Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 10k GitHub repositories distributing Trojan malware

orchidfiles.com

Post reply on HN
Print view View original

221–230 of 268 posts

Re: I found 10k GitHub repositories distributing Trojan malware

#221

Post by codedokode »

mittensc wrote: post #217
codedokode wrote: post #208

Earlier quoted context omitted.

How do you sandbox /proc by the way? So that the app doesn't crash due to missing /proc/self/exe link or /proc/ID/stat file, but cannot read my private information (like /proc/cmdline, /proc/mounts etc)? Things like bind mounts do not work on /proc. I ended up with writing a FUSE-based emulation in Python, but there are lot of issues with permissions and namespaces: - I could run my /proc emulator in the same PID nam…

> Also, running a program is the most basic functionality of an OS and you suggest that I need to write my own sandbox to do this because it is not included with Linux. Maybe that is why this year still is not the year of Linux on desktop. I'm saying other OSs are worse for sandboxing. How would you achieve what you want on MacOS or Windows? (or others?), what do you think goes on behind the scenes? I would set up a…

It doesn't matter how bad is Windows or Mac because I do not use them.

Apple might have something made for the government. They are very cooperative and routinely remove VPN apps from the repository at the request of Russian government, probably they will happily cooperate with US government as well.

> how do you defend from Microsoft/Google/Apple deciding to spy on you

My smartphone is in airplane mode since purchase and doesn't have a SIM card. I am considering options to port an open-souce firmware like Lineage OS, patch proprietary firmware or make mix of both. However to do this I need a realistic emulator that cannot be easily detected and that emulates at least some of phone hardware so that I can see what the programs try to do and where they try to connect to. Obviously there will be no Google services and similar software, mostly open-source apps from F-Droid.

As for computer, I use Linux so I guess I am relatively safe.

Re: I found 10k GitHub repositories distributing Trojan malware

#222

Post by brettermeier »

mschuster91 wrote: post #212
lynx97 wrote: post #211

Earlier quoted context omitted.

> ... and organizations willing to pay a lot of money to do political manipulation / influencing. Like what, parties campaigning?

We're talking about foreign influence here. All recent US and German elections reeked of Russian dark money, then there was the entire Cambridge Analytica mess and before that it was Brexit.

And Elon Musks dark money. Don't forget that. He gives his best to influence european politics.

Re: I found 10k GitHub repositories distributing Trojan malware

#223

Post by mschuster91 »

brettermeier wrote: post #222
mschuster91 wrote: post #212

Earlier quoted context omitted.

We're talking about foreign influence here. All recent US and German elections reeked of Russian dark money, then there was the entire Cambridge Analytica mess and before that it was Brexit.

And Elon Musks dark money. Don't forget that. He gives his best to influence european politics.

Don't think he gives money, but yes, he definitely does everything he can to help out the far-right with his global audience.

Re: I found 10k GitHub repositories distributing Trojan malware

#224

Post by mittensc »

codedokode wrote: post #221
mittensc wrote: post #217

Earlier quoted context omitted.

> Also, running a program is the most basic functionality of an OS and you suggest that I need to write my own sandbox to do this because it is not included with Linux. Maybe that is why this year still is not the year of Linux on desktop. I'm saying other OSs are worse for sandboxing. How would you achieve what you want on MacOS or Windows? (or others?), what do you think goes on behind the scenes? I would set up a…

It doesn't matter how bad is Windows or Mac because I do not use them. Apple might have something made for the government. They are very cooperative and routinely remove VPN apps from the repository at the request of Russian government, probably they will happily cooperate with US government as well. > how do you defend from Microsoft/Google/Apple deciding to spy on you My smartphone is in airplane mode since purchas…

Allright, so since you're using Linux and alternatives are worse... what's there to complain about?

why not put that effort into improving stuff / finding solutions?

Re: I found 10k GitHub repositories distributing Trojan malware

#225

Post by lelanthran »

Jimmc414 wrote: post #106

This is happening to me as well. I have a few moderately popular open source projects and I have found my name attached to new projects that I have nothing to do with or they are derivatives of my projects with redirection to unknown sites. Legitimate projects: https://github.com/jimmc414/onefilellm https://github.com/jimmc414/Kosmos https://github.com/jimmc414/cctrace Projects using my name which I have no affiliati…

> Projects using my name which I have no affiliation with or they are projects I have written that they have injected new URLs into:

How do you find these? I don't want to search for my name on those dodgy sites, as that tells them my projects exist.

Re: I found 10k GitHub repositories distributing Trojan malware

#226

Post by overloadedop »

I did a bit of reversing on it and it looks like it's a copy/fork of Aeternum. It takes screenshot and uploads it to a TA controlled infra, makes some eth_call via json rpc to polygon. the C2 is hosted by Organization: Standart AG, LLC (Latvia) ASN: AS207957

Re: I found 10k GitHub repositories distributing Trojan malware

#227

Post by ahoef »

lelanthran wrote: post #225
Jimmc414 wrote: post #106

This is happening to me as well. I have a few moderately popular open source projects and I have found my name attached to new projects that I have nothing to do with or they are derivatives of my projects with redirection to unknown sites. Legitimate projects: https://github.com/jimmc414/onefilellm https://github.com/jimmc414/Kosmos https://github.com/jimmc414/cctrace Projects using my name which I have no affiliati…

> Projects using my name which I have no affiliation with or they are projects I have written that they have injected new URLs into: How do you find these? I don't want to search for my name on those dodgy sites, as that tells them my projects exist.

I understand this sentiment, but rest assured that they will find your projects anyway.

Re: I found 10k GitHub repositories distributing Trojan malware

#228

Post by overloadedop »

overloadedop wrote: post #226

I did a bit of reversing on it and it looks like it's a copy/fork of Aeternum. It takes screenshot and uploads it to a TA controlled infra, makes some eth_call via json rpc to polygon. the C2 is hosted by Organization: Standart AG, LLC (Latvia) ASN: AS207957

[dead]

Re: I found 10k GitHub repositories distributing Trojan malware

#230

Post by srdjanr »

tuetuopay wrote: post #111
weird-eye-issue wrote: post #19

Earlier quoted context omitted.

This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match

That's without considering a lot of banks have non-textual inputs for their passwords. Man they love their scrambled virtual keyboard! I think the worst I ever had was HSBC that asked me for fragments of my password, like characters 4, 6, 7, 11, and 12. Absolute bonkers of a security theatre.

How can they even do that without storing plaintext passwords?
Post reply on HN