5 ms·

Dismantling a Crappy Malware Operation

102 points by MrBruh 4y ago

jallasprit 4y ago
I am surprised and also not surprised that they had approximately 0 OPSEC related to their hustle.
- MrBruh 4y ago
  Yeah for sure, also something interesting I found is that one of the guys is a teacher and the other is a student at the same university in Vietnam.
  - anonym29 4y ago
    Keep in mind that there is a nonzero chance that they are victims of account compromise themselves, and the adversaries just leveraged those to give authorities an easy "culprit" to point to. In fact, having apparently terrible opsec could even have been a deliberate effort used to frame individuals who's accounts had been compromised. It's not likely, but it could be an effective way to frame someone.
    - msla 4y ago
      Rhetorically, there's a push and pull here: It's entirely possible the people in the semi-redacted pictures were acting like idiots because they're idiots. It's also possible the real criminals are using those accounts as patsies. We, sitting here, can't know the real facts. However, philosophically, we can say that the first option is a least hypothesis, while still remaining open to a more complex explanation. Believe it or not, you don't have to come to a firm conclusion based on incomplete evidence.
      - anonym29 4y ago
        Not coming to a firm conclusion based on incomplete evidence is the point I am making: let's not (rhetorically) convict these people without wider consideration of the possibilities. To be clear, I am not calling for (rhetorically) dropping the charges against them, I'm just calling for "maybe we shouldn't halfway-dox people who _might_ be innocent and uninvolved parties". You know, an "innocent until proven guilty" sort of thing. I'd have forwarded this to law enforcement, sure. Blog post about how to dismantle poorly coded operations, fine. But posting poorly redacted names and photos? There isn't even a guarantee that the individuals in question are the same people who created the github accounts. As someone who was a victim of pretty serious bullying as a kid (including having other people make fake social media accounts with my name and picture to post horrific things that I wholeheartedly reject to harm my reputation and attempt to get me in legal trouble), I just want to remind everyone that these kind of situtations aren't always what they initially look like. Cybercriminals do stuff like this to security researchers all the time - you need look no further than Brian Krebs being repeatedly swatted and routinely harassed/trolled by cybercriminals around the world, with major database breaches often being publicly attributed to him by the cybercriminals. There was even a carding website / marketplace set up with his name and likeness - all to harm the reputation of someone working to ethically stamp out their crimes.
  - lovasoa 4y ago
    Did you report them to the University?
atsushin 4y ago
Really fun analysis, wasn't aware that Python scripts could be packaged into an executable until now, learned something new. Thanks for sharing!
- anonym29 4y ago
  PyInstaller is only one of several ways to do this. It bundles the Python interpreter, script, and dependencies together, drops them in a temp directory, and then starts the script using that interpreter, but that isn't the only technique. There are also source-to-source translation tools like Nuitka that translate Python to C, which can then be compiled to a PE. Nuitka is less reliable than PyInstaller, but harder to reverse engineer for predictable reasons.
  - flangola7 4y ago
    >Nuitka is less reliable than PyInstaller, but harder to reverse engineer for predictable reasons. That will not matter for long. GPT-4 can turn assembly back into C and generate appropriate comments.
    - remexre 4y ago
      Does this actually work for nontrivial functions, e.g. a hashtable lookup function?
      - selfmodruntime 4y ago
        Not when I tried.
        flangola7 4y ago
        It's in the Microsoft paper. We might require the 32k token model to really handle it.
        remexre 4y ago
nubinetwork 4y ago
Nice, but I have to wonder why Github acted on this so fast... I reported one account spreading Python based malware 2 months ago and the account was still there up until last week.
b1c1jones 4y ago
Great work!
charcircuit 4y ago
As mentioned in the article anyone can delete a malicious webhook. https://webhooks.scam.gay/ https://webhooks.scam.gay/ is a site that makes it easy to do for people who want a tool do it for them.
nightpool 4y ago
You mentioned they were using Dropbox to distribute the malware—did you follow up with them? What about the university?
voiper1 4y ago
Incredible detective work! Why would discord let anyone delete a webhook? I'd think anyone can post to the webhook, but you need to be authorized to modify it.
- charcircuit 4y ago
  >Why would discord let anyone delete a webhook? Why wouldn't they? Blocking it just leads to more abuse of Discord and its users.
  - VoidWhisperer 4y ago
    I think they mean why would discord let anyone delete a webhook if they have the webhook URL, as opposed to requiring a bot or user token with the correct permissions in the server the webhook is from
    - charcircuit 4y ago
      I answered that. If someone has your webhook either people will spam it which means it's best to have it deleted or private information is being sent over it in which it's best to delete it. It's like if AWS had a public end point to invalidate access keys. If access keys are public they will be used for abuse, so it benefits everyone if anyone can report these access keys to AWS to have them deactivated.
quacksilver 4y ago
Great work! - though the redaction of names / university is very leaky if that is a concern (particularly if you have some knowledge of common Vietnamese naming patterns)
- Gordonjcp 4y ago
  Not sure why you'd think that would be a problem. I wouldn't have redacted any names.
  - quacksilver 4y ago
    I am neutral on whether it is or not - though rather than posting unredacted images, an attempt appeared to be made to redact them for whatever reason and I could still read the names.
- m3047 4y ago
  Use something suffering from acropalypse and claim plausible deniability.
juunpp 4y ago
Did they have "malware development and distribution" on their resume?

