Hello, World!
There’s a cyber crime empire built on Discord, A Joe Biden themed dark web marketplace is
giving away 1 million credit cards for free, and KillNet attacks over a dozen US airports.
That’s all coming up in today’s roundup of cyber security tech news.
For months there have been various reports of malware targeting Discord users, but they
were just smaller parts of a larger puzzle, which has now been pieced together in a new
report by Checkmarx, exposing a cyber crime empire built around Discord.
It’s run by the “Lofy Gang”, they spread their malware via multiple channels, all with
the aim of stealing credit cards and discord accounts.
One of their vectors of infection is malicious npm packages.
So, Npm is a javascript package manager, which developers use to distribute their javascript
software, but blackhats also use it, to distribute their malware.
Lofy has so many malicious packages waiting to entrap victims that researchers at checkmarx
created a dedicated website just to track them all.
The greyed out ones have been deleted, but many are still up and downloadable.
One of Lofy’s malicious packages is discord-selfbot-v12.
A Discord selfbot is a bot that runs on your personal Discord account, giving you extra
features, not something I’ve played around with, but I’ve heard they can be useful.
This package comes second in npm’s search results for ‘discord selfbot’, so it’s
not surprising that hundreds of people have downloaded it.
Something important to point out here, is that this package isn’t for a fully finished
discord selfbot, instead, it’s for an API that people use to create selfbots, so if
a legit developer comes across this package and uses it to create a tool which they then
publish…
they will unknowingly be spreading malware, so these download statistics are just the
tip of the iceberg.
Back to the package page, and this github repo linked in the sidebar is fake, well - I
mean, it’s real, but it doesn’t belong to discord-selfbot-v12.
Since npm doesn’t verify the ownership of github repos, miscreants can just arbitrarily
add them to their packages, which means statistics are pulled from a real github repo, lending
the page some credibility.
Victims using this npm package won’t know they’ve downloaded malware, until they start
finding fraudulent transactions in their credit card statements - because this malware modifies
your Discord installation, so that credit card details you enter into Discord to pay
for nitro, are scooped up and sent to the hackers.
However, a bit of a plot twist here is that this package doesn’t actually contain any
malicious code, that, comes from one of its dependencies, which has actually been removed
by the npm security team.
When this happens, Lofy can just replace the malicious dependency with a different malicious
dependency, and because the main package doesn’t directly contain malware, it won’t be removed.
In fact, if you look through the version history you’ll find different malicious dependencies
scattered throughout each version.
Another way Lofy distributes malware is via hacking forums.
One of their posts promises free discord nitro, how does that work, I hear you ask?
A video tutorial recorded by Lofy shows that
after giving their bot, your discord authentication
token it’ll buy Nitro on your behalf, apparently using a stolen credit card - I wonder where
they get those from…
There’s so many layers of sus here it’s almost comical… before you even get to issue
of using stolen credit cards, you have to give the bot your discord token, which gives
Lofy pretty much full access to your Discord account, hence why they’re able to buy Nitro
for you.
What they then do with your Discord token, is unknown, but it can’t be anything good,
because after forum users marked the post as malicious, Lofy edited the post away.
If you want to read more about Lofy, you can find the full research by Checkmarx linked
below.
A dark web market called BidenCash, is giving away 1.2 million credit cards, for free.
This ‘Joe Biden’ themed carding marketplace made headlines earlier this year when they
started selling stolen credit cards for just 15 cents.
But their latest attention grabbing marketing scheme, has been to publicly post a 200MB
csv file containing 1.2 million credit cards.
Not only does it contain credit card numbers, but also expiry dates, cvvs, addresses and
so on - basically everything a blackhat would need to commit fraud.
The cards are from all over the world, but mostly the US.
However, as is usually the case with blackhats, everything is not as it seems.
It’s being reported that only 30% of the cards are fresh, the other 70% will be old,
non-working cards, probably just thrown into the mix to pump the numbers up to 1.2 million,
topping a similar giveaway perpetrated by a different dark web marketplace last year,
which gave away 1 million cards.
However, even if 70% of the cards are old and not working, that does mean there are
still 350,000 valid cards in here, but, luckily what you find with these kinds of leaks is
that they very quickly fall into the hands of cyber security researchers, who report
them to banks.
So even though it’s only been a matter of days since this was leaked, I imagine it’s
all but useless at this point.
