Website that we were running was under DDOS couple of years ago, what we did is we took ips of servers that made ddos. Then we scanned the ports, found vulnerability in the application that was running on it then get into the server using this vulnerability. We checked open connections and found one used for command and control server (irc server) then we listened to irc channel. DDOSers were talking private things on that channel... Then we entered their channel and disabled all their bots using their own software that we got source from link pasted on their channel. Then we confronted them, period of silence after they have read what we wrote was priceless. They never ddosed us again.
Thanks to domaintools.com - I also found that the guy (seemaexports3@gmail.com) used to own domain: bdmtsteel.com<p>I also find similarities between above domain and these:
transitoin-asia.com
seabunker.net<p>See this:
<a href="http://imgur.com/tsxqwiQ" rel="nofollow">http://imgur.com/tsxqwiQ</a><p>If someone wants to do more research - would be fun to dig deeper.
Is the header sticky for anyone else? It seems to take up ~30% of my screen (Windows 7, Chrome Stable) [0].<p>[0] <a href="http://puu.sh/pNYUH/d42d8395fc.jpg" rel="nofollow">http://puu.sh/pNYUH/d42d8395fc.jpg</a>
I've done this a few times for fun, simply search YouTube for a "game code generator" or something like that, take your pick, download their magic "tool" from the link in the video description and get disassembling with ILSpy [1]. A ton of these "account stealers" are written in VB.NET and seem to be generated from a template.
Remember to stay safe and use a sandbox or virtual machine when dealing with malicious code.<p>[1] <a href="http://ilspy.net/" rel="nofollow">http://ilspy.net/</a>
That's a great little story, interesting to read how these sorts of scams are carried out, but I also found the code analysis and decompilation tale fun!
I just hope someday the general public realize what a poor job Microsoft has done regarding security on Windows operating systems and embrace other (and more promising) alternatives
> It also attempts to steal password manager credentials and Windows keys.<p>Ugh I hate reading this. I keep everything in my password manager. If I lose that I'm hosed. I wish more sites supported 2FA.
a few questions I'm wondering about, if anyone can help:<p>- how do those PW stealers work? are they similar to the Steam one, where it'd delete existing creds and then sniff newly entered ones?<p>- can this thing detect certain apps like FileZilla and then say "user entered <FTP site creds>" and send individual fields, and is that what is meant by supporting say FTP and FileZilla?<p>- what does PHP support mean? maybe looks for common stuff like php.ini, various other conf files like FPM, and tries to find DB/cache connection creds?<p>there's one other thing I'm wondering about, which is the light/easily crackable encryption of the keylogger's internals, and I vaguely remember reading about Google's encryption on the new recaptcha and people talking about all this stuff like complicated encryption routines baked into the client side JS that I really didn't understand except at a handwavy level, and wonder if that's the kind of thing some, say, intelligence/espionage outfit could use.<p>very interesting/engaging (fun) article, all in all, for me. and I appreciated the understatement of the (well-deserved) plug at the end.
Using Volafile to host the keylogger executable seems like a pretty bad choice considering that this website will delete your files after only 2 days. Or maybe this shouldn't surprise me so much considering the "skills" of the attacker.