eblf2013 wrote:

ShinRun wrote:

Cerno wrote:

eblf2013 wrote:

Stomiks wrote:

I guess this event was short-lived.

What do you mean the OT!neus server is screwed.

checked the audit log and ippe, wither and angiee got banned. wtf happened in the server when it first went down, i was sleepin

Wither did some naughty stuff and angie got banned probably for exposing the hacker

TIL Angie is Abraker's sister.

So, when abraker got hacked and lost access to his account, he tried messaging through Angie. The message was deleted by the fake abraker.

Karmine wrote:

Time to make manish GMT to save OT

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

Sies wrote:

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

:<

time to save OT

z0z wrote:

Sies wrote:

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

:<

time to save OT

death is already here but you can join him

Cerno wrote:

z0z wrote:

Sies wrote:

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

:<

time to save OT

death is already here but you can join him

in this new era of ot we’ll be having 2 overlords

Puck- wrote:

Cerno wrote:

z0z wrote:

Sies wrote:

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

:<

time to save OT

death is already here but you can join him

in this new era of ot we’ll be having 2 overlords

Sies & Me.

Cerno wrote:

Puck- wrote:

Cerno wrote:

z0z wrote:

Sies wrote:

Clicky- wrote:

Cerno wrote:

oh bruh wtf did i woke up to

z0z wrote:

in the meanwhile, who would cover for the gmt?

Sies probably? I know he checks ot infrequently

oh yeah, Sies
i forgot that he's a GMT

:<

time to save OT

death is already here but you can join him

in this new era of ot we’ll be having 2 overlords

Sies & Me.

u are quite possibly the least qualified person to be in charge of a community

ShinRun wrote:

McEndu also got phished but be transferred one of his server ownership to me before the hacker can get to it

z0z wrote:

ShinRun wrote:

McEndu also got phished but be transferred one of his server ownership to me before the hacker can get to it

is this a server attack

eblf2013 wrote:

In case you ask, we're talking through MAL.

ShinRun wrote:

McEndu also got phished but be transferred one of his server ownership to me before the hacker can get to it

Manishh wrote:

ShinRun wrote:

McEndu also got phished but be transferred one of his server ownership to me before the hacker can get to it

that was my plan from the start, revenge

McEndu wrote:

Various things I can confirm about the hack:

1. The program uses JavaScript heavily; its icon even gives it away as a Node.js bundle.
2. It gets on to mainly your Discord. People have also confirmed that osu! credentials are stolen.

I am still trying to identify the damage done to my side. Also, the script kiddie hosted the trojan on itch.io (deadtriggerofficial.itch.io), so try to send itch.io a contact email if you can.

Corne2Plum3 wrote:

McEndu wrote:

Various things I can confirm about the hack:

1. The program uses JavaScript heavily; its icon even gives it away as a Node.js bundle.
2. It gets on to mainly your Discord. People have also confirmed that osu! credentials are stolen.

I am still trying to identify the damage done to my side. Also, the script kiddie hosted the trojan on itch.io (deadtriggerofficial.itch.io), so try to send itch.io a contact email if you can.

wdym? You got hacked too?

Clicky- wrote:

it would be funny if the old server is nuked and make a new one

OT!neus S2

ClevelandsMyBro wrote:

Clicky- wrote:

it would be funny if the old server is nuked and make a new one

OT!neus S2

just saying, us at NEOS are getting a bit lonely ngl.

ClevelandsMyBro wrote:

Clicky- wrote:

it would be funny if the old server is nuked and make a new one

OT!neus S2

just saying, us at NEOS are getting a bit lonely ngl.

Karmine wrote:

ClevelandsMyBro wrote:

Clicky- wrote:

it would be funny if the old server is nuked and make a new one

OT!neus S2

just saying, us at NEOS are getting a bit lonely ngl.

Gotta find the link, it's like a puzzle game

Manishh wrote:

ok i was wondering, how abraker gonna recover his account

HoosierTransfer wrote:

Manishh wrote:

ok i was wondering, how abraker gonna recover his account

get a new email and contact ppy

Manishh wrote:

HoosierTransfer wrote:

Manishh wrote:

ok i was wondering, how abraker gonna recover his account

get a new email and contact ppy

like forget the previous account for forever?

KatouMegumi wrote:

itt: discord bad

eblf2013 wrote:

Update

Death wrote:

I feel like this should be common sense, but I guess it's not. Don't provide links to malware here. If people are interested, use PMs or preferably a different platform please.

