Cinner

@Cinner@lemmy.world

This profile is from a federated server and may be incomplete. Browse more on the original instance.

Cinner, (edited )

====================

Edit: Can any fellow infosec nerds chime in and say whether this is readable or not? I feel like I just wrote it incoherently because I was stoned. I hope that’s what happened anyway, and people pirating software aren’t actually this ignorant about network security.

tl;dr: Disgruntled employee wants to make a bunch of easy crypto from the company he hates. cracks contain viruses a non-minimal amount of the time. This turned into a story about an easier way this coworker could be doing it to introduce his own ransomware and get away with it, and then I went into how I would do it if that was the intention.

I have no idea if this is the reason or if OPs colleague really hated scrolling down and clicking Accept. Maybe he just wanted the legit version for himself.

====================

This sounds like a great way to introduce your 2-year-delay ransomware on the company without it being as risky of a charge if you’re caught. Only fired for causing a ransomware infection out of neglect and stupidity if caught, just make sure you tell a few coworkers about it.

Although it’d be easier to plug in a USB drive you found in the parking lot with folder [company name blackmail] which contains “[hot male coworkers name] NUDES.zip.ws” and “[hot female coworkers name] NUDES.zip.ws”

Just make sure you buy a throwaway laptop and install a Russian or Chinese language pack and use that as the primary system language when opening the final source code before you add some CN/RU strings in the file and compile. Use Google Lens to translate in realtime from a burner smartphone /e/OS and location disabled. Make 3 drives and toss 2 of them from your car window in hard to find places a week before, with multiple days between. Then on the day you find yours, covertly chuck it from the roadway an hour before opening in the general area you park, and show up 5 minutes early in the spot you usually park. Make sure you always show up somewhat early. Then “notice it” and walk in and plug it in.

Ransomware starts after a 2 day delay, they being in LE and find the others that were dropped. Make sure to use neoprene gloves, as latex can pass fingerprints through.

Cinner, (edited )

Seriously? 21 downvotes? Is everyone in the piracy Lemmy completely ignorant and unaware of USB drops? Do you guys not get information security training at work?

I’m talking about osibeyond.com/…/usb-drop-attacks-cause-cybersecur… - USB drops and how that’d be the ideal way I would do it, if I were going to.

I was basically making a story about how OPs colleague could be using cracked programs so the ransomware he coded didn’t get him charged, but instead only fired.

I watched Office Space recently and I was high when I wrote it so maybe it didn’t come read as well as I thought it did.

P.S. .ws files can be as dangerous as .exe and .com/bat/PS1 if that’s what’s confusing people.

Cinner, (edited )

I am technically less than 49.999999999 bot.

Take that as you will.

Cinner,

I can see that. Appreciate you taking the time to break it down like that.

Cinner, (edited )

Unless he cracked it himself, he wouldn’t know for a long time if the cracks were malicious or not. When I found an uploader that had so much working software even the smaller more obscure and niche stuff, I tried to stay with him…Eventually I did malware analysis (hobby at the time) and found out he was binding his password manager stealer to the main program or some necessary .dll that was called my the main program.

That was on IPTorrents private tracker, and he was incredibly highly regarded.

I cum in my pants thinking about the number of different accounts he stole over all those years. I was able to access a similar dumb via ftp and hardcore username and password in the downloader, but that uploader has his bound file so crazy hidden.

The rest was high me writing a story about what your coworker could have been doing, Office Space style.

Cinner,

Many IT security guys go their whole career without touching malware analysis so I’m not one bit surprised.

Your post insinuated this was happening at work

Anyway if doesn’t matter. I’ll take the L for trying to share some information.

Cinner, (edited )

lol I still would have gone on the same rant since it was him using cracked software at work after paying for it. No worries.

Cinner,

I’ll throw in protonmail and skiff.

Cinner,

I’m confused. This kid was arrested for hacking Rockstar and downloading and sharing 90 video clips of the unreleased GTA6, but this source code leak is GTA5, and the full leak is 1TB in size. He was in police custody in a hotel during the time of his 90 clip GTA6 hack. That’s a lot of space for a smartphone and fire stick.

There are 3 leaks in circulation:

3.3 gigs, src only

17 gigs, src + partial assets

1 TB, src + full assets

How are we certain this kid was behind the GTA5 source leak, because these sources don’t claim that. It’s possible that he passed the info on to Lapsu$ members but unless you have another source, this kid wasn’t the leaker of the GTA5 leak.

Cinner,

The full source with assets included is what was leaked, that was my point. It’s 1TB. The leaker also made 2 other versions for people who don’t want to download 1TB since a lot of people don’t have that much spare space lying around for a copy of a games source.

Cinner, (edited )

There are 3 leaks in circulation:

4.3 gigs, src only

17 gigs, src + partial assets

1 TB, src + full assets

Cinner,

All the code, commit history, build scripts, used assets, unused assets, modified assets, random extra stuff.

