+- AiOwares (https://www.aiowares.com)
+-- Forum: The Daily News (https://www.aiowares.com/forumdisplay.php?fid=5)
+--- Forum: Global News (https://www.aiowares.com/forumdisplay.php?fid=10)
+--- Thread: Vigilante malware blocks victims from downloading pirated software (/showthread.php?tid=2822)
Pages:
1
2
Vigilante malware blocks victims from downloading pirated software - Pz_Miko - 06-18-2021
A vigilante developer turns the tables on software pirates by distributing malware that prevents them from accessing pirated software sites in the future.
Threat actors commonly use pirated software and fake crack sites to distribute malware to unsuspecting users who think they are downloading the latest game or movie.
Malware distributed via these methods is typically information-stealing trojans, ransomware, or crypto miners that can be used to generate value for the threat actor.
In a new report, SophosLabs shares how a vigilante malware is being distributed that prevents pirates from accessing the most popular copyrighted content torrent site, The Pirate Bay.
"In one of the strangest cases I’ve seen in a while, one of my Labs colleagues recently told me about a malware campaign whose primary purpose appears to stray from the more common malware motives," explains SophosLabs Principal Researcher Andrew Brandt in the new report.
"Instead of seeking to steal passwords or to extort a computer’s owner for ransom, this malware blocks infected users’ computers from being able to visit a large number of websites dedicated to software piracy by modifying the HOSTS file on the infected system."
According to Brandt, the new malware is being distributed through Discord or pirated software torrent sites. On Discord, the malware is distributed as standalone executables pretending to be pirated software.
On sites like The Pirate Bay, the malware is being distributed in a similar way to other torrent files in the sense that they contain readme files, NFO files, and shortcut files back to thepiratebay.org.
However, many of the files contained in these torrent archives serve no purpose and are only added as filler to impersonate your typical pirated software/movie torrent.
"Looking more closely at these files bundled with the installer, it’s clear that they have no practical benefit other than to give the archive the appearance of files typically shared over BitTorrent, and to modify hash values with the addition of random data," says Brandt in his report.
Once a user runs the malware executable, it will modify the Windows HOSTS file to add numerous entries that point to 127.0.0.1 for sites associated with The Pirate Bay.
After adding these HOSTS entries, when a user attempts to access one of the listed sites, they will instead be redirected to their local host and be unable to connect to the site's actual IP address. This effectively blocks access to the listed sites that are distributing torrents for copyrighted content.
To make matters worse, when the vigilante malware is executed, it will connect to a remote host under the attacker's control and send the name of the fake pirated software that has infected the user.
As web servers usually log a visitor's IP address, the attacker now has both the pirate's IP address and the name of the software or movie that they attempted to use.
While it is unknown what this information is used for, the threat actors could share it with ISPs, copyright agencies, or even law enforcement.
The attackers could also use this information in further attacks, such as email extortion campaigns where the attacker threatens to reveal the user's illegal activity if they don't pay a small extortion demand.
Brandt told BleepingComputer that this malware campaign was live between October 2020 and January 2021, when the attacker's site went offline.
According to Brandt, the malicious torrents have also stopped being distributed, likely after users stopped seeding them after learning that the files were malicious or fake.
While rare, vigilantes have taken justice in their own hands in the past by hacking into Netgear to remove malware, distributing malware to secure IoT devices, releasing weaponized version
Link to Article:
Code:
https://www.bleepingcomputer.com/news/security/vigilante-malware-blocks-victims-from-downloading-pirated-software/RE: Vigilante malware blocks victims from downloading pirated software - myhellonearth - 06-25-2021
what the hell, lol. freaking white hats
RE: Vigilante malware blocks victims from downloading pirated software - Pz_Miko - 06-25-2021
(06-25-2021, 08:12 AM)myhellonearth Wrote: what the hell, lol. freaking white hats
There are many Jon Lech Johansen, Jeff Moss, etc
RE: Vigilante malware blocks victims from downloading pirated software - sgaudou - 06-25-2021
This means they will be protecting us :DD
RE: Vigilante malware blocks victims from downloading pirated software - Pz_Miko - 06-26-2021
(06-25-2021, 03:12 PM)sgaudou Wrote: This means they will be protecting us :DD
Reminds me of this case, where this WH talked to a man through a NEST cam.
Code:
https://iottechnews.com/news/2018/dec/18/white-hat-hacker-speaks-iot-camera/RE: Vigilante malware blocks victims from downloading pirated software - BALTAGY - 10-27-2021
(10-27-2021, 03:00 PM)KOF_TEST1 Wrote: ok, thanks for the news.Please use thanks botton instead and read the rules here
Thanks
RE: Vigilante malware blocks victims from downloading pirated software - nodnar - 10-28-2021
interesting story. but it serves to get me mostly suspicious..
now lets see why this happens..
well; what is the motivation of this psychotic quest? not money.you can get more
from malware like ransomware or bitcoin mining,with less work. so lets assume
that you are 100% successfull. what happens? these vigilante warez will get progressively
less propagation. it will get a smile on the wicked faces of all the copyright boys, of course.
especially if you make them a nice xmas present like the ip-adress of the pirates..
so they can send 800 euro invoices to them. and it will fail dismally in a court of law,
however, as any lawyer can tell you, for if the vigilante trick worked in the first place,
the download has failed.and it is only an unsuccessfull attempt to steal copyrighted
warez; and attempts are totally innocent, unless they are successful.
so the wicked pirates will not be convicted to foot the bill.
so; long story short; the morale; this smells of a hoax. [perhaps sophos found their
stuff on the pirate bay once too often..] just my two cents.
RE: Vigilante malware blocks victims from downloading pirated software - froggyw5523 - 11-13-2021
The question is, do regular AV/AM software block this or not?
RE: Vigilante malware blocks victims from downloading pirated software - rigok9 - 11-18-2021
It blocks the IP by using the HOST file redirecting to local address... lol. Amateur
RE: Vigilante malware blocks victims from downloading pirated software - nodnar - 11-18-2021
lol. that`s right; go on thinking of yourself as a pro, and see how much respect you get that way..
i would respectfully suggest that you treat fellow members as you would like to be treated too; with respect.