8 ms·

Discord.io breached, 760k user accounts for sale on darknet

404 points by skilled 3y ago

superkuh 3y ago
> third-party interface tailored for the widely-used Discord messenger. Isn't this explicitly against the Discord TOS? I'm surprised it wasn't shut down by Discord itself.
- nijave 3y ago
  I'm surprised using the domain `discord.io` alone wasn't enough to get them shut down.
  - jrockway 3y ago
    I'm guessing the British Indian Ocean Territory doesn't have a lot of administrators to handle trademark claims. According to Wikipedia, "the only inhabitants are British and United States military personnel, and associated contractors, who collectively number around 3,000 (2018 figures)." Darn that global Internet, allowing people to use unauthorized chat clients with impunity!
    - zoky 3y ago
      There are other ways to shut down a third-party service, from sending a cease and desist letter for trademark infringement to server-side blocking of access to their API.
    - teddyh 3y ago
      > Darn that global Internet, allowing people to use unauthorized chat clients with impunity! The use was not the problem; the name was the problem.
      - jrockway 3y ago
        A sense of discord washes over me as I eat an apple in front of a computer running XWindows. A lesson about using a common English words as a trademark becomes apparent in my mind.
        deleted 3y ago
        [deleted]
        juanani 3y ago
        [dead]
    - superkuh 3y ago
      >Darn that global Internet, allowing people to use unauthorized chat clients with impunity! The problem here is that people are chosing to use Disord despite the fact that it is so stupidly proprietary. If Discord actually enforced it's rules all the time there'd have been far fewer teamspeak/irc/mumble/etc people lured into it's walled garden. It is a literal bait and switch. So it's important to point out a large fraction of the ways people do use Discord are actually very much against the TOS and could be prosecuted under the CFAA as felonies if Discord corporate thought they were rocking the boat and decided to buy a district attorney. It's the worst of both worlds.
      - NavinF 3y ago
        > people are chosing to use Disord despite the fact that it is so stupidly proprietary This has zero relevance to normal users. Does teamspeak/irc/mumble/etc even support live streaming with screen+audio capture to a group chat? That's a pretty basic feature in 2023. I'm not aware of any serious open source competitors in this space
        lightedman 3y ago
        "Does teamspeak/irc/mumble/etc even support live streaming with screen+audio capture to a group chat?" pIRCh98 had video chat support, and back then we used some wrapper from FRAPS to do our screen captures. Of course, back then, video chat was such a niche thing. Everyone else is actually late to the game - IRC had this capability before the majority of known players.
        NavinF 3y ago
        > pIRCh98 Proprietary software. I guess the answer to my question is no, there are no open-source competitors in this space.
    - bragr 3y ago
      .io domain is officially administrated out of the UK and is own by Ethos Capital, a private equity firm out of the US. Surely both the American and/or UK courts would be valid avenues for enforcement.
  - deleted 3y ago
    [deleted]
- judge2020 3y ago
  It was primarily a way for non-partner servers to have permanent, readable invite links before these became available officially (by paying users boosting a server). It wasn't actually a third party interface that recreated the discord client or anything (unless that's a recent development).
  - deleted 3y ago
    [deleted]
gochi 3y ago
Wonder how many people are going to think discord.io is officially related to discordapp.com/discord.com.
- Klathmon 3y ago
  Probably most, considering it's Discord's logo and screenshots of their app used in the article, and discord.io isn't loading with 522 errors right now so you can't exactly check.
- axus 3y ago
  It sounds more official than discord.gg
  - mattl 3y ago
    It shouldn't really. .gg and .io are being used for novelty value.
    - deprecative 3y ago
      It's definitely not just me but I only have a data point of one to use: Anytime I see something that isn't .com, .org, or .gov I immediately assume it's less than reputable at best and actively trying to scam/phish me at worst.
      - mattl 3y ago
        Yeah, there's a difference between .com .net .org .gov and many of the country code TLDs when you're looking for non-local content.
      - thih9 3y ago
        I got curious and decided to check which popular websites that I use are not on a .com / .org domain. I found: kubernetes.io , sentry.io , codepen.io , itch.io , not to mention lever.co , elastic.co and last but not the least, notion.so .
