Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github scam investigation: Thousands of “mods” and “cracks” stealing data

timsh.org

Post reply on HN
Print view View original

121–130 of 165 posts

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#121

Post by TechDebtDevin »

avodonosov wrote: post #81
Aurornis wrote: post #75

These repos post to Discord webhooks to notify of newly compromised systems. I’ve found Discord to be responsive to abuse complaints in the past. If someone wrote a simple script to download these repos and extract the Discord webhook links I bet you could get Discord to shut down their accounts. In my past experience Discord was aggressive about this, going so far as to ban the accounts of people who had participate…

> going so far as to ban the accounts The responsible thing would be also to release all related data, icluding personal information (IP adresses, emails, list of contacts, chat logs) to investigation (police, etc)

Doesnt really matter if the scammers are in bum fuck egypt (literally)

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#122

Post by catsma21 »

Aurornis wrote: post #117
catsma21 wrote: post #112

Earlier quoted context omitted.

i did, in fact, read the article. you said "a simple script to download these repos". the variety of malware would make the script not so simple, and not so effective.

> the variety of malware would make the script not so simple, and not so effective. The article is about using scripts to identify and download the malware. They identified over 1000 matching repos, which would contain Discord webhooks in the script. Scanning and identifying has already been done. That’s literally what the article is about. It’s right in the second paragraph: > As soon as you download and launch any…

yes, they identified spammy repos. you'd also need to identify which repos belong to which spammer groups, it's not just one person doing this (as mentioned in the article) -> they don't use the same malware. saying "sent to some discord server" is like saying "playing games on my nintendo". the malware is also obfuscated (as mentioned in the article) which makes identifying the home server harder with static analysis.

why don't we just send bad people to jail?

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#123

Post by throwawwey »

rwmj wrote: post #15
klaas- wrote: post #11

I think Microsoft has a general problem with getting rid of unwanted things within their eco-system. I keep complaining that their feedback.azure.com portal is filled with spam/malware comments and links, but even internally their teams can't reach anyone to get it fixed. Example https://feedback.azure.com/d365community/idea/9d0b22d8-c025-...

As another data point: MSFT have some sort of open mail server/service called onmicrosoft.com which (in my experience anyway) is only being used to send out fraudulent paypal messages. Because it lets the spammer set the From to service@paypal.com and also contains valid DKIM etc, it sails past spam filtering. There are so many complaints about this on (real) paypal.com forums, but Microsoft are apparently unable to…

This isn't really related to the parent comment, but I can't help myself from asking. I've been getting emails that look like they're from my own email address. They usually threaten to share my browser history unless I pay money. Has anyone else seen these kinds of scam emails? How can I stop them? I use two-factor authentication, so my account should be safe, but these emails still worry me. Any tips would be great!

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#124

Post by avodonosov »

TechDebtDevin wrote: post #121
avodonosov wrote: post #81

Earlier quoted context omitted.

> going so far as to ban the accounts The responsible thing would be also to release all related data, icluding personal information (IP adresses, emails, list of contacts, chat logs) to investigation (police, etc)

Doesnt really matter if the scammers are in bum fuck egypt (literally)

Law enforcement has ways to work across borders (international agreements, etc).

Such mechanisms should and will improve with time.

If a countly doesn't provide legal support against scammers, then the requesting country can reciprocate - declare green light for scammers agains the refusing country.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#125

Post by radicality »

throwawwey wrote: post #123
rwmj wrote: post #15

Earlier quoted context omitted.

As another data point: MSFT have some sort of open mail server/service called onmicrosoft.com which (in my experience anyway) is only being used to send out fraudulent paypal messages. Because it lets the spammer set the From to service@paypal.com and also contains valid DKIM etc, it sails past spam filtering. There are so many complaints about this on (real) paypal.com forums, but Microsoft are apparently unable to…

This isn't really related to the parent comment, but I can't help myself from asking. I've been getting emails that look like they're from my own email address. They usually threaten to share my browser history unless I pay money. Has anyone else seen these kinds of scam emails? How can I stop them? I use two-factor authentication, so my account should be safe, but these emails still worry me. Any tips would be great…

Huh, interesting, I just saw something like that in my spam filter for my own domain. It looked like some kind of an email forward from onmicrosoft.com, with the original email spoofed from my own domain with an email that doesn’t even exist on my domain.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#126

Post by Aurornis »

catsma21 wrote: post #122
Aurornis wrote: post #117

Earlier quoted context omitted.

