I reversed a Node.js malware and found the author

Re:I reversed a Node.js malware and found the author by easrng on Tuesday February 01, 2022 @05:57PM (#30170822)

It's always PirateStealer, probably because it's open source so it's easy for people to pick up and use instead of exerting effort. Also, you can send a DELETE request to a Discord webhook without any auth, defusing the malware.

[ Parent | on HN ]

Re:I reversed a Node.js malware and found the author by Fabricio20 on Tuesday February 01, 2022 @07:53PM (#30172070)

I'm still glad the DELETE thing works, I've reported a few times these with a complete writeup to Discord and all I got was a ticket being auto-closed after a month and the webhooks+servers still being up. I personally no longer bother reporting, just straight delete the webhook to stop the spread. Makes you wonder what their security/support team is doing with all those tickets.

[ Parent | on HN ]

Re:I reversed a Node.js malware and found the author by d4mi3n on Tuesday February 01, 2022 @08:25PM (#30172290)

They may not have one, or have one that’s so underwater with larger issues that the rest of the org doesn’t know how to route things to them.

Hiring for technical security is hard—you need engineering expertise to find good people, and then you need someone with an infosec background to vet them.

Finding a combination of both is surprisingly rare and you usually find infosec folks who can define but not implement a security program, or an engineer that can implement a security program with no idea how to run or grow it.

I need more peers in this space. If you’re reading this and are a software engineer looking for a transition please do reach out—email is in my profile. There’s a huge demand for security engineers and not nearly enough engineers interested in doing it.

[ Parent | on HN ]

Re:I reversed a Node.js malware and found the author by cinntaile on Wednesday February 02, 2022 @06:41AM (#30176272)

How do you mean? Do you mean infosec people usually don't have degrees?

[ Parent | on HN ]

Re:I reversed a Node.js malware and found the author by d4mi3n on Wednesday February 02, 2022 @11:38AM (#30179913)

That depends entirely on their backgrounds. I myself do not. The status-quo here isn’t too different than anywhere else in the tech sector.

Many security engineers transition into infosec from related fields like IT, DevOps, Network Engineering, Product Engineering, or similar. This tends to work out well since security engineers work closely with all of those areas within an organization.

[ Parent | on HN ]

Re:I reversed a Node.js malware and found the author by raverbashing on Wednesday February 02, 2022 @01:45AM (#30174567)

Discord's fraud and malware response is too simplistic to work

Somebody using my email for a discord acct without verification? Sure, go ahead (but I got the "verify your account" emails)

Then I "forget" the acct password, bam, account locked.

Which is fine by me, since I don't use that email with discord, still...

[ Parent | on HN ]

Re:I reversed a Node.js malware and found the author by tisryno on Wednesday February 02, 2022 @05:07AM (#30175713)

Yes, you can send a DELETE to a Discord Webhook, but these malware projects have clocked on in most situations and now forward Webhooks through their own domains.

For the example of PirateStealer, the kid who made it ran a website where you posted your webhook and it spat out an exe that hid your webhook behind the domain, they even sold "premium" copies with additional security but in reality once they put the webhook behind their own domains they were dual-hooking, so the information was actually sent to 2 webhooks instead of just the 1.

Most of the services to create this malware now hide it behind a domain rather than directly exposing the Webhook, so shutting it down isn't as easy.

[ Parent | on HN ]