Github scam investigation: Thousands of “mods” and “cracks” stealing data • Hacker News Board

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#161

Post by nottorp » Sat, Mar 01, 2025, 9:48 AM UTC

babygsmallz wrote: post #157

nottorp wrote: post #22

"Or why you should never download game mods"... Like everything else, you shouldn't blindly search on github - or any other download site. Only download from links referred from the official site if there's any, or the game's forum, or any other trustable and human reviewed source.

Best part is people downloading them and turning EVERYTHING off - running it as admin, antivirus off, everything. How can you trust something random off the internet that much?

Not random, but let's take this example:

https://forums.beamdog.com/discussion/87952/icewind-dale-2-e...

There is no official Enhanced Edition for IWD2 and there will never be because the source code is lost.

This is a fan made mod that patches the original binaries in memory to add stuff like wide screen support etc. And it triggers your anti virus because of that.

It's perfectly fine as long as you download it from the official sources.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#162

Post by kennysoona » Sat, Mar 01, 2025, 10:07 AM UTC

ndiddy wrote: post #152

Terretta wrote: post #99

Earlier quoted context omitted.

> Without a doubt every search result I found on that forum from someone having a similar issue never resulted in a useful lead. This was subsumed into answers.microsoft.com and it's turned into a few of those original "good with computers" retirees spending all day answering from within their own knowledge, now overwhelmed by countless individuals with names or flavors of English suggesting emerging economic zones "…

> This is so consistent, I wonder what is driving it. Microsoft has a cert called "Most Valuable Professional" that gives out a ton of free stuff (free MSDN subscription, free admission to a conference that gives away hardware, etc). It also probably looks good on your resume to hiring managers who don't know any better. Renewing the cert involves doing "community work", and the easiest way to do community work is to…

So that's the answer to the question I always had but never bothered to ask. Thanks!

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#163

Post by kbolino » Sat, Mar 01, 2025, 1:48 PM UTC

bobince wrote: post #141

delusional wrote: post #46

Earlier quoted context omitted.

How would Microsoft forge a DKIM signature? It sounds more likely that it's just a shitty email from Paypal.

Yes, they're originated by PayPal, but collected by a different original recipient and from there sent on to the victim. The envelope-recipient is not part of the material signed by DKIM, so the signature remains valid. The To: header _is_ part of the signed material so will list the original recipient not the victim — but the attacker sets the recipient name/address to something misleading like “Order Received” to o…

It seems like it's time to revise DMARC so that it requires (or at least can be configured to require) both SPF and DKIM to pass.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#164

Post by snailmailman » Sat, Mar 01, 2025, 5:14 PM UTC

landr0id wrote: post #145

vegadw wrote: post #88

I think to an extent Microsoft is the guilty party here. For may cracks Windows Defender will trip saying "Win32/Keygen" even if there's no actual malware https://www.microsoft.com/en-us/wdsi/threats/malware-encyclo... This trains people that do a lot of piracy to be used to turning off their antivirus to let something through, which is fine until it's not. It's like drugs, if we know a subset of the population will…

Windows Defender believes that my Rust egui application is a trojan, but magically if I compile it with a different toolchain it's no longer flagged :p There's something seriously wrong with A/V heuristics.

I’ve had similar issues across multiple programming languages. The latest is a C++ program with almost no dependencies. While I’m making changes and frequently recompiling, windows defender will randomly pop-up and let me know that it deleted my freshly-compiled binary. The change will often be something simple, and simply making any change and compiling again will randomly not get flagged.

It’s extremely annoying. It’s my code, stop deleting it. It’s not malware.

Re: Github scam investigation: Thousands of “mods” and “cracks” stealing data

#165

Post by Hilift » Sun, Mar 09, 2025, 2:23 PM UTC

_7acn wrote: post #29

In my opinion, Microsoft’s entire support is at a tragically poor and hopeless level. GitHub is flooded with open issues that remain open for years without any response from Microsoft. The same applies to Azure. The technical support there is also truly terrible, and it’s easy to find horror stories online about people losing access to their accounts and being unable to restore them.

A bit late, but there was a bug in the GitHub Win32 OpenSSH that was introduced in last October 2024 cumulative update. This was precipitated by a PR from September 2023. It performs a permissions check on the logs and other folders, and apparently enforces the permissions it expects, as the service crashes/does not start. This seems to affect Windows platforms more as opening an affected location in Windows Explorer probably prompts the user that access is denied, and would you like to update the permissions. https://github.com/PowerShell/Win32-OpenSSH/issues/2282