I reversed a Node.js malware and found the author

Re:I reversed a Node.js malware and found the author by userbinator on Wednesday February 02, 2022 @12:07AM (#30173955)

I had fun with people on forums trying to get others to download keyloggers and the like. A lot of these were the stereotypical "script kiddies" who didn't know how much personal data they were giving away or even how the tools they used worked. I distinctly remember a few "C:\Documents and Settings\<uncommon first and last name>\...", from which I could find and sometimes phone them (often their parents would answer), but I drew the line at doing anything physical --- they were all far away anyway.

The most interesting results include apologies; one kid's father registered on the forum to post one for his son. Spamming a keylogger's logs with the physical address of its owner and "I know where you live" tends to cause them to repent in fear pretty quickly.

[ Parent | on HN ]

Re:I reversed a Node.js malware and found the author by bryanrasmussen on Wednesday February 02, 2022 @05:44AM (#30175947)

> I distinctly remember a few "C:\Documents and Settings\<uncommon first and last name>\...", from which I could find and sometimes phone them (often their parents would answer)

so this sounds like a pretty devious attack if you want to get someone, pose as a script kiddie in online forum, put in C:\Documents and Settings\<their first and last name> in stuff, other identifying info maybe and then let others do the work.

[ Parent | on HN ]

Re:I reversed a Node.js malware and found the author by jacquesm on Wednesday February 02, 2022 @05:11AM (#30175743)

It's all fun and games until the doorbell rings.

[ Parent | on HN ]