> as ChatGPT confirmed when I asked it to analyze it lol we are so cooked
> as ChatGPT confirmed when I asked it to analyze it
lol we are so cooked
This guy makes an app and had to use a chatbot to do a base64 decode?
The scariest "user support" email I've received
61–70 of 267 posts
Re: The scariest "user support" email I've received
#62Earlier quoted context omitted.
Isn't analysing and writing bits of code one of the few things LLMs are actually good at and useful for (as opposed to creative writing or whatever). Before LLMs if someone wasn't familiar with deobfuscation they would have no easy way to analyse the attack string as they were able to do here.
LLMs are just as bad at code as "creative writing or whatever". It's just that fewer people know how to write/smell code at the same level as prose, so we get drowned out as "anti-AI" cynics and the lie continues.
[deleted]
Re: The scariest "user support" email I've received
#63Earlier quoted context omitted.
https://duckduckgo.com/?t=ffab&q=base64+decode+Y3VybCAtc0wgL...
So I downloaded this file... Apparently it is: $ file -b grecaptcha Mach-O universal binary with 2 architectures: [x86_64:\012- Mach-O 64-bit x86_64 executable, flags: ] [\012- arm64:\012- Mach-O 64-bit arm64 executable, flags: ] I cannot perform a dynamic analysis as I do not have macOS. :( May anyone do it for me? Use "otool", "dtruss", and "tcpdump" or something. :D Be careful! The executable is available here: ht…
No need - it's detectable as Trojan:MacOS/Amos by VirusTotal, just Google the description. Spoiler: it's a stealer. Here [0] is a writeup
> AMOS is designed for broad data theft, capable of stealing credentials, browser data, cryptocurrency wallets, Telegram chats, VPN profiles, keychain items, Apple Notes, and files from common folders.
[0] https://www.trendmicro.com/en_us/research/25/i/an-mdr-analys...
Re: The scariest "user support" email I've received
#64> ChatGPT confirmed Why are you relying on fancy autocorrect to "confirm" anything? If anything, ask it how to confirm it yourself.
It’s less they did it and more they admitted to doing it heh
Re: The scariest "user support" email I've received
#65Earlier quoted context omitted.
So I downloaded this file... Apparently it is: $ file -b grecaptcha Mach-O universal binary with 2 architectures: [x86_64:\012- Mach-O 64-bit x86_64 executable, flags: ] [\012- arm64:\012- Mach-O 64-bit arm64 executable, flags: ] I cannot perform a dynamic analysis as I do not have macOS. :( May anyone do it for me? Use "otool", "dtruss", and "tcpdump" or something. :D Be careful! The executable is available here: ht…
No need - it's detectable as Trojan:MacOS/Amos by VirusTotal, just Google the description. Spoiler: it's a stealer. Here [0] is a writeup > AMOS is designed for broad data theft, capable of stealing credentials, browser data, cryptocurrency wallets, Telegram chats, VPN profiles, keychain items, Apple Notes, and files from common folders. [0] https://www.trendmicro.com/en_us/research/25/i/an-mdr-analys...
Thank you! Nothing too interesting. :(
Got anything better? :D Something that may be worth getting macOS for!
Edit: I have some ideas to make this one better, for example, or to make a new one from scratch. I really want to see how mine would fare against security researchers (or anyone interested). Any ideas where to start? I would like to give them a binary to analyze and figure out what it does. :D I have a couple of friends who are bounty hunters and work in opsec, but I wonder if there is a place (e.g. IRC or Matrix channel) for like-minded, curious individuals. :)
Re: The scariest "user support" email I've received
#66Which is why it's infuriating that health care companies implement secure email by asking the customer to click on a 3rd party link in an email. An email they're saying is an insecure delivery system. But we're supposed to click on links in these special emails. Fuck!
Problems:
- E-mail is insecure. It can be read by any number of servers between you and the sender.
- Numerically, very few healthcare companies have the time, money, or talent to self-host a secure solution, so they farm it out to a third-party that offers specific guarantees, and very few of those permit self-hosting or even custom domains because that's a risk to them.
As someone who works in healthcare, I can say that if you invent a better system and you'll make millions.
Re: The scariest "user support" email I've received
#67In Windows CMD you don’t even need to hit return at the end. They can just add a line break to the copied text and as soon as you paste into the command line (just a right click!), you own yourself.
I have one question though: Considering the scare-mongering about Windows 10’s EOL, this seems pretty convoluted. I thought bad guys could own your machine by automatic drive-by downloads unless you’re absolutely on the latest versions of everything. What’s with all the “please follow this step-by-step guide to getting hacked”?
Re: The scariest "user support" email I've received
#68The binary itself appears to be a remote-access trojan and data exfiltration malware for MacOS. It provides a reverse-shell via http://83.219.248.194 and exfiltrates files with the following extensions: txt rtf doc docx xls xlsx key wallet jpg dat pdf pem asc ppk rdp sql ovpn kdbx conf json It looks quite similar to AMOS - Atomic MacOS Stealer. It also seems to exfiltrate browser session data + cookies, the MacOS key…
I can’t even exfiltrate my MacOS Notes on purpose. Maybe I’ll download it and give it a spin.
Re: The scariest "user support" email I've received
#69Which is why it's infuriating that health care companies implement secure email by asking the customer to click on a 3rd party link in an email. An email they're saying is an insecure delivery system. But we're supposed to click on links in these special emails. Fuck!
Problems: - E-mail is insecure. It can be read by any number of servers between you and the sender. - Numerically, very few healthcare companies have the time, money, or talent to self-host a secure solution, so they farm it out to a third-party that offers specific guarantees, and very few of those permit self-hosting or even custom domains because that's a risk to them. As someone who works in healthcare, I can say…
Millions please. The solution is to just link to the fucking thing instead of a cryptic tracking url from your mass mailing provider. But oh no, now you can’t see line go up anymore!!!
Re: The scariest "user support" email I've received
#70Earlier quoted context omitted.
RIP the once-common practice of having a personal website (that would have a free host)
The "free" hosts were already harbingers of the end times. Once, having a dedicated IP address per machine stopped being a requirement, the personal website that would be casually hosted whenever your PC is on was done.
> the personal website that would be casually hosted whenever your PC is on
I don't think that was ever really a thing. Which isn't to say that no one did it, but it was never a common practice. And free web site hosting came earlier than you're implying - sites like Tripod and Angelfire launched in the mid-1990s, at a time when most users were still on dialup.