Hello, World!
The humble Discord mod is under threat from browser bookmarks, malicious ones which enable
attackers to completely take over their servers.
Now before making this video I actually had no idea bookmarks could be weaponised, and
if you’re just as confused as I was then you have to know about this, even if you aren’t
a Discord mod.
So, I’m guessing we’ve all come across bookmarks that point to URLs, but they can
also store javascript, this allows bookmarks to do quite a bit more than their name suggests,
you can store games in a bookmark like pong, I came across a snippet of code that’ll
Shrekify the whole page - I even found one that allows you to skip YouTube ads, no adblocker
required - all this bookmark does it set the current timecode of the youtube ad you’re
watching to whatever its duration is, something you just can’t do from a user perspective
- this might actually be useful given YouTube’s latest experiment.
The whole concept of storing javascript in bookmarks is called a bookmarklet, I was surprised
I’d never heard about them before.
But then I found out why, they went out of fashion, quite a while back.
There were just better ways of achieving the same thing with browser extensions, not to
mention the security problems of bookmarklets, but we’ll get to that in a bit.
These things peaked in popularity way back in 2010, and have been dying ever since, forums
dedicated to them have become ghost towns, leaving bookmarklets all but dead.
That is until last year when all of a sudden bookmarklets mysteriously became popular again.
This rise from the grave seems to have coincided
with the first known malicious uses of bookmarklets
in Discord scams.
The scam works in different ways but we’ll use the recent example of cryptocurrency related
Discord servers being targeted.
And it goes something like this, an admin or mod on one of these servers gets a message
from someone working for a fictitious crypto news website, wanting an interview.
The discord mod excitedly accepts and joins a server hosted by the interviewer, however…
before the server will allow them in, it points them to a website in order to ‘verify their
identity’.
Which says “To gain access to this Discord server, drag the “Drag Me” to your bookmark
bar.”
If you’ve never come across a bookmarklet before you wouldn’t know that dragging a
button to your bookmarks bar is a quick and common way to install bookmarklets, other
than just pasting in the raw code.
The website then tells you to “proceed to the Discord server which you want to verify
in and click on the verify function while on it”.
But if we take a look at the bookmarklet’s code we can see exactly what’s going on
here, far from verifying your identity, it’ll grab your Discord token, along with some other
variables, sending them straight to the attacker through a Discord webhook.
Your discord token of course holds the key to your account and is all an attacker needs
to take it over.
2 factor authentication isn’t going to save you here, as this bypasses that.
After the attacker grabs the token, they’ll wait till the dead of night, when the mod
is quite literally asleep before logging in
as them, and posting a crypto scam in announcements.
But these aren’t typical, double your money kind of crypto scams, those are way too basic
to work in an actual cryptocurrency community.
Rather because many crypto servers are based around a particular crypto project, token,
NFT, or something like that… the attacker will harness the power of their brand, and
set up a highly customised website impersonating it - claiming that they’re doing some kind
of giveaway.
Victims who fall for it and connect their wallets to the site end up having them drained.
And if you try to warn others in the chat that it’s all fake, you’ll just get banned.
If possible, the attackers will also derank other staff members to keep the scam alive
for as long as possible.
This all goes on until the mod inevitably wakes up to the carnage.
Luckily, locking out the attacker is as simple as changing your password, but by then the
damage is already done.
Whilst these scams have mainly been targeting crypto focused Discord servers - as it’s
just easier to squeeze money out of those guys, there’s no reason to think malicious
bookmarklets won’t be used more widely, so definitely look out for them.
If you do want to play around with non malicious bookmarklets, you can find quite a bit on
github - a lot of these remind me of pre 2012 internet, the kind of thing you’d play around
with at school.
But be careful of course when copy pasting code, as there could be a nasty surprise hiding
inside.
This video is sponsored by PCBWay, the complete solution for all your PCB Fabrication and
on demand 3D printing needs.
From standard PCBs to the more advanced varieties, PCBWay provides granular control over every
element of your PCB.
With superfast turnaround times you’ll be spending more time creating and less time
waiting on packages.
PCBWay also offers on demand machining, from CNCing and sheet metal cutting to 3d printing
and injection molding, there’s an array of materials to choose from, and of course,
superfast turnaround times.
PCBWay have just celebrated their 9th birthday and have a ton of promotions on, found out
more via the link in the video description.
As always thanks for watching and I’ll see you in the next video, have a good one.