> the variety of malware would make the script not so simple, and not so effective. The article is about using scripts to identify and download the malware. They identified over 1000 matching repos, which would contain Discord webhooks in the script. Scanning and identifying has already been done. That’s literally what the article is about. It’s right in the second paragraph: > As soon as you download and launch any…

yes, they identified spammy repos. you'd also need to identify which repos belong to which spammer groups, it's not just one person doing this (as mentioned in the article) -> they don't use the same malware. saying "sent to some discord server" is like saying "playing games on my nintendo". the malware is also obfuscated (as mentioned in the article) which makes identifying the home server harder with static analysi…

The web hook is in the templated script

From the article:

> The "trust" value, when base64-decoded, turns out to be a discord webhook link: myhook = 'https://discord.com/api/webhooks/1050437982584324138/VJByvmB...'

Collect all the scripts matching the template. Extract the “trust” variable. Decode base64. Send to Discord with proof of how it was obtained.

Discord then identifies the Discords matching those webhooks.

It’s not some hard static analysis problem. These are python scripts with a base64 encoded variable. I don’t understand why you’re making it out to be something other than what the article says.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#127

Post by TonyTrapp »

throwawwey wrote: post #123
rwmj wrote: post #15

Earlier quoted context omitted.

As another data point: MSFT have some sort of open mail server/service called onmicrosoft.com which (in my experience anyway) is only being used to send out fraudulent paypal messages. Because it lets the spammer set the From to service@paypal.com and also contains valid DKIM etc, it sails past spam filtering. There are so many complaints about this on (real) paypal.com forums, but Microsoft are apparently unable to…

This isn't really related to the parent comment, but I can't help myself from asking. I've been getting emails that look like they're from my own email address. They usually threaten to share my browser history unless I pay money. Has anyone else seen these kinds of scam emails? How can I stop them? I use two-factor authentication, so my account should be safe, but these emails still worry me. Any tips would be great…

If you are in control of the domain of your email address, enable SPF and DKIM for that domain, together with strict policies that mail servers should reject spoofed mails claiming to come from that domain. If your own mail server supports validating SPF and DKIM, you would no longer receive such forged mails, nor anyone else behind a mail server supporting SPF and DKIM.

If you aren't in control... just ignore it like any other spam mail.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#128

Post by kiliankoe »

throwawwey wrote: post #123
rwmj wrote: post #15

Earlier quoted context omitted.

As another data point: MSFT have some sort of open mail server/service called onmicrosoft.com which (in my experience anyway) is only being used to send out fraudulent paypal messages. Because it lets the spammer set the From to service@paypal.com and also contains valid DKIM etc, it sails past spam filtering. There are so many complaints about this on (real) paypal.com forums, but Microsoft are apparently unable to…

This isn't really related to the parent comment, but I can't help myself from asking. I've been getting emails that look like they're from my own email address. They usually threaten to share my browser history unless I pay money. Has anyone else seen these kinds of scam emails? How can I stop them? I use two-factor authentication, so my account should be safe, but these emails still worry me. Any tips would be great…

E-Mail allows setting the From header to whatever you want. These mails won't have valid DKIM or SPF data because they're not sent through your mail server. There's nothing to worry about, it's just spam, your account isn't compromised (unless of course it is, and they're sending it through yours, but they likely wouldn't try to scam you like that then). Just one of the quirks of e-mail we have to live with.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#129

Post by Technetium »

throwawwey wrote: post #123
rwmj wrote: post #15

Earlier quoted context omitted.

As another data point: MSFT have some sort of open mail server/service called onmicrosoft.com which (in my experience anyway) is only being used to send out fraudulent paypal messages. Because it lets the spammer set the From to service@paypal.com and also contains valid DKIM etc, it sails past spam filtering. There are so many complaints about this on (real) paypal.com forums, but Microsoft are apparently unable to…

This isn't really related to the parent comment, but I can't help myself from asking. I've been getting emails that look like they're from my own email address. They usually threaten to share my browser history unless I pay money. Has anyone else seen these kinds of scam emails? How can I stop them? I use two-factor authentication, so my account should be safe, but these emails still worry me. Any tips would be great…

Do not click the links or allow images to load, and you will remain safe. View the full raw email and look at the headers. Search who is registered for the domain in question. Contact their hosting provider.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#130

Post by kennysoona »

wil421 wrote: post #90
kennysoona wrote: post #28

Earlier quoted context omitted.

I wasn't even talking about people who paid for a cert, just people signing up to try and help. They are generally more annoying then helpful to people who can do anything more than install and uninstall programs. Without a doubt every search result I found on that forum from someone having a similar issue never resulted in a useful lead.

Amazon has an ask a question feature and it will email a lot of people who previously bought the product, not sure how it works. Anyway, I saw tons of responses from elderly people with nonsense answers like “I don’t know the answers please don’t email me”. People felt compelled to respond, now I see why Nigerian prince scams are so successful.

There was a story recently that Reese Witherspoon was in a jury, and the other members of the Jury genuinely thought she was a lawyer because of Legally Blonde.

That kind of ridiculousness is way more common than you think. These people shouldn't be allowed to vote let alone try to assist in solving even remotely complex IT problems.

Post reply on HN