5 ms·

Edit: after getting in touch with Joshua, behind Echo, the original evidence on Twitter by Kevin Beaumont has been retracted [0] and Joshua claims that Echo is

Edit: after getting in touch with Joshua, behind Echo, the original evidence on Twitter by Kevin Beaumont has been retracted [0] and Joshua claims that Echo is not related to the rootkit in question. Edit 2: Some further clarifications about Echo from Joshua: "We also don't just give untethered access, it's a scan which does specific things and doesn't have any malicious capabilities from the staff member on the player. How it works is cheats leave traces behind, Echo is almost a forensic analysis to see if cheats were on that PC. For example, any executable on windows that resolves a domain has strings in the Dnscache service, or any process that makes requests to cheat servers will leave the domain as strings in lsass.exe (which is can be PPL and can require kernel to read from). We use the driver and strong obfuscation to prevent cheat developers (known to be good reverse engineers) from being able to just clear these traces." [0] https://twitter.com/GossiTheDog/status/1408900596145569795 https://twitter.com/GossiTheDog/status/1408900596145569795 Piecing together info scattered across disclosures [1] and tweets [2], it seems the malware is related to Echo [3], a product marketed for Minecraft server owners that allegedly helps in detecting cheaters. From what I understand, suspected cheaters are requested by the server staff to download and install the Echo client, which shares the player's screen [4] with the admins and apparently gives full, unrestricted OS access. I've tried to get in touch with the people allegedly behind Echo [5] [6] for clarification, and I'll update this once I get more info. [1] https://www.gdatasoftware.com/blog/microsoft-signed-a-malicious-netfilter-rootkit https://www.gdatasoftware.com/blog/microsoft-signed-a-malici... [2] https://twitter.com/GossiTheDog/status/1407328596247646217 https://twitter.com/GossiTheDog/status/1407328596247646217 [3] https://echo.ac https://echo.ac [4] https://www.reddit.com/r/screensharing/ https://www.reddit.com/r/screensharing/ [5] https://find-and-update.company-information.service.gov.uk/company/13017981/officers https://find-and-update.company-information.service.gov.uk/c... [6] https://discord.gg/mGTTAT5 https://discord.gg/mGTTAT5