warent 3y ago
Thankfully I never used this website exactly because I feared this. There was a link to join a discord server via Discord.io that showed as a top Google result. I clicked it not even aware it was 3rd party. Thankfully OAuth gave me the friendly confirmation page saying "You are about to connect with this third party service and grant full access to your account." I said WTF? NO Shame on the Discord legal team and their executive team for completely lacking diligence on this.
- predictabl3 3y ago
  If Discord.io was using OAuth then this would largely be a non-issue as those tokens could be invalidated or revoked, by Discord, trivially. And they wouldn't have any password data, hashed or otherwise. Granted, I don't use discord.io , so maybe I'm missing something.
  - AgentK20 3y ago
    To quote the article: > Salted and hashed passwords (mainly concerning users prior to 2018 when Discord.io began exclusively using Discord for logins) So it sounds like they used to have their own accounts before integrating via Discord OAuth, and some users may be affected by this. Unsure if they didn't delete users' hashed PWs once they migrated to the OAuth flow or something like that.
  - explaininjs 3y ago
    Based on the screenshot it would seem they do have hashed passwords, specifically it looks like bcrypt hashes with a cost factor of 8. Not sure why the cost would be so low, or indeed why the hashes are available at all.
- deleted 3y ago
  [deleted]
- rvnx 3y ago
  If Discord was allowing this website to run for so long using this brand, don't they risk losing the trademark because of the dilution due to non-enforcement ?
PUSH_AX 3y ago
Just FYI, discord.io !== discord.com the chat app, it's a related but separate service.
- WheatMillington 3y ago
  And discord.com !== discordapp.com or discord.gg.
  - jowea 3y ago
    They all redirect to discord.com now.
    - account42 3y ago
      discord.gg is used for invite links
  - Technetium 3y ago
    "As of May 4th, 2020, we have moved our domain from discordapp.com to discord.com!" https://support.discord.com/hc/en-us/articles/360042987951-Discordapp-com-is-now-Discord-com https://support.discord.com/hc/en-us/articles/360042987951-D...
- hbn 3y ago
  Normally I think it's lame when a product-for-a-product (there's probably a better term) has to abide by stringent branding guidelines to not look official. e.g. when third-party reddit clients (RIP) had to change from e.g. "Reddit Sync" to "Sync for Reddit" and they weren't allowed to use the Snoo character in their branding. But in this case... why was Discord fine with this branding? It looks unabashedly like an alternate official domain for their own service. Googling "what is discord.io" leads to a good handful of confused redditors asking if it's legit/safe.
  - jumpCastle 3y ago
    I still use infinity for reddit though.
politelemon 3y ago
To those who used discord.io, what was the appeal of it over discord.gg? Unfortunately their site is down so I can't even see what its own marketing said.
- bavarianbob 3y ago
  I believe discord.io is (was?) a discovery platform. You can view an archive of the site here: https://web.archive.org/web/20220329132537/https://discord.io/servers https://web.archive.org/web/20220329132537/https://discord.i...
soloninja 3y ago
Happens way to often now with wall garden services
- thebigman433 3y ago
  How does the concept of a walled garden have anything to do with this?
- Exuma 3y ago
  Discord.io is not the same thing as discord.com
zapkyeskrill 3y ago
How would one know if they're affected? I use discord but have no recollection how I signed up .. probably via first search hit (which could be an add)
- qingcharles 3y ago
  This isn't the main Discord app/site, so you're probably not affected. But you can always check at the link below. That guy gets a lot of donated packages of cracked data: https://haveibeenpwned.com/ https://haveibeenpwned.com/ Google also has their own people seemingly trolling through onion sites buying up packages of cracked data so they can run it against their own properties and see if anyone is affected.
gautamsomani 3y ago
Noob question - What websites are these where such data is published? I never came across any?
- chefandy 3y ago
  Various darknet fora. Certainly nowhere on clearnet. There are search engines that deal with such things though I'll bet there's a 99:1 ratio of scam to legit. I have no idea how someone world go about validating what they saw.
  - judge2020 3y ago
    Validation is likely tied to reputation - such as by showing a sample to an established moderator / community member and them vouching that the data seems real.
