5 ms·
A Botnet Accidentally Destroyed I2P
- gnabgib 9mo agoThis seems to lack the full story, despite the headline.. Krebs' coverage is more in-depth (39 points) https://news.ycombinator.com/item?id=46976825 https://news.ycombinator.com/item?id=46976825
- darig 9mo ago[dead]
- walletdrainer 9mo ago[flagged]
- pests 9mo agoThis is so odd. I tried to verify your claim and I give up. It might be but I really hate how information is becoming like this. There is other reporting out there on "Starkiller" (the phishing kit in kerbs most recent post) and I can find other articles on it, but sources seem to be circular. The source mentions Jinkusu forums, which do seem to be real, but any links I find aren't loading for me and still no conclusive findings of Starkiller.
- walletdrainer 9mo agohttps://temp.sh/XOWUP/STARKILLER_V6.0.1___ULTIMATE_WEAPON__BYPASS_2FA_MFA__-_Software_-_Exploit.IN_Forum.pdf https://temp.sh/XOWUP/STARKILLER_V6.0.1___ULTIMATE_WEAPON__B... These forums are mostly private, but Krebs certainly has access to them. There can really be no excuse for how he handled this. There are multiple posts by people in different places claiming to have bought this phishing kit, and then being delivered totally non-functional vibecoded garbage. The vibecoded garbage is not the advertised product though, as the author never managed to get the AI to finish his project.
- pests 9mo agoI figured the forums were real, just was blocked for some reason so thanks. I do not doubt this story for a second. Its crazy Kerb's is basically freely advertising this blackhat slop.
- flipped 9mo agoKrebs lack any sort of real credibility. He's pushing out slop with a govern-mentalist propaganda. Tech journalists are the worst form to gather any actual information.
- walletdrainer 9mo agoKrebs has some credibility in this space because he used to post well-informed takes on these topics, not stuff like this. His record has never been flawless, but the guy actually put in the work to learn Russian to be able to read these forums. He just doesn’t anymore.
- flipped 9mo agoAll of his dox articles are based on sloppy practices from threat actors.
- walletdrainer 9mo agoSo? At least the reporting used to be mostly accurate and trustworthy. Here we can see that Krebs is now willing to publish stories he hasn’t even attempted to verify
- flipped 9mo ago[flagged]
- tomhow 9mo agoPlease don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- walletdrainer 9mo ago
- notpushkin 9mo agoCould you elaborate a bit? It’s hard to take such a claim seriously without any evidence presented.
- walletdrainer 9mo agoEvery single person who has bought the phishing kit claims the seller is a scammer. Krebs’s article is based entirely on the sellers description of the (imaginary) product, rather than actual observation of the phishing kit in the wild. See the exploit.in thread for example https://temp.sh/XOWUP/STARKILLER_V6.0.1___ULTIMATE_WEAPON__BYPASS_2FA_MFA__-_Software_-_Exploit.IN_Forum.pdf https://temp.sh/XOWUP/STARKILLER_V6.0.1___ULTIMATE_WEAPON__B... Krebs has access to these forums, he could’ve checked this story out in less than 3 minutes but did not. Even if Krebs wasn’t a subject matter expert, it’s still inexcusable that he didn’t do the most basic work here. You don’t need to frequent underground runet forums to know that a journalist should be able to verify the stories he puts out. I think it’s also particularly telling that he didn’t bother to source reasonable quality screenshots for the story, which he would have been able to do had he ever witnessed this phishing kit working.
- Roark66 9mo ago>See the exploit.in thread for example https://temp.sh/XOWUP/STARKILLER_V6.0.1___ULTIMATE_WEAPON__B https://temp.sh/XOWUP/STARKILLER_V6.0.1___ULTIMATE_WEAPON__B... "Maximum download limit reached" - it's gone. Also, not present in the archive.org :-(
- JasonADrury 9mo agohttps://files.catbox.moe/fod8rc.pdf https://files.catbox.moe/fod8rc.pdf https://web.archive.org/web/20260222094129/https://files.catbox.moe/fod8rc.pdf https://web.archive.org/web/20260222094129/https://files.cat...
