The Supreme Backdoor Factory • Hacker News Board

Re: The Supreme Backdoor Factory

#11

Post by dylz » Sun, Mar 03, 2019, 4:48 AM UTC

rolleiflex wrote: post #9

HelloFellowDevs wrote: post #8

So what does this mean for the people who have created bots for sneaker sites? I actually used to write code for those sneaker bots and run a slack group (before we all moved to discord), but I've never encountered oddities in the code builds for bots I used. This may be going over my head a bit but does this mean that the builders for the bot installs could contain malicious code?

In short, yes - could be. The blog shows at least one case where this has happened in practice. Semi-unrelated, but why did you end up moving from Slack to Discord, if I may ask?

The demographic of people buying the bots are not... very technical. Discord is what they are "used to".

Re: The Supreme Backdoor Factory

#12

Post by UncleEntity » Sun, Mar 03, 2019, 8:12 AM UTC

iceninenines wrote: post #7

If you want to find malware with no AV signatures, look at no-name warez of medium popular and niche professional software, and honey-net via unpatched Windows computers on exo-DMZ unfiltered IP addresses. I saw this one sample behavioral analysis of a trojaned well-known firewall product for Mac that tries to download Google Chrome in order to clickbot... no AV signature for it. With the right APT defenses, such as…

> and better use such farm for a big money-maker.

So...like raise goats or something?

Re: The Supreme Backdoor Factory

#13

Post by renholder » Sun, Mar 03, 2019, 10:44 AM UTC

I know I'm late to the party and this is probably the stupidest question in the world but one never knows unless one asks, yeah? How did he/she know the binaries were packed with upx?

Re: The Supreme Backdoor Factory

#14

Post by HelloFellowDevs » Sun, Mar 03, 2019, 12:41 PM UTC

rolleiflex wrote: post #9

HelloFellowDevs wrote: post #8

So what does this mean for the people who have created bots for sneaker sites? I actually used to write code for those sneaker bots and run a slack group (before we all moved to discord), but I've never encountered oddities in the code builds for bots I used. This may be going over my head a bit but does this mean that the builders for the bot installs could contain malicious code?

In short, yes - could be. The blog shows at least one case where this has happened in practice. Semi-unrelated, but why did you end up moving from Slack to Discord, if I may ask?

Like the other comment below, we made the jump because it was where the customer base was. Slack was great for webhooks and tooling to monitor stock but in the end it wasn’t where the paying people were.

Re: The Supreme Backdoor Factory

#15

Post by detaro » Sun, Mar 03, 2019, 1:43 PM UTC

renholder wrote: post #13

I know I'm late to the party and this is probably the stupidest question in the world but one never knows unless one asks, yeah? How did he/she know the binaries were packed with upx?

There's various analysis tools that can identify common packers, and I think you can at least guess UPX by looking at the file contents and seeing the string "UPX" a few times, which it uses as markers for something.