  - cowsup 3y ago
    In this case, they validated it by: 1. confirming the emails were not already listed in other databases / leaks; 2. going to the actual Discord platform and performing a "Forgot Password" request, entering a stolen email, and seeing if it goes through or not, as Discord confirms if an email exists or not during this flow; 3. contacting Discord.io directly, who confirmed & put out a statement. Other data breaches are harder to verify. Troy Hunt (owner of haveibeenpwned.com) described this in far more interesting ways than I ever could[0], but for each breach, it varies. [0]: https://www.troyhunt.com/heres-how-i-verify-data-breaches/ https://www.troyhunt.com/heres-how-i-verify-data-breaches/
  - technion 3y ago
    Until recently, every time a story was run about a leak being "for sale on the dark web", you could visit raid forums or breach forums, both clearnet sites, and note that's where it's for sale.
- tamimio 3y ago
  I have a directory of most of them, I would not post it under my real identity obviously, but if you happen to be into the cybersec space, definitely you came across some of these sites, there are even sites with latest APT discovered up to this month too.
lakomen 3y ago
Ok so when I've never used a 3rd party discord service I'm safe. I got scared there for a moment, but then I thought what would I lose? Nothing at all. Nothing that can't be replaced. No contacts worth keeping.
- poglet 3y ago
  If someone has access to your account I assume they can read all your messages and possibly impersonate you.
  - Spivak 3y ago
    Having OAuth creds is a totally different thing than having access to your account. I support "Log in with Discord" on my site that uses the OAuth flow and the only thing I get out is a set of creds that can hit /user/@me and let me say "the user that just authed is this Discord user." Now discord.io could have asked for everything but the risk of some random integration is on average a lot less. To my knowledge absolutely nothing has the rpc scopes. The good news is that even with every scope you can't take over the account and the service can just be removed cutting off their access for sure.
scudsworth 3y ago
what was the actual killer app here
- boneitis 3y ago
  [e: i apparently mistook discordio for a couple of the other discovery platforms we utilized, but it seems to be the same concept as the others, looking at the web archives] discordapp back then was really just a collection of servers pretty siloed/insulated from each other, with barebones voice and text chat functionality. discordio offered some basic form of discovery and cross-server exploration/networking when it was effectively nonexistent back then. it, along with other outreach efforts on our part, certainly helped boost our community size and amusingly also attracted a lot of teens approaching us to ask if we wanted to "partner up" with their server (i help administer a studygroup server on discord). my 2c, as a fairly active user since '16.
  - ehsankia 3y ago
    I assume being able to get a custom link is also nice, I believe discord only allows that for partnered servers?
    - boneitis 3y ago
      ah, forgot about the free custom links. anyway, 'partnered', to my recollection, means a formal arrangement with discord where the particular server community is directly promoted by discord on front pages and such, in exchange for meeting a higher bar of conduct that represents a model community (SFW, PC, etc.). one of the perks that comes with this is being granted "Level 3" boost status, free of charge (normally costing anywhere from $49-70/mo, depending on circumstances), which is what directly grants the custom link feature.
    - noxvilleza 3y ago
      I run a Discord server which wasn't partnered, is quite small, and somehow had a custom link (we also certainly weren't boosted).
paulpauper 3y ago
as long as there is data, there will be data breaches
- Waterluvian 3y ago
  This is why I store all my sensitive data on the cozy side of an event horizon.
  - tmpz22 3y ago
    I have a vault set to open when GRRMs Winds of Winter comes out. I feel pretty good about it.
sharts 3y ago
Where there are DBs and no accountability for data security, there are breaches. Nothing to see here.
dancemethis 3y ago
I mean, that's not _too_ different from the way Discord "officially" sells user data in the shadows.
pyuser583 3y ago
As a discord user, how worried should I be?
- lcnPylGDnU4H9OF 3y ago
  It sounds like one would needed to have connected their discord account with this separate discord-related app. If you didn’t do that, I would expect your account wasn’t breached.