1. The EXE file has a Node.js icon. The version of Node.js is also written in the resources section; I can only remember the major version number 14.
2. The program is ran as a command line app. Once it is run, it opens a terminal window, minimizes it, kills your browser and Discord, then reopens Discord. The reopened Discord appears to work normally, but I believe that they injected their code in it.
3. The terminal window did not close while the malware is running. My theory for the reason behind is that the terminal window, conhost.exe, is the trojan's parent process, and closing the terminal window kills the trojan. I can't preclude the possibility of installing an operating system service, though.
4. Opening the file using a plain text editor, you can find long pieces of plain JavaScript embedded in the middle and at the end.
5. You can see the variables PAYLOAD_POSITION and PAYLOAD_SIZE in the script at the end. Doing a Ctrl+F search and you have something more interesting...In the JavaScript data in the middle of everything, the exact same variables are assigned a number.
6. Combined with variable names, we have located the actual package that does the dirty work. An invocation of the Unix command dd, and the package is extracted.
7. The trailing script should not be discarded yet...The package itself does not contain any info on how to extract from them, and it is in the trailing script. The data is also stored in a very easy to access location -- at the very end of the script. These data gives away the location of each file in the package, and (deduced by analysis of the script) also gives away the compression algorithm used for each file.
8. While the package contains many files, it turns out that many of them are dependencies, which I promptly ignored. (Should the actual script portion consist of more files, I would write a script to extract the files.) I used dd to manually extract the core script file, a dependency listing, and a JSON containing a key to somewhere.
9. Unfortunately the script is compiled to V8 bytecode, which impeded further analysis as I can't find a good decompiler. I suspect however that it is a GitHub-sourced stealer with minimal modifications.

McEndu wrote:

Let me summarize the current findings:

1. The EXE file has a Node.js icon. The version of Node.js is also written in the resources section; I can only remember the major version number 14.
2. Opening the file using a plain text editor, you can find long pieces of plain JavaScript embedded in the middle and at the end.
3. You can see the variables PAYLOAD_POSITION and PAYLOAD_SIZE in the script at the end. Doing a Ctrl+F search and you have something more interesting...In the JavaScript data in the middle of everything, the exact same variables are assigned a number.
4. Combined with variable names, we have located the actual package that does the dirty work. An invocation of the Unix command dd, and the package is extracted.
5. The trailing script should not be discarded yet...The package itself does not contain any info on how to extract from them, and it is in the trailing script. The data is also stored in a very easy to access location -- at the very end of the script. These data gives away the location of each file in the package, and (deduced by analysis of the script) also gives away the compression algorithm used for each file.
6. While the package contains many files, it turns out that many of them are dependencies, which I promptly ignored. (Should the actual script portion consist of more files, I would write a script to extract the files.) I used dd to manually extract the core script file, a dependency listing, and a JSON containing a key to somewhere.
7. Unfortunately the script is compiled to V8 bytecode, which impeded further analysis as I can't find a good decompiler. I suspect however that it is a GitHub-sourced stealer with minimal modifications.

I am going to put it in a virtual machine some time later.

eblf2013 wrote:

Update

Cerno wrote:

my dumbass cant comprihend whatever tf yall are on about but aight

Aireunaeus wrote:

is that me or is the ot-chat back again?

Clicky- wrote:

i have a theory that McEndu is probably the hacker

ColdTooth wrote:

Clicky- wrote:

i have a theory that McEndu is probably the hacker

I have a completely different theory that may blow everyone's minds here.

ColdTooth wrote:

Clicky- wrote:

i have a theory that McEndu is probably the hacker

I have a completely different theory that may blow everyone's minds here.

1. The malware process calls itself Node.js JavaScript Runtime.
2. The malware requires conhost to run as intended. If the new Windows Terminal is used as the default console program (in place of conhost), the malware would only minimize and fail to go to the background.
3. Once it goes into the background, it crashes and reopens Discord. After reopening Discord (now with malicious code injected), the Node.js process exits.
4. Until you terminate Discord, everything works fine...but on the next time you open it, any trace of you having logged in would be gone! The QR code also takes infinitely long to load -- acceptable in the communist internet (of China), but definitely weird in America and Europe.
5. Task Manager reveals no new startups other than the hijacked Discord.
6. You can no longer trust the Discord on the machine. For your safety, reboot, delete the entire Discord folder, then download a fresh installer.
7. One last thing...Quake II ran smoothly on the virtual machine.