Cinner,

All the code, commit history, build scripts, used assets, unused assets, modified assets, random extra stuff.

Cinner,

you know that’s a really great point. I had assumed they would make sure he didn’t have a credit card or monitor it etc but you can buy whatever amount of VPS or dedi storage you want with crypto. I’m sure he had knowledge of DNS exfiltration etc to get past any Wi-Fi blocks, or just crack the password for any nearby hotspots if he wasn’t allowed internet access per his detainment.

My thought was he probably gave the initial foothold info to other lapsus members and they took it from there but you’re right he absolutely could have.

Cinner,

you know that’s a really great point. I had assumed they would make sure he didn’t have a credit card or monitor it etc but you can buy whatever amount of VPS or dedi storage you want with crypto. I’m sure he had knowledge of DNS exfil paid hotspot bypass etc to get past any Wi-Fi blocks, or just crack the password for any nearby hotel occupant hotspots if he wasn’t allowed internet access per his detainment.

My thought was he probably gave the initial foothold info to other lapsus members and they took it from there but you’re right he absolutely could have done at all himself.

Cinner, (edited )

He hacked rockstar at a hotel, where he was left with no computers or phones, only to find that the TV had a chromecast, which he used to buy a phone and a keyboard (presumably by selling his monero).

You sure are making a lot of assumptions here and have some very interesting takes. Can you tell me how this would be done without a way to modify the Chromecast?

Cinner,

Why link an irrelevant article from 2005 about IR?

The only hardware an intruder needs is a laptop running Linux, an infrared transmitter and a USB TV tuner. Laurie said the attack can also be performed using the infrared port built into many laptops.

When a Torrent disappears from 1337x, how do you find out what happened?

Yesterday there was a controversial movie torrent that was getting 1000s of downloads and was on the “popular this week” page, and today it’s just gone. I went to the uploader’s account page and it’s not there either. Just like it never existed....

Cinner, (edited )

I would leave my laptop on 24/7 for years to make sure I seeded as much as possible on IPT. Then I wasn’t able to login or seed for a couple months and they locked my account. I went into their IRC to get it unlocked, and they said I should have logged in and could pay like $200 to get it unlocked. At the time I didn’t even have that much money in my account. I tried to reason with them, about how much I’ve uploaded and loved the site, and without a second response they just muted me and after a PM trying to talk to the guy they kicked and banned me from the IRC.

FUCK IPTorrents.

Cinner, (edited )

No I got a better job after that and pretty much only pirate popular stuff that shows on 1337x, TPB, or TorrentGalaxy. I used to pirate mostly software but because of the increasing risk of ransomware and FUD rootkit botnets, I’d rather just pay $30 for it. I’ll still pirate something and run it in a VM if I /really/ need to and it’s $1,000 and I’m going to use it 5 times, but I usually just buy software now.

I’ll probably get a seedbox setup and run Plex for media soon, in which case I’ll just use open trackers or find some non-IPT private tracker.

Cinner, (edited )

The only difference between public and private trackers is availability and quality. You should have a VPN always enabled (through the closest locale if you like, for speed) or a seedbox which is even better than a VPN. If public trackers have what you want, there’s zero reason not to use them.

When I was back on IPT, I found one of the top software uploaders binding a fully undetectable backdoor downloader to his downloads. Never in the installer or anything, always bound to the main software file and could be unbound after install and activation. Always showed 0/50 on virustotal etc. Since I was somewhat into malware analysis at the time, I tried to do some analysis on it but of course it would detect my analysis of it and just not run. Whereas if I ran the software on an old PC, it would do it’s thing and I could detect it after the fact, but still not get very far.

I used a lot of software from that guy previously. Who knows what keys to the kingdom he has.

Cinner,

Have you really never heard of malware from JavaScript? Buffer overflows and sandbox escapes are almost all JavaScript, still, hasn’t changed in the last decade. Sometimes it’s a random font parser library or something, but almost always it’s JavaScript. And now that browsers are auto-updating and they have fully staffed security teams behind them that get word of a vulnerability being secretly exploited before the general public, most people don’t get hit just because they browsed to a random website. But it’s still possible, and especially likely that a shady torrent site could be hosting malware or get ““hacked””.

Cinner,

Also, the guy in the meme is a… checks notes… Canadian that goes around debating freshmen at American college campuses.

Cinner,

I’m talking about reddit admin automated account processes. Not subreddit bots/mods.

Cinner, (edited )

More “if fried chicken was a person” with a picture of Beet (but I wouldn’t do beet dirty like that)

mayo is a “white people thing” according to a black friend when I was younger. or maybe I was offering them miracle whip now that I think about it. I don’t remember.

nope it’s mayo. boards.straightdope.com/t/…/852662

Cinner,

If you want to be up to date on modern slang, falloutboy where the teenagers rizz with they homies.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • localhost
  • All magazines
  • Loading…
    Loading the web debug toolbar…
    Attempt #