404 points by skilled 3y ago

> third-party interface tailored for the widely-used Discord messenger. Isn't this explicitly against the Discord TOS? I'm surprised it wasn't shut down by Discord itself.

nijave 3y ago
I'm surprised using the domain `discord.io` alone wasn't enough to get them shut down.
- jrockway 3y ago
  I'm guessing the British Indian Ocean Territory doesn't have a lot of administrators to handle trademark claims. According to Wikipedia, "the only inhabitants are British and United States military personnel, and associated contractors, who collectively number around 3,000 (2018 figures)." Darn that global Internet, allowing people to use unauthorized chat clients with impunity!
  - zoky 3y ago
    There are other ways to shut down a third-party service, from sending a cease and desist letter for trademark infringement to server-side blocking of access to their API.
  - teddyh 3y ago
    > Darn that global Internet, allowing people to use unauthorized chat clients with impunity! The use was not the problem; the name was the problem.
    - jrockway 3y ago
      A sense of discord washes over me as I eat an apple in front of a computer running XWindows. A lesson about using a common English words as a trademark becomes apparent in my mind.
      - deleted 3y ago
        [deleted]
      - juanani 3y ago
        [dead]
  - superkuh 3y ago
    >Darn that global Internet, allowing people to use unauthorized chat clients with impunity! The problem here is that people are chosing to use Disord despite the fact that it is so stupidly proprietary. If Discord actually enforced it's rules all the time there'd have been far fewer teamspeak/irc/mumble/etc people lured into it's walled garden. It is a literal bait and switch. So it's important to point out a large fraction of the ways people do use Discord are actually very much against the TOS and could be prosecuted under the CFAA as felonies if Discord corporate thought they were rocking the boat and decided to buy a district attorney. It's the worst of both worlds.
    - NavinF 3y ago
      > people are chosing to use Disord despite the fact that it is so stupidly proprietary This has zero relevance to normal users. Does teamspeak/irc/mumble/etc even support live streaming with screen+audio capture to a group chat? That's a pretty basic feature in 2023. I'm not aware of any serious open source competitors in this space
      - lightedman 3y ago
        "Does teamspeak/irc/mumble/etc even support live streaming with screen+audio capture to a group chat?" pIRCh98 had video chat support, and back then we used some wrapper from FRAPS to do our screen captures. Of course, back then, video chat was such a niche thing. Everyone else is actually late to the game - IRC had this capability before the majority of known players.
        NavinF 3y ago
        > pIRCh98 Proprietary software. I guess the answer to my question is no, there are no open-source competitors in this space.
  - bragr 3y ago
    .io domain is officially administrated out of the UK and is own by Ethos Capital, a private equity firm out of the US. Surely both the American and/or UK courts would be valid avenues for enforcement.
- deleted 3y ago
  [deleted]
judge2020 3y ago
It was primarily a way for non-partner servers to have permanent, readable invite links before these became available officially (by paying users boosting a server). It wasn't actually a third party interface that recreated the discord client or anything (unless that's a recent development).
- deleted 3y ago
  [deleted]

gochi 3y ago

Wonder how many people are going to think discord.io is officially related to discordapp.com/discord.com.

Klathmon 3y ago
Probably most, considering it's Discord's logo and screenshots of their app used in the article, and discord.io isn't loading with 522 errors right now so you can't exactly check.
axus 3y ago
It sounds more official than discord.gg
- mattl 3y ago
  It shouldn't really. .gg and .io are being used for novelty value.
  - deprecative 3y ago
    It's definitely not just me but I only have a data point of one to use: Anytime I see something that isn't .com, .org, or .gov I immediately assume it's less than reputable at best and actively trying to scam/phish me at worst.
    - mattl 3y ago
      Yeah, there's a difference between .com .net .org .gov and many of the country code TLDs when you're looking for non-local content.
    - thih9 3y ago
      I got curious and decided to check which popular websites that I use are not on a .com / .org domain. I found: kubernetes.io , sentry.io , codepen.io , itch.io , not to mention lever.co , elastic.co and last but not the least, notion.so .

