result I found on that forum from someone having a similar issue never resulted in a useful lead.

Amazon has an ask a question feature and it will email a lot of people who previously bought the product, not sure how it works. Anyway, I saw tons of responses from elderly people with nonsense answers like “I don’t know the answers please don’t email me”. People felt compelled to respond, now I see why Nigerian prince scams are so successful.
Post reply on HN