swiley 5y ago
>From what I understand, suspected cheaters are requested by the server staff to download and install the Echo client, which shares the player's screen [4] with the admins and apparently gives full, unrestricted OS access. Downloading and running software like that from someone you met on a game server is incredibly stupid. I know multiple people who have gotten rootkits and lost control of important accounts this way.
- Josheyr 5y ago
  Hi swily, I own Echo. This is a common misconception about our software, we're an established and still growing company. There are indeed some bad eggs in the community, however we are trusted and our tool has absolutely no malicious capabilities from the server staff on the player. Every mainstream game has a powerful anti cheat performing kernel functionality just like ours. If someone is asked to download and scan with Echo, firstly since we're established and it's better than being asked to download "Swiley Tool", secondly they always have the option to say no and it's absolutely not forced.
  - swiley 5y ago
    I'm touched that you cared enough to reply to my comment and it is nice that it's separate from the game, that's definitely an improvement over the status quo for AAA closed source video games. I don't mean anything against you personally and am sure you and your team are wonderful and intelligent people but: 1) popularity alone does not justify misbehavior (especially distributing what are essentially rootkits.) 2) mature communities can function without cheating. I often play a game called Xonotic which has no such functionality and have yet to meet someone cheating at it. 3) I would always elect 100% of the time to abandon any game or server before running any kind of software like this.
    - ItzGoogle 5y ago
      I suppose that in the MC community, there is a certain level of trust to "SS Tools". Since there aren't "that many" SS tools. I also think the culture is different in competitive minecraft, since whenever I get SSed I usually see a pattern: "They use Anydesk", "They use either Echo, Paladin, Avenge or Actova" and "They usually do dome manual stuff in process hacker" and this usually makes me feel more comfortable. Its ok to not wanna get SS'ed in the community, but this usually comes with a punishment, like a permanent ban, or a temporary one. The SS'ing process in the MC community is more of a "Last chance to prove you are legit before your cheating ban" rather than a "I SS you just randomly". In Echo's case they have taken action by now taking logs and looking at the custom themes where people used images such as "launching booter" and "Injecting rootkit" and are now handing out punishments to users who do that. ( Reference to Joshyer's announcement: https://media.discordapp.net/attachments/852881172152844318/858497727406931999/image0.png?width=312&height=675 https://media.discordapp.net/attachments/852881172152844318/... ) I would also understand why people would be confused about what a program such as Echo does, Its not a remote access tool, and it does not provide any access for anyone after the fact. Here is how it works if you are confused: I tell the person to send me their Anydesk code, then I go to the panel of echo and generate a pin, on the person in question I run the tool and enter the pin, the tool does some magic, removes itself from the pc and then i can see all the info I need like Program start times, Ran and Deleted files, internal strings, etc. Without ever leaving anything on the users PC, except possibly a log file. After the fact I have no access to the users PC or data not necessary for scanning, and the program has been deleted. Addressing your points: 1) Of course it doesn't, but again, Its not Echos fault that some of the custom themes were posted, and some of their competitors dont exactly have squeaky clean records either, But the fact that echo removes itself, makes it either seem legit, or like the worlds worst virus (Canadian Virus; "Woops didnt mean to infect your PC, ill just remove myself, just carry on."). 2) Welcome to minecraft, a game where you download a zip file, run a .bat and boom you have the source code. Minecraft offers no internal anticheat so therefore using a solution like Badlion's BAC or lunars (No longer existing) Lunar Online mode can help since they catch cheaters by running in the background while the game runs, looking at DLLs and inputs to determine if a person is using a advanced Autoclicker, or a bad cheat like VL. Minecraft has plenty of serversided anticheats since creating Plugins for servers is even easier than creating a modded client. The issue with the game is that it runs at 20 TPS, meaning that you only have 20 samples per second to deal with, this can lead to major issues and some things just being near impossible to detect without a client sided component. And i can tell you, on minecraft servers (especially Practice, Kitpvp, Kitmap, HCF and SMP) Cheaters make anywhere from 5 - 50% of the playerbase. Where people use anything from mild 8 CPS autoclickers, to TPAura, Fly, Killaura, etc. 3) Well again, the culture is different, Some people decide to click the "Quit to menu" button, indicating that they would rather have the ban instead of proving they are legit, or having the embarrassment of being proven a cheater and having the slight public humiliation of the "PLAYERNAME has been removed from the server for "Cheats found in SS"" message getting sent to everyone on the network. Then there are the people who either think their cheats bypass, or who are legit and who aren't afraid to show whoever runs the SS Tools. So again, the culture around SS Tools in minecraft is different than, lets say Xonotic. Hope this helps clear up a bunch of stuff. (Wrote more than for my final exam right here lmao)

swiley 5y ago

>From what I understand, suspected cheaters are requested by the server staff to download and install the Echo client, which shares the player's screen [4] with the admins and apparently gives full, unrestricted OS access. Downloading and running software like that from someone you met on a game server is incredibly stupid. I know multiple people who have gotten rootkits and lost control of important accounts this way.