- pests 9mo ago> Krebs’s article is based entirely on the sellers description of the (imaginary) product, rather than actual observation I noticed. While researching I had a feeling of "is this just makeup on a pig?". Anyone can make pretty graphics or make claims. I tried reading a few selling points and I was weary. One claimed to handle a MFA token handover and then somehow got access to the token and they could proxy it for you? The user types in the MFA token, they get the token. I cant figure out how they would bypass all browser protections to pass on the highly-secured token via a proxy. I've been online for 25 years, I understand on a deep level on the internet works and the web and what is happening in this situation, as I'm sure most here are. Without a 0day, this just doesn't make sense. But this is pretty technical, and unless you hang out here then the above sounds perfectly reasonable but to us sounds like bullshit. > he didn’t bother to source reasonable quality screenshots for the story Also noted. Quickly found better quality versions myself with a quick search.
- torben-friis 9mo agoMan, I feel so out of depth with cybersecurity news. Why does i2p (per the article) expect state sponsored attacks every February? Where are those forming from, what does the regularity achieve? How come the operators of giant (I’m assuming illegal) botnets are available to voice their train of thought in discord?
- OgsyedIE 9mo agoMany state bodies involved in adversarial action have dedicated budgets for offensive cyber-warfare, credential thefts, supply chain compromises and disinformation. If they haven't used all of their budget by the end of the budget period, they'll be allocated a smaller budget for the next budget period.
- torben-friis 9mo agoOh ffs. Whenever I think my opinion on the state of the world can’t get any lower, things somehow manage to get dumber.
- bryanrasmussen 9mo agoI mean this is a common pattern in many large organizations, governmental and non, if you didn't use your budget it means we can save money, yayyyy! I hadn't really considered it would apply to state-backed hacking but makes sense.
- tosapple 9mo ago[dead]
- busko 9mo ago[dead]
- flipped 9mo agoState sponsored cyber attacks are news to you? It's been a thing since more than 2 decades now.
- jjmarr 9mo agoFrom the main article, I2P has 55,000 computers, the botnet tried to add 700,000 infected routers to I2P to use it as a backup command-and-control system. https://news.ycombinator.com/item?id=46976825 https://news.ycombinator.com/item?id=46976825 This, predictably, broke I2P.
- infogulch 9mo agoThat's an interesting stress test for I2P. They should try to fix that, the protocol should be resilient to such an event. Even if there are 10x more bad nodes than good nodes (assuming they were noncompliant I2P actors based on that thread) the good nodes should still be able to find each other and continue working. To be fair spam will always be a thorny problem in completely decentralized protocols.
- sandworm101 9mo agoNo. They should not try to survive such attacks. The best defense to a temporary attack is often to pull the plug. Better than than potentially expose users. When there are 10x as many bad nodes as good, the base protection of any anonymity network is likely compromised. Shut down, survive, and return once the attacker has moved on.
- martin-t 9mo agoWhy would an attacker move on if it can maintain a successful DoS attack forever?
- illusive4080 9mo agoWhy does Discord allow a server for a botnet owner?
- fragmede 9mo agobotnet owners dying typically come forwards and say they are trying to run a botnet, so there may be some difficulty there.
- fragmede 9mo agobotnet owners don't typically come forwards and say they are trying to run a botnet, so there may be some difficulty in detecting them there.
- ddtaylor 9mo agoDiscord has a lot of terrible servers. This is one of the reasons they were not trusted when they came out and wanted to do identity verification. They already have a lot of information yet fail to do meaningful enforcement at scale.
- Aurornis 9mo agoOnly a couple years ago the outrage was that Discord was too eagerly banning servers and users. I know several people whose Discord accounts were banned because they participated in a server that later had some talk of illegal activities in one of the channels. There are similar stories all over Reddit.
- zamadatix 9mo agoIf a Walmart has ~100 people in it and wants to get rid of 4 shoplifters but really sucks at selecting them well then the likely result is 4 normal people are very upset while all of the shoplifters are still there. In the same scenario, even if Walmart is right about who they ejected 75% of the time then they still have ~1 shoplifter remaining and ~1 very upset person. Even in an ideal world where Walmart is right about ejection 100% of the time it doesn't mean they start receiving 0 new shoplifters either, it just means the number of people wrongly made upset is 0. Discord's problem (on both ends) lies in lack of depth in investigating bans. It takes resources to review when someone shouldn't be banned and it takes resources to make sure you ban everybody. Putting too low of resources into banning just means that both sides of the scale manage to get tipped in the wring direction at the same time.
