Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github scam investigation: Thousands of “mods” and “cracks” stealing data

timsh.org

Post reply on HN
Print view View original

131–140 of 165 posts

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#131

Post by dcow »

Aurornis wrote: post #72
dcow wrote: post #2

Why should malware repos be deleted? Serious question. The repos aren't themselves doing harm, are valuable for research, and would be distributed some other way if GH removed them. Maybe a banner “be careful! others have reported that this repo may not do what it claims. proceed with caution” would be a more appropriate response?

> The repos aren't themselves doing harm, Yes they are. Did you read the part about the people doing this and getting 50-100 compromised computers per day? They’re stealing accounts and crypto with these. > are valuable for research, Research into how they’re harming people? The research is done. Time to move to fixing it. > and would be distributed some other way if GH removed them. This is like saying we shouldn’t…

At least the malware is exposed in the light of day. I didn't say don’t fix something. I asked whether the malware should be removed vs e.g. being flagged by github. If github removes it, it will move somewhere else and be harder to keep a thumb on. That’s fine, I was curious because this “research” wouldn’t have happened in the first place if the malware was elsewhere. It sounds like intent here matters…

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#132

Post by catsma21 »

Aurornis wrote: post #126
catsma21 wrote: post #122

Earlier quoted context omitted.

yes, they identified spammy repos. you'd also need to identify which repos belong to which spammer groups, it's not just one person doing this (as mentioned in the article) -> they don't use the same malware. saying "sent to some discord server" is like saying "playing games on my nintendo". the malware is also obfuscated (as mentioned in the article) which makes identifying the home server harder with static analysi…

The web hook is in the templated script From the article: > The "trust" value, when base64-decoded, turns out to be a discord webhook link: myhook = ' https://discord.com/api/webhooks/1050437982584324138/VJByvmB... ' Collect all the scripts matching the template. Extract the “trust” variable. Decode base64. Send to Discord with proof of how it was obtained. Discord then identifies the Discords matching those webhooks…

the article details how github is spammed by multiple people who read one guide. not every single one of the 1000 repos is THE SAME breed of malware. some overlap, maybe. but some is c#, some is rust, some is python. out of those that are python, some are obfuscated with this love/trust/joy obfuscator, some use pyarmor, some are compiled with nuitka. no, the guide does not instruct you which malware strain to use, only how to game github for traffic.

if it was that simple it would be a solved problem. i encourage you to give it a shot

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#133

Post by Aurornis »

catsma21 wrote: post #132
Aurornis wrote: post #126

Earlier quoted context omitted.

The web hook is in the templated script From the article: > The "trust" value, when base64-decoded, turns out to be a discord webhook link: myhook = ' https://discord.com/api/webhooks/1050437982584324138/VJByvmB... ' Collect all the scripts matching the template. Extract the “trust” variable. Decode base64. Send to Discord with proof of how it was obtained. Discord then identifies the Discords matching those webhooks…

the article details how github is spammed by multiple people who read one guide. not every single one of the 1000 repos is THE SAME breed of malware. some overlap, maybe. but some is c#, some is rust, some is python. out of those that are python, some are obfuscated with this love/trust/joy obfuscator, some use pyarmor, some are compiled with nuitka. no, the guide does not instruct you which malware strain to use, on…

> not every single one of the 1000 repos is THE SAME breed of malware. some overlap, maybe. but some is c#, some is rust, some is python

No, the article is specifically about 1115 malware repos built from the same template

This is taken from the intro of the article:

> Wrote a script that helped me find 1115 repositories built based on the instructions from the guide.

I don’t know what you think you’re talking about, but you’re not talking about the article that I’m talking about.

The template repo is here: https://github.com/Jalynn0922/steal-cook

It contains the main.py script that the article is talking about.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#134

Post by gsck »

sylware wrote: post #65
avodonosov wrote: post #61

Earlier quoted context omitted.

Is there such a right hosting, with noscript and basic html?

Yes. I use at least 2 of them... repo.or.cz, or rocketgit, and I guess they are many more. Drop microsoft github and move there or similar. But the best is to host yourself. But careful, you are going against big tech interests, expect their shadow-paid hackers to attack you and any real-life alternative you use.

Do you have any proof of these "shadow-paid hackers" or are you just schizo posting?

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#135

Post by Aurornis »

dcow wrote: post #131
Aurornis wrote: post #72

Earlier quoted context omitted.