warent 3y ago

Thankfully I never used this website exactly because I feared this. There was a link to join a discord server via Discord.io that showed as a top Google result. I clicked it not even aware it was 3rd party. Thankfully OAuth gave me the friendly confirmation page saying "You are about to connect with this third party service and grant full access to your account." I said WTF? NO Shame on the Discord legal team and their executive team for completely lacking diligence on this.

predictabl3 3y ago
If Discord.io was using OAuth then this would largely be a non-issue as those tokens could be invalidated or revoked, by Discord, trivially. And they wouldn't have any password data, hashed or otherwise. Granted, I don't use discord.io , so maybe I'm missing something.
- AgentK20 3y ago
  To quote the article: > Salted and hashed passwords (mainly concerning users prior to 2018 when Discord.io began exclusively using Discord for logins) So it sounds like they used to have their own accounts before integrating via Discord OAuth, and some users may be affected by this. Unsure if they didn't delete users' hashed PWs once they migrated to the OAuth flow or something like that.
- explaininjs 3y ago
  Based on the screenshot it would seem they do have hashed passwords, specifically it looks like bcrypt hashes with a cost factor of 8. Not sure why the cost would be so low, or indeed why the hashes are available at all.
deleted 3y ago
[deleted]
rvnx 3y ago
If Discord was allowing this website to run for so long using this brand, don't they risk losing the trademark because of the dilution due to non-enforcement ?

PUSH_AX 3y ago

Just FYI, discord.io !== discord.com the chat app, it's a related but separate service.

WheatMillington 3y ago
And discord.com !== discordapp.com or discord.gg.
- jowea 3y ago
  They all redirect to discord.com now.
  - account42 3y ago
    discord.gg is used for invite links
- Technetium 3y ago
  "As of May 4th, 2020, we have moved our domain from discordapp.com to discord.com!" https://support.discord.com/hc/en-us/articles/360042987951-Discordapp-com-is-now-Discord-com https://support.discord.com/hc/en-us/articles/360042987951-D...
hbn 3y ago
Normally I think it's lame when a product-for-a-product (there's probably a better term) has to abide by stringent branding guidelines to not look official. e.g. when third-party reddit clients (RIP) had to change from e.g. "Reddit Sync" to "Sync for Reddit" and they weren't allowed to use the Snoo character in their branding. But in this case... why was Discord fine with this branding? It looks unabashedly like an alternate official domain for their own service. Googling "what is discord.io" leads to a good handful of confused redditors asking if it's legit/safe.
- jumpCastle 3y ago
  I still use infinity for reddit though.

politelemon 3y ago

To those who used discord.io, what was the appeal of it over discord.gg? Unfortunately their site is down so I can't even see what its own marketing said.

bavarianbob 3y ago
I believe discord.io is (was?) a discovery platform. You can view an archive of the site here: https://web.archive.org/web/20220329132537/https://discord.io/servers https://web.archive.org/web/20220329132537/https://discord.i...

soloninja 3y ago

Happens way to often now with wall garden services

thebigman433 3y ago
How does the concept of a walled garden have anything to do with this?
Exuma 3y ago
Discord.io is not the same thing as discord.com

zapkyeskrill 3y ago

How would one know if they're affected? I use discord but have no recollection how I signed up .. probably via first search hit (which could be an add)

qingcharles 3y ago
This isn't the main Discord app/site, so you're probably not affected. But you can always check at the link below. That guy gets a lot of donated packages of cracked data: https://haveibeenpwned.com/ https://haveibeenpwned.com/ Google also has their own people seemingly trolling through onion sites buying up packages of cracked data so they can run it against their own properties and see if anyone is affected.

gautamsomani 3y ago

Noob question - What websites are these where such data is published? I never came across any?