Serraionga wrote:

hahaha what

i struggle to believe abraker actually made such a blunder

like, why the fuck would you click random links from strangers in [Current Year]. phishing scams have been a thing long before any of us were born, and people still fall for them somehow

Manishh wrote:

good person, if someone will say try my game I will try it

1. AppX Deployment Service
2. Base Filtering Engine
3. Client License Service (ClipSVC)
4. CoreMessaging
5. Security Accounts Manager

Serraionga wrote:

hahaha what

i struggle to believe abraker actually made such a blunder

like, why the fuck would you click random links from strangers in [Current Year]. phishing scams have been a thing long before any of us were born, and people still fall for them somehow

McEndu wrote:

Serraionga wrote:

hahaha what

i struggle to believe abraker actually made such a blunder

like, why the fuck would you click random links from strangers in [Current Year]. phishing scams have been a thing long before any of us were born, and people still fall for them somehow

I think abraker actually got the thing from an hijacked account of someone close to him
and the chain goes on terminating at the actual stupid guy making the blunder

ColdTooth wrote:

McEndu wrote:

Serraionga wrote:

hahaha what

i struggle to believe abraker actually made such a blunder

like, why the fuck would you click random links from strangers in [Current Year]. phishing scams have been a thing long before any of us were born, and people still fall for them somehow

I think abraker actually got the thing from an hijacked account of someone close to him
and the chain goes on terminating at the actual stupid guy making the blunder

Still a massive blunder imo, shouldn't even trust close ones or yourself, let alone have them ask the whole ordeal of them hijacking your account w/ a "pls test me game".

How do people fall for that still, really baffles me.

McEndu wrote:

Set my virtual machine up, would destroy it now

(Also want to play Quake II in it, because VirtualBox has some neat 3d acceleration in place)

Also interested in how well can the script kiddie speak chinese (please send him 我想聴你説一句中文，可不可以喵？)

McEndu wrote:

Test using a virtualized Windows 10:

1. The malware requires conhost to run as intended. If the new Windows Terminal is used as the default console program (in place of conhost), the malware would only minimize and fail to go to the background.

Serraionga wrote:

hahaha what

i struggle to believe abraker actually made such a blunder

like, why the fuck would you click random links from strangers in [Current Year]. phishing scams have been a thing long before any of us were born, and people still fall for them somehow

eblf2013 wrote:

Karmine wrote:

We still have NEOS

Manishh wrote:

Karmine wrote:

We still have NEOS

No, thats for game night i think

Manishh wrote:

Karmine wrote:

We still have NEOS

No, thats for game night i think

Karmine wrote:

Manishh wrote:

Karmine wrote:

We still have NEOS

No, thats for game night i think

But that hasn't happened a single time since I joined lol

Scyla wrote:

The last time i clicked some suspicious link, my facebook sent everyone porn links

Scyla wrote:

The last time i clicked some suspicious link, my facebook sent everyone porn links

Scyla wrote:

The last time i clicked some suspicious link, my facebook sent everyone porn links

Scyla wrote:

The last time i clicked some suspicious link, my facebook sent everyone porn links

silmarilen wrote:

Where were you when abraker was kill?

abraker wrote:

Guys I am back, and been back for a couple days now. I've let select people know in advance so they could report the current server owner, but at this point I think it's going to be a while till Discord decides to do anything about it, if at all. I feared having people talk about me being back in OT!neus would cause the server owner to take some action, possibly deleting the server. As easy as it is to make a new server and tell you guys to migrate over, the server's history is not something that is replaceable and I'd hate to loose that.

Sorry to Poly for receiving the silent treatment. You should def not have ran that thing. Manishh, I'm sure the current guy could make you mod if you paid them.

Speaking of the current guy, the server owner is an alt that gets planted in each server they take over and then wait for the original owner to beg for them to get the server back. Discord has a process for transferring server ownership, but it requires that guy to be inactive for at least a month:



So the current plan is to sometime later "beg" them for the server back so they can offer a price. At that point I'll have a valid case to report them for attempting to sell the server.

Scyla wrote:

hacker guy here

abraker wrote:

For those who know who Railey2 is, great. For those who don't also great. I wouldn't expect anything less from him, so enjoy

How troll ft. Railey2

abraker wrote:

For those who know who Railey2 is, great. For those who don't also great. I wouldn't expect anything less from him, so enjoy

How troll ft. Railey2

Stomiks wrote:

abraker wrote:

For those who know who Railey2 is, great. For those who don't also great. I wouldn't expect anything less from him, so enjoy

How troll ft. Railey2

How long did he keep that guy preoccupied?

abraker wrote:

For those who know who Railey2 is, great. For those who don't also great. I wouldn't expect anything less from him, so enjoy

How troll ft. Railey2

abraker wrote:

For those who know who Railey2 is, great. For those who don't also great. I wouldn't expect anything less from him, so enjoy

How troll ft. Railey2