However BidenCash probably doesn’t care, I mean, it’s not like they leaked this for
the benefit of their cybercriminal brethren, BidenCash just wanted attention, exposure…
eyeballs on their site, which they got, I mean - here we are talking about them.
Even just their name, “BidenCash” is a pretty attention grabbing.
Though, I suppose the last thing a dark web carding marketplace needs to worry about is
trademark infringement.
In fact, it’s quite common for dark web sellers to name themselves after high street
shops.
I’ve seen some darknet sellers in the UK, go by the names, “Tesco”, “Asda”,
and “John Lewis”, why?
Well, it is pretty funny, for people to say they bought their drugs from, Tesco.
It adds a little spice, which I imagine is what BidenCash was going for.
But where on Earth do you get 1.2 million credit cards from?
Web skimming.
This usually takes the form of miscreants hacking ecommerce sites which run magento
or wordpress.
Usually these sites are running some old vulnerable
plugin, which is exploited to inject malicious
scripts into the checkout page of the site - allowing hackers to siphon off customers’
credit card numbers.
I’ve covered this sort of stuff before… and hackers can get quite creative, one example
I covered, saw miscreants encoding stolen credit card data into images, in order to
avoid raising suspicion from website owners, before just, downloading the pictures from
the site, and then likely listing them on a carding marketplace…
like BidenCash.
BidenCash accepts bitcoin payments from miscreants who can search their database of cards for
sale, picking and choosing the cards they want, based on a whole array of variables,
like the country and city the card is registered in.
This is quite useful for these miscreants, because they can buy cards registered near
their physical location, within just a couple of miles, making fraudulent payments using
these stolen cards, much harder to detect for the websites they’re used on.
Y’know I’ve seen people try to justify using stolen credit cards because they say
‘that since the victim will 99% of time time get their money reimbursed by the bank,
you’re only stealing money from the bank’.
Well, as someone who operates an ecommerce store I can say that this just isn’t true,
when a credit card’s legitimate owner notices
a fraudulent transaction and initiates a chargeback
it’s the company who accepted the payment who has to repay the money, not the bank.
Not only that but payment processors will usually slap on an extra bill of $20 or so,
as some kind of administration fee.
So yea, using a stolen credit card is a pretty scummy thing to do.
Killnet - a pro Russian hacktivist group has attacked more than a dozen airports across
the United States.
This made mainstream news, and let’s be honest, putting “airport” and “attack”
in the same sentence is always going spook people.
However, it turns out that this was just a DDoS attack - and whilst it was a rather large
scale one, Killnet only went after the websites of airports.
Which seems like an odd choice when you think about it - I mean, when was the last time
you visited an airports website, they don’t exist to do much other than display information
about car parking and the different restaurants in the departure lounge, so I can’t imagine
the short lived downtime of just a few hours caused much impact.
Flights weren’t affected, and by all accounts it was business as usual at airports - this
attack seems to have been designed to get the group behind it, Killnet - the maximum
media attention.
But who is Killnet?
Well, they’re a pro Russian hacktivist group with a Telegram channel of over 90 thousand
subscribers, here they post memes disparaging Ukraine, and the West in general, but they
also post targets for their subscribers to attack - this is the list of US airport websites
they went after.
You could describe Killnet as the opposite version of the “IT Army of Ukraine”, which
itself is a Telegram channel set up to direct people to attack Russian websites, though
they have more than double the subscribers, and focus less on the memes and more on the
DDoSing.
The “IT Army of Ukraine” is state sponsored, as in it was literally set up by the Ukrainian
government, however there’s no indication that Killnet has any blessing from their big
guy.
Killnet have targeted a diverse array of countries,
which have included Japan, Estonia and Lithuania,
but all for the same reason, they either sided with Ukraine or engaged in what Killnet perceives
as anti-Russian acts.
This video was made possible by Linode, who are giving you a $100 60-day credit just for
signing up.
Linode is essentially your swiss army knife for cloud computing, if it runs on linux it'll
run on Linode.
One great feature of Linode is their app marketplace
which makes it super easy to spin up servers
with preconfigured software.
Use Linode's Kali Linux app to quickly spin up a fresh instance of Kali, the installer
makes it easy to configure the basics, like VNC passwords, whether you want a desktop
environment, and so on.
Linode can run almost anything, by providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
As always thanks for watching, and I’ll see you in the next video, have a good one.