Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

theverge.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

#21

Post by techjamie »

HDBaseT wrote: post #14
zuzululu wrote: post #5

He was smart/determined enough to risk it all. Why didn't he just try find a job that pays $200k/year ? Why play into the stereotypes ?

It is honestly much easier to spread malware or hack companies than it is to make 200k/year from a company. Now with AI, you can accelerate this so much. The only thing holding back thousands of new threat actors from doing the same is Opsec, its hard.

A silver lining is that at least a lot of these AI generated malware and phishing scams are easy to disrupt with mild white hat skills. Often the people behind them lack the knowledge on how to prevent themselves from being disrupted by said white hats.

The most laughable I've seen was a scam that put a captcha on the frontend to stop me from flooding their free email system on the backend and rate limit them. However, the captcha was clientside only, so I didn't even notice until I looked to see if they rotated emails, but also the captcha was a textbox with the code set as the placeholder.

Truly the pinnacle of vibecoding a scam.

Re: Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

#22

Post by drnick1 »

techjamie wrote: post #19
drnick1 wrote: post #10

This underscores a major issue with commercial software like Steam and games obtained therein. You cannot trust that software not to maliciously scan your device for secrets such as crypto wallets or other information. Ideally, you want to run apps like Steam, Discord, Zoom and whatever else does not come from a trusted distribution repo as a separate user. This is not always convenient however, and the compromise I…

In theory you could change the steam command line fpr each game and have them launch in bubblewrap. Though I'm not sure how well that would play with graphics drivers. It might be friendly with AMD, but my experience is that NVIDIA is a pain to have play nice with containers.

I sandbox Steam itself for simplicity. My experience with Nvidia and Wayland has been good. I simply exposed /dev/nvidia*, a few networking-related files in /etc and system binaries like /usr.

Re: Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

#23

Post by charcircuit »

drnick1 wrote: post #10

This underscores a major issue with commercial software like Steam and games obtained therein. You cannot trust that software not to maliciously scan your device for secrets such as crypto wallets or other information. Ideally, you want to run apps like Steam, Discord, Zoom and whatever else does not come from a trusted distribution repo as a separate user. This is not always convenient however, and the compromise I…

Android solves this problem by making it impossible for an app to access the storage of another app. No matter how much the Steam app wants to see your crypto wallet's key it is not possible (assuming no Linux exploit).

Re: Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

#24

Post by pfych »

choilive wrote: post #12
r_lee wrote: post #9

Earlier quoted context omitted.

> didn't he just try find a job that pays $200k/year ? you really think it's that easy?

Claude get me a job that pays $200k/yr. Make no mistakes.

Claude get me a job that pays $200k/yr. Make a breakthrough.

Re: Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

#25

Post by drnick1 »

charcircuit wrote: post #23
drnick1 wrote: post #10

This underscores a major issue with commercial software like Steam and games obtained therein. You cannot trust that software not to maliciously scan your device for secrets such as crypto wallets or other information. Ideally, you want to run apps like Steam, Discord, Zoom and whatever else does not come from a trusted distribution repo as a separate user. This is not always convenient however, and the compromise I…

Android solves this problem by making it impossible for an app to access the storage of another app. No matter how much the Steam app wants to see your crypto wallet's key it is not possible (assuming no Linux exploit).

That's nice, but a cell phone isn't a viable gaming platform for anything but very basic games. And Android, at least in its typical Googled form, has its own set of problems; it's a privacy nightmare.

Re: Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

#26

Post by darksim905 »

vorpalhex wrote: post #17
robotnikman wrote: post #16

Earlier quoted context omitted.

>Why didn't he just try find a job that pays $200k/year ? Probably was not able to get into MIT or another prestigious school that many of those companies look for on a resume.

None of my peers went to any school of note, nor did I. A fair bit of community college, some lower ranked state unis, and one guy did a bootcamp. All well above 200k.

What do they do, _exactly_? Because in the real world out of YC, the rest of us can barely top $200,000 a year unless we move into management or Executive level roles.

Re: Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

#27

Post by LoganDark »

HDBaseT wrote: post #15
LoganDark wrote: post #7

I heard Monero can help against blockchain analysis (though less so if you buy from adversaries). Unfortunately it looks like blockchain analysis was not the attack vector here, but rather buying gift cards through an incompetent intermediary.

Not really an "incompetent intermediary", Bitrefill, the company used for buying gift cards with Bitcoin received legal requests to identify the user. Bitrefill doesn't proclaim insane privacy protections, they are based out of Sweden but aren't immune to being requested to provide the information. Monero could of helped, although its not easy to transfer BTC to Monero without P2P trades, as effectively every exchang…

Making it possible to identify a user is incompetence, exactly because of legal issues like this. You don't run a service that accepts crypto for gift cards and then keep information on file that identifies the buyer personally, that's just stupid. But then again, you don't illegally obtain crypto and then give out your info when you go to use the illegal funds, that's just stupid as well.

Is P2P that big a deal? I swap coins on Bisq all the time. It's super easy to pick up and use if you already have the BTC. The biggest obstacle is obtaining some BTC in the first place when you don't have any yet. Once you have enough for the security deposit, you can buy/sell or swap thousands of dollars in funds at a time.

Re: Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

#28

Post by handedness »

Cider9986 wrote: post #4
fsflover wrote: post #3

Earlier quoted context omitted.

> Victims should have not keep crypto on desktops. They are much less secure than Mobile. Unless it's Qubes OS.

True. How viable is steam on Qubes?

It's doable if you have a suitable GPU to pass through to a Steam Qube, but it's still far from simple or even viable for most users, e.g., https://forum.qubes-os.org/t/step-by-step-nvidia-gpu-passthr...

Re: Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

#29

Post by Cider9986 »

HDBaseT wrote: post #15
LoganDark wrote: post #7

I heard Monero can help against blockchain analysis (though less so if you buy from adversaries). Unfortunately it looks like blockchain analysis was not the attack vector here, but rather buying gift cards through an incompetent intermediary.

Not really an "incompetent intermediary", Bitrefill, the company used for buying gift cards with Bitcoin received legal requests to identify the user. Bitrefill doesn't proclaim insane privacy protections, they are based out of Sweden but aren't immune to being requested to provide the information. Monero could of helped, although its not easy to transfer BTC to Monero without P2P trades, as effectively every exchang…

>Monero could of helped, although its not easy to transfer BTC to Monero without P2P

It's really not hard but it probably gets much harder to transfer tainted Bitcoin. Trocador.app aggregates various no-KYC CEX swaps and is regarded well in the Monero community.

As we can see from the various Monero pumps, which often stemmed from cleaning coins. Thieves don't want to sit on the Bitcoin so they drive up the price of Monero selling it fast.

Yeah P2P is more technical. Hopefully with Serai we can get a good UX decentralized exchange.

Swapping into fiat is a different beast.

Re: Bitcoin trail, Google cookies and Uber Eats orders help tie man to Steam malware

#30

Post by charcircuit »

drnick1 wrote: post #25
charcircuit wrote: post #23

Earlier quoted context omitted.

Android solves this problem by making it impossible for an app to access the storage of another app. No matter how much the Steam app wants to see your crypto wallet's key it is not possible (assuming no Linux exploit).

That's nice, but a cell phone isn't a viable gaming platform for anything but very basic games. And Android, at least in its typical Googled form, has its own set of problems; it's a privacy nightmare.

And despite what you claim it is the most profitable gaming platform. There are lessons you can learn from them.
Post reply on HN