Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I reversed a Node.js malware and found the author

medium.com

Post reply on HN
Print view View original

11–20 of 79 posts

Re: I reversed a Node.js malware and found the author

#11

Post by openknot »

technion wrote: post #7
FastEatSlow wrote: post #3

Finding the author of most common malware isn't hard, skript kiddies really like their credit for reputation.

Is it really fair to call someone a "skript kiddie" if they wrote the malware themselves that became "the most common malware" ?

A misquote or an edit in the original comment occurred, as it now appears as: "Finding the author of most common malware isn't hard."

This assertion is different (i.e. Finding the author of [the majority of] malware isn't hard..., versus Finding the author of [the most popularly-used] malware isn't hard...).

Re: I reversed a Node.js malware and found the author

#12

Post by d4mi3n »

Fabricio20 wrote: post #9
easrng wrote: post #2

It's always PirateStealer, probably because it's open source so it's easy for people to pick up and use instead of exerting effort. Also, you can send a DELETE request to a Discord webhook without any auth, defusing the malware.

I'm still glad the DELETE thing works, I've reported a few times these with a complete writeup to Discord and all I got was a ticket being auto-closed after a month and the webhooks+servers still being up. I personally no longer bother reporting, just straight delete the webhook to stop the spread. Makes you wonder what their security/support team is doing with all those tickets.

They may not have one, or have one that’s so underwater with larger issues that the rest of the org doesn’t know how to route things to them.

Hiring for technical security is hard—you need engineering expertise to find good people, and then you need someone with an infosec background to vet them.

Finding a combination of both is surprisingly rare and you usually find infosec folks who can define but not implement a security program, or an engineer that can implement a security program with no idea how to run or grow it.

I need more peers in this space. If you’re reading this and are a software engineer looking for a transition please do reach out—email is in my profile. There’s a huge demand for security engineers and not nearly enough engineers interested in doing it.

Re: I reversed a Node.js malware and found the author

#13

Post by rnotaro »

chana_masala wrote: post #10
MrStonedOne wrote: post #4

Our discord got hit by the same shit, targeted at our game admins. We are the largest open source multiplayer video game on github, so (compromised) discord friends sending admins messages about "games they made" with exes in them was more effective then it should have been until news and announcements went out.

Which game? bzflag is the only one that comes to mind, but I am not a gamer.

I had Teeworlds [1] in mind but their game is tg Space Station 13 [2].

[1]https://github.com/teeworlds/teeworlds [2]https://github.com/tgstation/tgstation

Re: I reversed a Node.js malware and found the author

#15

Post by grepfru_it »

I did the same thing to someone who attacked my gf in high school. They got her with subseven which was extremely easy to remove. Rather than just erase it, I took a copy home with me and analyzed it. Running the strings command uncovered the subseven signatures.. Turns out there was tooling that allowed you to modify the binary and redistribute it. Except the binary had an ICQ address to alert him to my gf’s online presence. He also had his AIM screen name, full name and city in his profile.

So I socially engineered him by posing as a classmate. I told him I was going to come by to get the homework for English. He wasn’t sure but I somehow convinced him and got his address. I don’t know why they always talk to strangers, but just like the article the dude responded. I got my friend and we went to pay him a visit.

Rang his doorbell, “hi is this l33th4x0r?”. He nodded but had no clue who I was. I mentioned my gf’s screen name and you could see the color leave his face. He stuttered and stammered about how he was just playing and didn’t mean to cause any problems. I said some stern words then left him wondering wtf I was and what just happened.

Kinda wish I saved the details (screen name, address, etc) just because of how epic it was at the time

Re: I reversed a Node.js malware and found the author

#19

Post by lolinder »

hankman86 wrote: post #18

Why did you redact the identity of the scammer? Please name and shame them! These people need to be called out and it seems like you’ve got irrefutable proof.

These posts show up on every thread like this and it always strikes me as off. It's not that I think the scammer here deserves protection, but the impulse to "name and shame" makes me very uncomfortable.

I worry that supporting that impulse, even in cases like this, normalizes the use of internet lynch mobs to exact "justice" (for any subjective value of "justice" that can get enough steam).

Re: I reversed a Node.js malware and found the author

#20

Post by oh_sigh »

hankman86 wrote: post #18

Why did you redact the identity of the scammer? Please name and shame them! These people need to be called out and it seems like you’ve got irrefutable proof.

Why are you so credulous to believe any random account on the internet?

Not saying the author is a liar. But it sounds like you want to go on a crusade for them after just finding out they exist.

Post reply on HN