Josheyr 5y ago
Hi swily, I own Echo. This is a common misconception about our software, we're an established and still growing company. There are indeed some bad eggs in the community, however we are trusted and our tool has absolutely no malicious capabilities from the server staff on the player. Every mainstream game has a powerful anti cheat performing kernel functionality just like ours. If someone is asked to download and scan with Echo, firstly since we're established and it's better than being asked to download "Swiley Tool", secondly they always have the option to say no and it's absolutely not forced.
- swiley 5y ago
  I'm touched that you cared enough to reply to my comment and it is nice that it's separate from the game, that's definitely an improvement over the status quo for AAA closed source video games. I don't mean anything against you personally and am sure you and your team are wonderful and intelligent people but: 1) popularity alone does not justify misbehavior (especially distributing what are essentially rootkits.) 2) mature communities can function without cheating. I often play a game called Xonotic which has no such functionality and have yet to meet someone cheating at it. 3) I would always elect 100% of the time to abandon any game or server before running any kind of software like this.
  - ItzGoogle 5y ago
    I suppose that in the MC community, there is a certain level of trust to "SS Tools". Since there aren't "that many" SS tools. I also think the culture is different in competitive minecraft, since whenever I get SSed I usually see a pattern: "They use Anydesk", "They use either Echo, Paladin, Avenge or Actova" and "They usually do dome manual stuff in process hacker" and this usually makes me feel more comfortable. Its ok to not wanna get SS'ed in the community, but this usually comes with a punishment, like a permanent ban, or a temporary one. The SS'ing process in the MC community is more of a "Last chance to prove you are legit before your cheating ban" rather than a "I SS you just randomly". In Echo's case they have taken action by now taking logs and looking at the custom themes where people used images such as "launching booter" and "Injecting rootkit" and are now handing out punishments to users who do that. ( Reference to Joshyer's announcement: https://media.discordapp.net/attachments/852881172152844318/858497727406931999/image0.png?width=312&height=675 https://media.discordapp.net/attachments/852881172152844318/... ) I would also understand why people would be confused about what a program such as Echo does, Its not a remote access tool, and it does not provide any access for anyone after the fact. Here is how it works if you are confused: I tell the person to send me their Anydesk code, then I go to the panel of echo and generate a pin, on the person in question I run the tool and enter the pin, the tool does some magic, removes itself from the pc and then i can see all the info I need like Program start times, Ran and Deleted files, internal strings, etc. Without ever leaving anything on the users PC, except possibly a log file. After the fact I have no access to the users PC or data not necessary for scanning, and the program has been deleted. Addressing your points: 1) Of course it doesn't, but again, Its not Echos fault that some of the custom themes were posted, and some of their competitors dont exactly have squeaky clean records either, But the fact that echo removes itself, makes it either seem legit, or like the worlds worst virus (Canadian Virus; "Woops didnt mean to infect your PC, ill just remove myself, just carry on."). 2) Welcome to minecraft, a game where you download a zip file, run a .bat and boom you have the source code. Minecraft offers no internal anticheat so therefore using a solution like Badlion's BAC or lunars (No longer existing) Lunar Online mode can help since they catch cheaters by running in the background while the game runs, looking at DLLs and inputs to determine if a person is using a advanced Autoclicker, or a bad cheat like VL. Minecraft has plenty of serversided anticheats since creating Plugins for servers is even easier than creating a modded client. The issue with the game is that it runs at 20 TPS, meaning that you only have 20 samples per second to deal with, this can lead to major issues and some things just being near impossible to detect without a client sided component. And i can tell you, on minecraft servers (especially Practice, Kitpvp, Kitmap, HCF and SMP) Cheaters make anywhere from 5 - 50% of the playerbase. Where people use anything from mild 8 CPS autoclickers, to TPAura, Fly, Killaura, etc. 3) Well again, the culture is different, Some people decide to click the "Quit to menu" button, indicating that they would rather have the ban instead of proving they are legit, or having the embarrassment of being proven a cheater and having the slight public humiliation of the "PLAYERNAME has been removed from the server for "Cheats found in SS"" message getting sent to everyone on the network. Then there are the people who either think their cheats bypass, or who are legit and who aren't afraid to show whoever runs the SS Tools. So again, the culture around SS Tools in minecraft is different than, lets say Xonotic. Hope this helps clear up a bunch of stuff. (Wrote more than for my final exam right here lmao)