> The repos aren't themselves doing harm, Yes they are. Did you read the part about the people doing this and getting 50-100 compromised computers per day? They’re stealing accounts and crypto with these. > are valuable for research, Research into how they’re harming people? The research is done. Time to move to fixing it. > and would be distributed some other way if GH removed them. This is like saying we shouldn’t…

At least the malware is exposed in the light of day. I didn't say don’t fix something. I asked whether the malware should be removed vs e.g. being flagged by github. If github removes it, it will move somewhere else and be harder to keep a thumb on. That’s fine, I was curious because this “research” wouldn’t have happened in the first place if the malware was elsewhere. It sounds like intent here matters…

> If github removes it, it will move somewhere else and be harder to keep a thumb on.

It’s on GitHub for visibility and credibility to victims.

If it moves somewhere else where victims can find it, the researchers can find it too.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#136

Post by andrewchilds »

Jimmc414 wrote: post #120
linwangg wrote: post #69

This raises a big question: How effective is GitHub’s abuse reporting system against large-scale malware campaigns? If 1,000+ malicious repos can persist for months, does this mean GitHub lacks automated scanning or relies too much on user reports?

> If 1,000+ malicious repos can persist for months 3 years unfortunately https://github.com/Jalynn0922/steal-cook

I mean, do a search for "steal cookie": https://github.com/search?q=steal+cookie&type=repositories

This one has been up for two years: https://github.com/Aker490/Steal-Cookie-Roblox

It would be good to hear an official response from GitHub on where the boundaries are, since it seems like there's plenty of examples of clearly malicious repos hosted for years.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#137

Post by catsma21 »

Aurornis wrote: post #133
catsma21 wrote: post #132

Earlier quoted context omitted.

the article details how github is spammed by multiple people who read one guide. not every single one of the 1000 repos is THE SAME breed of malware. some overlap, maybe. but some is c#, some is rust, some is python. out of those that are python, some are obfuscated with this love/trust/joy obfuscator, some use pyarmor, some are compiled with nuitka. no, the guide does not instruct you which malware strain to use, on…

> not every single one of the 1000 repos is THE SAME breed of malware. some overlap, maybe. but some is c#, some is rust, some is python No, the article is specifically about 1115 malware repos built from the same template This is taken from the intro of the article: > Wrote a script that helped me find 1115 repositories built based on the instructions from the guide. I don’t know what you think you’re talking about,…

NOT the same malware template. article only details how "This first repo I found" works, not all of them. look at how his github searching script works in "Scraping Github" - there is no way to determine what malware is in the repo, only that it is doing keyword stuffing.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#138

Post by xprueg »

delusional wrote: post #46
rwmj wrote: post #15

Earlier quoted context omitted.

As another data point: MSFT have some sort of open mail server/service called onmicrosoft.com which (in my experience anyway) is only being used to send out fraudulent paypal messages. Because it lets the spammer set the From to service@paypal.com and also contains valid DKIM etc, it sails past spam filtering. There are so many complaints about this on (real) paypal.com forums, but Microsoft are apparently unable to…

How would Microsoft forge a DKIM signature? It sounds more likely that it's just a shitty email from Paypal.

Here’s a CCC talk[1] which shows how you can send mails from other servers by „SMTP Smuggling“.

1: https://media.ccc.de/v/37c3-11782-smtp_smuggling_spoofing_e-...

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#139

Post by williamdclt »

BLKNSLVR wrote: post #70
klaas- wrote: post #11

I think Microsoft has a general problem with getting rid of unwanted things within their eco-system. I keep complaining that their feedback.azure.com portal is filled with spam/malware comments and links, but even internally their teams can't reach anyone to get it fixed. Example https://feedback.azure.com/d365community/idea/9d0b22d8-c025-...

If only they had some kind of partnership with one of the big AI companies they might be able to leverage it to make their products, sorry, services better. "We only sell the shovels, we don't use them, we don't think we have any holes needing dug."

I think I prefer spam to AI moderating the internet, to be honest (although I have little doubt that this feeling isn’t shared by big tech and almost all moderation is going to be done by AI)

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#140

Post by ryandrake »

klaas- wrote: post #11

I think Microsoft has a general problem with getting rid of unwanted things within their eco-system. I keep complaining that their feedback.azure.com portal is filled with spam/malware comments and links, but even internally their teams can't reach anyone to get it fixed. Example https://feedback.azure.com/d365community/idea/9d0b22d8-c025-...

Look at the comments down below that post. All unmoderated trash and spam. There's nobody in the driver's seat at Microsoft, is there?
Post reply on HN