Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keylogger discovered in image generator extension

old.reddit.com

Post reply on HN
Print view View original

11–20 of 102 posts

Re: Keylogger discovered in image generator extension

#11

Post by Latty »

14 wrote: post #8

Is there no way to defend against a keylogger? What can you do if a simple keylogger can steal your passwords?

Ideally, don't use passwords: Passkeys where supported, SSH Keys, client certificates, social login via a service that does support one of these methods.

Magic link emails can also work, but are potentially vulnerable if you copy/pasted it rather than clicking depending on the keylogger's capability and clipboard visibility, although the window for attack is small, it's a much more sophisticated attack that leaves more traces (good sites will reject reuse).

Second best, also use a second factor: U2F ideally, TOTP with the same caveats as magic link emails, and at the bottom of the barrel SMS which is better than nothing but known to be very flawed.

Honestly, if you are anything other than a casual user, and don't have devices with support baked in already, it's crazy not to spend ~£60 on a pair of security keys for passkey/U2F. It's not a lot of money and is just so much more secure.

Re: Keylogger discovered in image generator extension

#12

Post by zamalek »

WarOnPrivacy wrote: post #4

Some entity called Nullbulge Group claims they took over the repo. Today's capture (before the repo got 404'd) has their belligerence spiel. https://web.archive.org/web/20240609135118/https://github.co... This is the capture from 3 days prior: https://web.archive.org/web/20240525021402/https://github.co...

Must be script kiddies. You have the opportunity to deploy anything to a machine that almost certainly has a powerful GPU, and choose a key logger that exists in signature databases? Genius.

Re: Keylogger discovered in image generator extension

#13

Post by belladoreai »

millzlane wrote: post #10
belladoreai wrote: post #6

Earlier quoted context omitted.

I have not seen a statement from Nullbulge so it's not appropriate to say that they took over the repo. The author of the repo is claiming that their repo is hacked, but this is an obvious lie, because their very first GitHub commit is the one where they push the malware. Nobody would hack an empty GitHub account. I don't know if the author of the repo is lying when they say that Nullbulge is behind the attack (perha…

I wouldn't be so sure no one would hack an idle account. I had my Spotify account taken before I even used it. I think in my case they used my account to pump up other lesser known artists.

Okay, sure. But if we have an account which has never had any legitimate activity on it ever - an account that has only ever been used to push malware - then I don't know if it matters much who is the "rightful owner" of the account. Things would be different if the GitHub account had some legitimate activity before the "hack".

Re: Keylogger discovered in image generator extension

#15

Post by Retr0id »

14 wrote: post #8

Is there no way to defend against a keylogger? What can you do if a simple keylogger can steal your passwords?

Aside from not using passwords or using 2FA, sandboxing helps.

A VM with GPU passthrough set up would be one example (although this is usually a pain to set up and I expect most people aren't doing it).

As a more user-friendly example, if you install an iOS app (local-model LLM and image generation apps exist), the sandboxing provided by the OS ought to be more than enough to prevent keyloggers, short of 0day exploits.

Re: Keylogger discovered in image generator extension

#16

Post by millzlane »

belladoreai wrote: post #13
millzlane wrote: post #10

Earlier quoted context omitted.

I wouldn't be so sure no one would hack an idle account. I had my Spotify account taken before I even used it. I think in my case they used my account to pump up other lesser known artists.

Okay, sure. But if we have an account which has never had any legitimate activity on it ever - an account that has only ever been used to push malware - then I don't know if it matters much who is the "rightful owner" of the account. Things would be different if the GitHub account had some legitimate activity before the "hack".

I agree it doesn't matter much. Could be a noob mistake by the account owner and this is damage control.

Re: Keylogger discovered in image generator extension

#17

Post by nsingh2 »

Retr0id wrote: post #15
14 wrote: post #8

Is there no way to defend against a keylogger? What can you do if a simple keylogger can steal your passwords?

Aside from not using passwords or using 2FA, sandboxing helps. A VM with GPU passthrough set up would be one example (although this is usually a pain to set up and I expect most people aren't doing it). As a more user-friendly example, if you install an iOS app (local-model LLM and image generation apps exist), the sandboxing provided by the OS ought to be more than enough to prevent keyloggers, short of 0day exploit…

Not as secure as VMs but GPU passthrough with Docker/Podman is much easier to set up, and you can even use the GPU on the host machine at the same time.

Re: Keylogger discovered in image generator extension

#18

Post by szundi »

belladoreai wrote: post #5
skilled wrote: post #3

Looks like a pretty small project. Only had 40 stars on GitHub before the repo was removed. Was this the main method of GPT4 and Claude integrations for ComfyUI?

It was an extension for ComfyUI, which has 37k stars on GitHub. The way ComfyUI is commonly used is that a person shares a "workflow" file, which utilizes various obscure extensions (called "custom nodes") and then the people who want to run the workflow on their own computer will install all these obscure custom nodes that have like 40 stars on GitHub or so.

Just like an npm install

Re: Keylogger discovered in image generator extension

#19

Post by Stagnant »

zamalek wrote: post #12
WarOnPrivacy wrote: post #4

Some entity called Nullbulge Group claims they took over the repo. Today's capture (before the repo got 404'd) has their belligerence spiel. https://web.archive.org/web/20240609135118/https://github.co... This is the capture from 3 days prior: https://web.archive.org/web/20240525021402/https://github.co...

Must be script kiddies. You have the opportunity to deploy anything to a machine that almost certainly has a powerful GPU, and choose a key logger that exists in signature databases? Genius.

Telegram and discord webhooks are 100% signs of an unsophisticated attacker and they are a very common sight in malware samples. Github is full of skiddie "info stealer" projects that use telegram api / discord webhook to deliver the stolen data. They make no sense to use since anybody can spam that webhook endpoint. Not 100% sure about discord, but at least in the case of telegram anybody can even read and download all the data that has been sent to it.

Re: Keylogger discovered in image generator extension

#20

Post by janoc »

millzlane wrote: post #10
belladoreai wrote: post #6

Earlier quoted context omitted.

I have not seen a statement from Nullbulge so it's not appropriate to say that they took over the repo. The author of the repo is claiming that their repo is hacked, but this is an obvious lie, because their very first GitHub commit is the one where they push the malware. Nobody would hack an empty GitHub account. I don't know if the author of the repo is lying when they say that Nullbulge is behind the attack (perha…

I wouldn't be so sure no one would hack an idle account. I had my Spotify account taken before I even used it. I think in my case they used my account to pump up other lesser known artists.

There was also an actively exploited XSS vulnerability on Github in the recent days.

Doesn't mean that this guy was not a malicious actor, only that one shouldn't be so quick to cast stones without evidence.

Post reply on HN