Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I reversed a Node.js malware and found the author

medium.com

Post reply on HN
Print view View original

41–50 of 79 posts

Re: I reversed a Node.js malware and found the author

#41

Post by tisryno »

smorgusofborg wrote: post #34
Mashimo wrote: post #33

Earlier quoted context omitted.

* Discord Credit Card Stealing * Discord Login Stealing

I didn't really get that comment in the OP. There's not an API that gives you your entire stored credit card information? Right?

No, there's no direct API for that. What the malware does is inject javascript into your discord, so if you add any payment details to your account it will harvest the data and send it via the Webhook to the owner.

The injected code also will scan your friends for "rare" badges, like the Bot Developer, Early Supporter and Certified Moderator. They use this information to then target the malware to those people in the hopes they can sell the rare badge accounts.

Re: I reversed a Node.js malware and found the author

#42

Post by vmception »

lolvmception wrote: post #40
vmception wrote: post #26

Earlier quoted context omitted.

I used to just DDOS people’s AIM and messengers if they crossed me, as a phantom curse attached to them and they had no idea the cause. I would chat with them as normal at the same time, chuckling to myself as they kept falling offline following a barrage of emoticons and requests from my army of chat bots that made their process run out of memory. Eventually I’d bore of it. Or have one of the chatbots tell them not…

Quoted post unavailable.

I was going to write it earlier but I was content with the statute of limitations so just bring it up when I run for office, it pretty much has nothing to do with what you believe

I wrote about what happened, its a different reaction than the person I replied to - who actually visited the person instead of calling the police - there was no prowess associated with my response only that it was different and impersonal and also satisfactory, no more no less

Re: I reversed a Node.js malware and found the author

#43

Post by vmception »

suzzer99 wrote: post #35
vmception wrote: post #26

Earlier quoted context omitted.

I used to just DDOS people’s AIM and messengers if they crossed me, as a phantom curse attached to them and they had no idea the cause. I would chat with them as normal at the same time, chuckling to myself as they kept falling offline following a barrage of emoticons and requests from my army of chat bots that made their process run out of memory. Eventually I’d bore of it. Or have one of the chatbots tell them not…

Way way back in the day, my friend wrote a program that would format the user's Commodore 5 1/4" floppy disk (usually the one that also ran their BBS) if they just tried to load it. They didn't even have to run it. If someone screwed us, we'd create a new identity and upload a file named after a hot new pirated game to their BBS. Then sit back and watch the BBS go offline for a while.

Niiiice, that reminds me of why I dont pirate Windows disk images any more, theyre all compromised! The “slim” builds with a buncha stuff deleted and also preloaded was nice, but now they just steal crypto.

Re: I reversed a Node.js malware and found the author

#45

Post by lolvmception »

vmception wrote: post #42
lolvmception wrote: post #40

Earlier quoted context omitted.

Quoted post unavailable.

I was going to write it earlier but I was content with the statute of limitations so just bring it up when I run for office, it pretty much has nothing to do with what you believe I wrote about what happened, its a different reaction than the person I replied to - who actually visited the person instead of calling the police - there was no prowess associated with my response only that it was different and impersonal…

No post body was provided.

Re: I reversed a Node.js malware and found the author

#46

Post by tisryno »

easrng wrote: post #2

It's always PirateStealer, probably because it's open source so it's easy for people to pick up and use instead of exerting effort. Also, you can send a DELETE request to a Discord webhook without any auth, defusing the malware.

Yes, you can send a DELETE to a Discord Webhook, but these malware projects have clocked on in most situations and now forward Webhooks through their own domains.

For the example of PirateStealer, the kid who made it ran a website where you posted your webhook and it spat out an exe that hid your webhook behind the domain, they even sold "premium" copies with additional security but in reality once they put the webhook behind their own domains they were dual-hooking, so the information was actually sent to 2 webhooks instead of just the 1.

Most of the services to create this malware now hide it behind a domain rather than directly exposing the Webhook, so shutting it down isn't as easy.

Re: I reversed a Node.js malware and found the author

#47

Post by jacquesm »

userbinator wrote: post #27
grepfru_it wrote: post #15

I did the same thing to someone who attacked my gf in high school. They got her with subseven which was extremely easy to remove. Rather than just erase it, I took a copy home with me and analyzed it. Running the strings command uncovered the subseven signatures.. Turns out there was tooling that allowed you to modify the binary and redistribute it. Except the binary had an ICQ address to alert him to my gf’s online…

I had fun with people on forums trying to get others to download keyloggers and the like. A lot of these were the stereotypical "script kiddies" who didn't know how much personal data they were giving away or even how the tools they used worked. I distinctly remember a few "C:\Documents and Settings\ \...", from which I could find and sometimes phone them (often their parents would answer), but I drew the line at doi…

It's all fun and games until the doorbell rings.

Re: I reversed a Node.js malware and found the author

#48

Post by tisryno »

timwis wrote: post #44

Is it not possible for discord to mitigate this vulnerability?

I don't know the specifics, but I'd assume not, Discord has made big steps recently in stopping this sort of malicious activity by adding the "Report Spam" feature as well as creating their own phishing link database to help detect spam in private messages.

Discord knows it's a big issue and I'd hope they've attempted to mitigate the malware but there's no way to stop the actual injection, so really all they can do is code shuffle frequently to make the injected code redundant, but that'd rely on doing releases frequently and hoping everyone updates just as frequently.

Re: I reversed a Node.js malware and found the author

#49

Post by atdrummond »

lolvmception wrote: post #40
vmception wrote: post #26

Earlier quoted context omitted.

I used to just DDOS people’s AIM and messengers if they crossed me, as a phantom curse attached to them and they had no idea the cause. I would chat with them as normal at the same time, chuckling to myself as they kept falling offline following a barrage of emoticons and requests from my army of chat bots that made their process run out of memory. Eventually I’d bore of it. Or have one of the chatbots tell them not…

Quoted post unavailable.

It's just as sad you made an account just to troll the user you're replying to, given the username.

Re: I reversed a Node.js malware and found the author

#50

Post by vm2196 »

lolvmception wrote: post #45
vmception wrote: post #42

Earlier quoted context omitted.

I was going to write it earlier but I was content with the statute of limitations so just bring it up when I run for office, it pretty much has nothing to do with what you believe I wrote about what happened, its a different reaction than the person I replied to - who actually visited the person instead of calling the police - there was no prowess associated with my response only that it was different and impersonal…

Quoted post unavailable.

You must be real fun at parties. Dickweed.
Post reply on HN