- richardfey 9mo agoI wonder how cjdns would have handled this
- hoppp 9mo agoIsn't I2P java? The botnet uses java? I thought python or C is preferred for that kinda stuff
- mhitza 9mo agoThe official router implementation is Java. i2pd is an alternative written in C++. Once established communication can transparently be processed through a socks proxy, or integration with SAM or similar https://i2p.net/en/docs/api/samv3/ https://i2p.net/en/docs/api/samv3/
- monero-xmr 9mo agoComputers are so fast it doesn’t matter
- flipped 9mo ago"Since the abstraction layers have quadrupled, let's not just care about the actual performance anymore!"
- fuzzfactor 9mo agoNot my downvote, but which computers would that be? More people than just myself might want one.
- rippeltippel 9mo agoCommunication between bots use network protocols, it doesn't matter in which language those protocols are implemented.
- Cider9986 9mo agoThe video seems to be a bit more in-depth.
- fuzzfactor 9mo agoA bit of a tangent, but if I had a beard like that I would be making a lot more videos :)
- cookiengineer 9mo agoThis was one of the worst writeups I ever read. Even a LinkedIn Premium post would have had more technical details, lol
- pmontra 9mo agoThis seems to be a better post about what happened, from the same site https://www.sambent.com/i2p-2-11-0-ships-post-quantum-crypto-after-botnet-siege/ https://www.sambent.com/i2p-2-11-0-ships-post-quantum-crypto...
- nneonneo 9mo agoThose are some weird-ass visualizations. I can only assume they were AI-generated.
- KennyBlanken 9mo agoI'll save everyone else a click: AI slop text coupled with the strangest, most pointless visualizations I've ever seen.
- SV_BubbleTime 9mo agoSpeak for yourself! I didn’t really understand the link between Alice and Bob until I saw a green floaty dot go through a pile of spaghetti with the word compromise beneath it.
- charcircuit 9mo ago>hostile nodes >they accidentally disrupted I2P while attempting to use the network as backup command-and-control infrastructure So were they hostile or were they using it normally?
- shevy-java 9mo ago> The I2P development team responded by shipping version 2.11.0 just six days after the attack began. Not wanting to be overly critical, but any net-infrastructure project kind of has to keep bot-attacks in mind and other attack vectors, in the initial design stage already. Any state-actor (and other actors, though I would assume it is often a state financing the bot network behind-the-scene) can become potentially hostile.
- rollulus 9mo agoThis article (with high slop vibes) and another article on their site (linked in the comments) seem to suggest that post quantum encryption mitigated the Sybil attack, without explanation. I fail to understand how the two are even related.
- singpolyma3 9mo agoCame here to say this. Seems like the attack was an accident and it ended. Nothing was mitigated
- swordsith 9mo agoDefinitely generated, testing a ML model I'm training. it flags as claude mostly.
- Roark66 9mo agoIs there a shittier summary anywhere, please? Or did the author reached the peak of enshittification? Honestly, did the bot implementation have bugs or was it a proper implementation that crashed the network due to sheer numbers? Also, how does changing the encryption standard affect anything if the bots tried to integrate correctly with the network? Is the problem "fixed" or is it not? Elsewhere I found large number if botnet devs got pissed off with this botnet operator and 600k nodes went offline. Might this have much more to do with the situation getting better than simply changing encryption? Also, was there any suggestion a quantum breaking attack was attempted? No. So why put the emphasis on "post quantum" in this article? Bad. Very bad.
- _yclj 9mo ago[dead]
- superkuh 9mo ago> The operators admitted on Discord they accidentally disrupted I2P while attempting to use the network as backup command-and-control infrastructure ... This is crazy to me. Discord is letting literal criminals use it's corporate services in full view to commit crimes?
- newzino 9mo ago[flagged]
- anthk 9mo agoI upgraded my OBSD just fine over I2P. I don't use the Java client/server, that might the reason.
- anthk 9mo agoAlso rewriting i2pd in Go would be the sanest step. From Java to Go is not a big challenge and you gain even more portability. Just look at Yggdrasil on how these people created meshnets running even under Android and cheap i386 netbooks. Thus, something like this in Go should be the norm. The GC it's ideal for this, it comes with batteries charged for networking and it can be for sure be made compatible with stuff like NNCP like nothing. It wouldn't run many times slower than i2pd in C++, it should be perfectly bearable.