5 ms·

Ran a PowerShell script, Was I hacked?

34 points by firebaze 5y ago

bob229 5y ago
It’s a good target market for hackers. Those idiotic enough to gamble with cryptos are also probably a stupid enough to run the script
chaxor 5y ago
The script looks like it was written by a 6 year old though... hard coded paths? It's pretty much Rule No. 1 to never have *hard coded paths* in a script that should be useful to anyone (other than yourself, in the case of perhaps single-use bash scripts). I don't think anyone has to worry much if that's run on their computer, since the only person it will likely do anything to is the person who created it. I doubt many people have those same configurations for their system when dealing with crypto.
- nunez 5y ago
  This is good social engineering, though. `powershell.software` looks legit to unsuspecting folks, and it is cumbersome enough to get the version of PowerShell that you’re using that I can see some lazy sysadmins trying to do something like this instead. The intersection of lazy sysadmins that are holding Dogecoin on their computers is pretty small though.
nunez 5y ago
TL;DR: This powershell script attempts to steal popular Dogecoin wallets, but doesn’t execute any malicious code otherwise. The scary thing about this is that on the MacOS/Linux side, *so* many large open-source projects are norming piping arbitrary shell scripts from the Internet into Bash. Homebrew is the biggest culprit of this. In other words, they are making it okay to just run “curl | bash” to install something without inspecting the scripts first. Given that _many_ engineers in the enterprise perform copy-paste-driven-development, this is a huge social engineering attack waiting to happen. In Windows land, you can disable arbitrary code execution through Invoke-RestMethod and Invoke-WebResponse by way of PowerShell policies, which were introduced in PowerShell version 2 (i.e. forever ago). In Linux, I’m not sure how you can work around “curl | bash” forking.
- adminscoffee 5y ago
  i often wonder why we cannot build a small ai inspector for devops in general. so much time is spent piecing together technologies, the config files alone could be automated to be complete honest

34 points by firebaze 5y ago

It’s a good target market for hackers. Those idiotic enough to gamble with cryptos are also probably a stupid enough to run the script

chaxor 5y ago

The script looks like it was written by a 6 year old though... hard coded paths? It's pretty much Rule No. 1 to never have *hard coded paths* in a script that should be useful to anyone (other than yourself, in the case of perhaps single-use bash scripts). I don't think anyone has to worry much if that's run on their computer, since the only person it will likely do anything to is the person who created it. I doubt many people have those same configurations for their system when dealing with crypto.

nunez 5y ago
This is good social engineering, though. `powershell.software` looks legit to unsuspecting folks, and it is cumbersome enough to get the version of PowerShell that you’re using that I can see some lazy sysadmins trying to do something like this instead. The intersection of lazy sysadmins that are holding Dogecoin on their computers is pretty small though.

nunez 5y ago

TL;DR: This powershell script attempts to steal popular Dogecoin wallets, but doesn’t execute any malicious code otherwise. The scary thing about this is that on the MacOS/Linux side, *so* many large open-source projects are norming piping arbitrary shell scripts from the Internet into Bash. Homebrew is the biggest culprit of this. In other words, they are making it okay to just run “curl | bash” to install something without inspecting the scripts first. Given that _many_ engineers in the enterprise perform copy-paste-driven-development, this is a huge social engineering attack waiting to happen. In Windows land, you can disable arbitrary code execution through Invoke-RestMethod and Invoke-WebResponse by way of PowerShell policies, which were introduced in PowerShell version 2 (i.e. forever ago). In Linux, I’m not sure how you can work around “curl | bash” forking.

adminscoffee 5y ago
i often wonder why we cannot build a small ai inspector for devops in general. so much time is spent piecing together technologies, the config files alone could be automated to be complete honest