4 ms·
I would differentiate 'malware implementations' from 'malware'. A hacking tool presented with its harmful features at face value, with adequate warnings, is not
by creatonez 3y ago
I would differentiate 'malware implementations' from 'malware'. A hacking tool presented with its harmful features at face value, with adequate warnings, is not quite the same as an attempt at tricking people into downloading or bundling something dangerous. I believe Github makes the same distinction in allowing hacking tools. They also allow byte-reversed or zip-encrypted copies of well-known malware for the purpose of study. There's no way to keep out the bad guys while still allowing security researchers.
- DrawTR 3y agoI would understand the first definition if not for the fact that these pieces of software under the topic really don't have any legitimate usage in my opinion. Unless you're explicitly making the argument that the code is the important part (& should be kept on GitHub for the purpose of disseminating the programming methods used to create it, despite their purpose), I just think that GH is being used as a 'download link' if not an aggregator for projects like these. And, they're used for the express purpose of infecting other machines, presumably of people who are none the wiser
- deleted 3y ago[deleted]
- mtlmtlmtlmtl 3y agoI would argue that pretty much any type of malware can at the very least be used legitimately in penetration testing, and probably is.
- DrawTR 3y agoSure, but I would be willing to make the argument that the net benefit you'd get from the maybe one or two people willing to genuinely examine the project's internals is hugely outnumbered by the measurably thousands who want to ruin someone's life
- boneitis 3y agoI don't work in the sector, but my imagination always figured that those one-or-two people would not-infrequently happen to be those (possibly actual r7) devs that write metasploit modules to arm all-colored hats.
- _8j50 3y agoYou don't need to steal crypto wallets and credit card info in a pentest because it's a crime. Unless you argue some companies store crypto wallets and credit card info that belong to the company on computers and that is why all these people are writing stealers? Lol
- hutzlibu 3y agoBut you can include such attacks, to see if it really works. But sure, that is more of a theoretical point.
- _8j50 3y agoBut breaking the law can never be part of the rules of engagement when the company doesn't have authority to give you permission to do something (take an employees financial property).
- hutzlibu 3y agoCompany laptops can also have discord or (more rarely) crypto accounts and a succesful(or unseccesful) pentesting would be taking them over.
- smoyer 3y agoIs it a crime to steal a crypto wallet. Razzlekhan and hubby were convicted of money laundering with the latter also being charged with hacking BitFinex.
- _8j50 3y agoCrypto has financial value, taking something of value that belongs to others is theft.
- smoyer 3y agoI'm not sure the legal system is ready for charging for crypto "theft". What if the unimaginable happens and there's a private key collision that results in two owners ... If they both use the account without noticing the other but one eventually closes the account, is that still theft? It's pretty clear when an account or computer is hacked and yet neither razz or hubby were charged with theft ... Hubby essentially got convicted of tax evasion like a '30s gangster.
- elj 3y agoI would draw the line at the malware author helping users of it use stolen data: https://github.com/Blank-c/Blank-Grabber/issues/359 https://github.com/Blank-c/Blank-Grabber/issues/359
- maxloh 3y ago> How to login to "your telegram account" through the files taken by Blank Grabber? I think it still falls into the "malware implementations" category. It is more about what happens if your data is stolen and how a hacker could exploit that stolen data to gain access to your account.
- elj 3y agoLots of these issues don't mention hacking their own devices but rather someone else's (and some are from obvious script kiddies). I don't think the claim of being an educational purpose tool really holds merit in this case.
- _8j50 3y agoThat's how they nailed the nanocore author. He didn't just write a RAT, he supported it.