chefandy 3y ago
Various darknet fora. Certainly nowhere on clearnet. There are search engines that deal with such things though I'll bet there's a 99:1 ratio of scam to legit. I have no idea how someone world go about validating what they saw.
- judge2020 3y ago
  Validation is likely tied to reputation - such as by showing a sample to an established moderator / community member and them vouching that the data seems real.
- cowsup 3y ago
  In this case, they validated it by: 1. confirming the emails were not already listed in other databases / leaks; 2. going to the actual Discord platform and performing a "Forgot Password" request, entering a stolen email, and seeing if it goes through or not, as Discord confirms if an email exists or not during this flow; 3. contacting Discord.io directly, who confirmed & put out a statement. Other data breaches are harder to verify. Troy Hunt (owner of haveibeenpwned.com) described this in far more interesting ways than I ever could[0], but for each breach, it varies. [0]: https://www.troyhunt.com/heres-how-i-verify-data-breaches/ https://www.troyhunt.com/heres-how-i-verify-data-breaches/
- technion 3y ago
  Until recently, every time a story was run about a leak being "for sale on the dark web", you could visit raid forums or breach forums, both clearnet sites, and note that's where it's for sale.
tamimio 3y ago
I have a directory of most of them, I would not post it under my real identity obviously, but if you happen to be into the cybersec space, definitely you came across some of these sites, there are even sites with latest APT discovered up to this month too.

lakomen 3y ago

Ok so when I've never used a 3rd party discord service I'm safe. I got scared there for a moment, but then I thought what would I lose? Nothing at all. Nothing that can't be replaced. No contacts worth keeping.

poglet 3y ago
If someone has access to your account I assume they can read all your messages and possibly impersonate you.
- Spivak 3y ago
  Having OAuth creds is a totally different thing than having access to your account. I support "Log in with Discord" on my site that uses the OAuth flow and the only thing I get out is a set of creds that can hit /user/@me and let me say "the user that just authed is this Discord user." Now discord.io could have asked for everything but the risk of some random integration is on average a lot less. To my knowledge absolutely nothing has the rpc scopes. The good news is that even with every scope you can't take over the account and the service can just be removed cutting off their access for sure.

scudsworth 3y ago

what was the actual killer app here

boneitis 3y ago
[e: i apparently mistook discordio for a couple of the other discovery platforms we utilized, but it seems to be the same concept as the others, looking at the web archives] discordapp back then was really just a collection of servers pretty siloed/insulated from each other, with barebones voice and text chat functionality. discordio offered some basic form of discovery and cross-server exploration/networking when it was effectively nonexistent back then. it, along with other outreach efforts on our part, certainly helped boost our community size and amusingly also attracted a lot of teens approaching us to ask if we wanted to "partner up" with their server (i help administer a studygroup server on discord). my 2c, as a fairly active user since '16.
- ehsankia 3y ago
  I assume being able to get a custom link is also nice, I believe discord only allows that for partnered servers?
  - boneitis 3y ago
    ah, forgot about the free custom links. anyway, 'partnered', to my recollection, means a formal arrangement with discord where the particular server community is directly promoted by discord on front pages and such, in exchange for meeting a higher bar of conduct that represents a model community (SFW, PC, etc.). one of the perks that comes with this is being granted "Level 3" boost status, free of charge (normally costing anywhere from $49-70/mo, depending on circumstances), which is what directly grants the custom link feature.
  - noxvilleza 3y ago
    I run a Discord server which wasn't partnered, is quite small, and somehow had a custom link (we also certainly weren't boosted).

paulpauper 3y ago

as long as there is data, there will be data breaches

Waterluvian 3y ago
This is why I store all my sensitive data on the cozy side of an event horizon.
- tmpz22 3y ago
  I have a vault set to open when GRRMs Winds of Winter comes out. I feel pretty good about it.

sharts 3y ago

Where there are DBs and no accountability for data security, there are breaches. Nothing to see here.

dancemethis 3y ago

I mean, that's not _too_ different from the way Discord "officially" sells user data in the shadows.

pyuser583 3y ago

As a discord user, how worried should I be?

lcnPylGDnU4H9OF 3y ago
It sounds like one would needed to have connected their discord account with this separate discord-related app. If you didn’t do that, I would expect your account wasn’t breached.