102 points by MrBruh 4y ago

jallasprit 4y ago

I am surprised and also not surprised that they had approximately 0 OPSEC related to their hustle.

MrBruh 4y ago
Yeah for sure, also something interesting I found is that one of the guys is a teacher and the other is a student at the same university in Vietnam.
- anonym29 4y ago
  Keep in mind that there is a nonzero chance that they are victims of account compromise themselves, and the adversaries just leveraged those to give authorities an easy "culprit" to point to. In fact, having apparently terrible opsec could even have been a deliberate effort used to frame individuals who's accounts had been compromised. It's not likely, but it could be an effective way to frame someone.
  - msla 4y ago
    Rhetorically, there's a push and pull here: It's entirely possible the people in the semi-redacted pictures were acting like idiots because they're idiots. It's also possible the real criminals are using those accounts as patsies. We, sitting here, can't know the real facts. However, philosophically, we can say that the first option is a least hypothesis, while still remaining open to a more complex explanation. Believe it or not, you don't have to come to a firm conclusion based on incomplete evidence.
    - anonym29 4y ago
      Not coming to a firm conclusion based on incomplete evidence is the point I am making: let's not (rhetorically) convict these people without wider consideration of the possibilities. To be clear, I am not calling for (rhetorically) dropping the charges against them, I'm just calling for "maybe we shouldn't halfway-dox people who _might_ be innocent and uninvolved parties". You know, an "innocent until proven guilty" sort of thing. I'd have forwarded this to law enforcement, sure. Blog post about how to dismantle poorly coded operations, fine. But posting poorly redacted names and photos? There isn't even a guarantee that the individuals in question are the same people who created the github accounts. As someone who was a victim of pretty serious bullying as a kid (including having other people make fake social media accounts with my name and picture to post horrific things that I wholeheartedly reject to harm my reputation and attempt to get me in legal trouble), I just want to remind everyone that these kind of situtations aren't always what they initially look like. Cybercriminals do stuff like this to security researchers all the time - you need look no further than Brian Krebs being repeatedly swatted and routinely harassed/trolled by cybercriminals around the world, with major database breaches often being publicly attributed to him by the cybercriminals. There was even a carding website / marketplace set up with his name and likeness - all to harm the reputation of someone working to ethically stamp out their crimes.
- lovasoa 4y ago
  Did you report them to the University?

atsushin 4y ago

Really fun analysis, wasn't aware that Python scripts could be packaged into an executable until now, learned something new. Thanks for sharing!

anonym29 4y ago
PyInstaller is only one of several ways to do this. It bundles the Python interpreter, script, and dependencies together, drops them in a temp directory, and then starts the script using that interpreter, but that isn't the only technique. There are also source-to-source translation tools like Nuitka that translate Python to C, which can then be compiled to a PE. Nuitka is less reliable than PyInstaller, but harder to reverse engineer for predictable reasons.
- flangola7 4y ago
  >Nuitka is less reliable than PyInstaller, but harder to reverse engineer for predictable reasons. That will not matter for long. GPT-4 can turn assembly back into C and generate appropriate comments.
  - remexre 4y ago
    Does this actually work for nontrivial functions, e.g. a hashtable lookup function?
    - selfmodruntime 4y ago
      Not when I tried.
      - flangola7 4y ago
        It's in the Microsoft paper. We might require the 32k token model to really handle it.
        remexre 4y ago

nubinetwork 4y ago

Nice, but I have to wonder why Github acted on this so fast... I reported one account spreading Python based malware 2 months ago and the account was still there up until last week.

b1c1jones 4y ago

Great work!

charcircuit 4y ago

As mentioned in the article anyone can delete a malicious webhook. https://webhooks.scam.gay/ https://webhooks.scam.gay/ is a site that makes it easy to do for people who want a tool do it for them.

nightpool 4y ago

You mentioned they were using Dropbox to distribute the malware—did you follow up with them? What about the university?

voiper1 4y ago

Incredible detective work! Why would discord let anyone delete a webhook? I'd think anyone can post to the webhook, but you need to be authorized to modify it.

charcircuit 4y ago
>Why would discord let anyone delete a webhook? Why wouldn't they? Blocking it just leads to more abuse of Discord and its users.
- VoidWhisperer 4y ago
  I think they mean why would discord let anyone delete a webhook if they have the webhook URL, as opposed to requiring a bot or user token with the correct permissions in the server the webhook is from
  - charcircuit 4y ago
    I answered that. If someone has your webhook either people will spam it which means it's best to have it deleted or private information is being sent over it in which it's best to delete it. It's like if AWS had a public end point to invalidate access keys. If access keys are public they will be used for abuse, so it benefits everyone if anyone can report these access keys to AWS to have them deactivated.

quacksilver 4y ago

Great work! - though the redaction of names / university is very leaky if that is a concern (particularly if you have some knowledge of common Vietnamese naming patterns)

Gordonjcp 4y ago
Not sure why you'd think that would be a problem. I wouldn't have redacted any names.
- quacksilver 4y ago
  I am neutral on whether it is or not - though rather than posting unredacted images, an attempt appeared to be made to redact them for whatever reason and I could still read the names.
m3047 4y ago
Use something suffering from acropalypse and claim plausible deniability.

juunpp 4y ago

Did they have "malware development and distribution" on their resume?