Hacker infects 18,000 "script kiddies" with fake malware builder

bleepingcomputer.com

203 points

emschwartz

a day ago


88 comments

junon a day ago

This happened a lot on old gaming forums where hacks were being produced.

When I was much younger I looked up to a game cheats writer on an old forum since he taught me about how they worked, which I found extremely cool (still do!). It actually formed my initial interest in security.

I asked if I could help somehow, as all young, eager noobs at the time did, and to my surprise he said yes. He wanted to track the licenses he sold to which accounts via IRC. The game would boot, hacks get injected, hacks connected to IRC and would interact with an mIRC bot to check them on his own machine. That was my first foray into socket programming and protocols, too.

A while after that, I learned my code had been shared with another cheats maker (not itself a problem for me) when I was contacted to add DCC SEND support, which allowed sending files via IRC. I don't remember if I came to the conclusion myself or if it was explicitly stated, but either way, the objective was clear, and I refused. I felt bad, had learned my lesson, and never contributed to that scene again.

That was in ca. 2006 or so. This has been going on for a long, long time.

  • TheJoeMan a day ago

    It’s okay, my brother’s way of getting hooked on programming was downloading those types of cheats for Counterstrike, and reverse-engineering them to strip out the bad functionality. It’s not so much keyloggers as running into the cheat creator in a game, and they get mad and say “I’m going to remotely crash your PC watch!” and then getting even more mad when it doesn’t work.

    • Loughla a day ago

      Counterstrike was my first ever introduction to real life cheating. We used to do LAN parties and play mostly that. One guy came and talked about how good he was and, to his benefit, he was really really good.

      Then when the guys who were taking a break started watching him, they saw that he was tracking players as they went across the other side of the map, and his gun was firing as soon as they were in view. Headshots every time.

      It blew my mind for two reasons.

      1. It was possible.

      2. This was a party with zero point of winning. There was no prize. Why cheat?

    • junon 21 hours ago

      Yep. I learned Java just to hack a math program in middle school. It had a hint button that would eventually give you the answer but would dock your progress by quite a bit if you used it at all.

      I modified it to run the "solve answer" method without reporting back to the server at a random interval that was just human enough, and played Minecraft in the meantime.

      In my defense, I knew the material just fine. The program was very anal about whitespace, parenthesis, order of terms (even if it was inconsequential), so most of the homework time was spent fighting with it instead of testing my math skill. The grade for it was also pass fail, whereas the tests were what mattered (and I dared not cheat on those).

      Ended up learning a valuable skill at the same time, so I still consider it a win.

  • doublerabbit a day ago

    Same kind of kidhood. At school a social reject but during the night a script kiddie shovelling content across IRC and FTP sites.

    • danielbln a day ago

      Oh hi, another one of those checking in. IRC, Grim's Ping, FTP/FXP (preferably the WinNT machines where files could be made undeleteable). Those were the days.

      • dfsegoat a day ago

        Oh man, FXP, couriering (the original “currying”!) and 0day drops…

        This thread is such a solid shot of nostalgia, and why I love HN.

  • gxs a day ago

    Honestly, to a degree I chalk this up to boys will be boys.

    I had my own stint doing this type of stuff on my different schools networks growing up and it too spawned an interest that’s led me to an entire career.

    You shouldn’t feel bad - you learned, you got your kicks, and developed a conscious once you knew better. If dealing with some hacks in some of the games I played meant some curious kid got their start with programming it was well worth it.

    What does piss me off are the people who turn it into a living to the extent where it becomes a plague - Warzone is a perfect example. Sure, the game still makes money, but the actual “scene” is fed up with it. I get that these same type of people/hacks are what you may have briefly been a part of, but it’s still not the same thing.

    A kid contributing for fun is different than orchestrating the entire thing.

    My take on it at least.

    • jdblair 11 hours ago

      I'm having memories of being asked to remove "the curse words" from the cracker startup screens on AppleII 80s games and stuff. These were almost always graphics buffer files (memory dumps) and the fix was hardly hacking (find file, edit in paint program) but it made me feel l33t.

      I don't know how any software houses made money with the floppy copy scene in the 80s.

      • gxs 4 hours ago

        I know what you mean

        Like back when all you had to do to get banned software to run on your school’s computer was rename the executable to notepad.exe - I’ll be damned if I didn’t feel like neo in the matrix at the time

jamal-kumar a day ago

They talk about this like it's a new phenomenon but I distinctly remember this being super common in the windows 95 to vista days. Like I went to some kid's house and he would do something like try and tell everyone he knew how to 'hack google' and he used use some obviously sketchy as hell tool which just ran a whois on their domain to show their address, and this was all the evidence that he was 'hacking', and we all clowned on him for it and how he probably just installed a virus on himself. He ended up finding some extremely obvious viruses some kid thought would be funny to leave on a network share at school called something like 'sexyporn.jpg.exe' and getting expelled for being daft enough to execute them

  • lupusreal a day ago

    We used to run `tree` and tell the computer lab teacher we were hacking the school, government, etc. It always got a strong reaction out of her, she was a good typing instructor (and a genuinely nice person) but was out of her depth with computers. What little shits we were.

    • seattle_spring a day ago

      Me and a buddy got expelled for "hacking the school network" by using "net send" to interrupt our teacher's presentations.

      • Uehreka a day ago

        Oh man, the days before blocking net send was a common school sysadmin practice…

        Back when I was a highschool freshman (2004-05) I wrote a batch script that would fire off net sends to everyone in the computer lab in rapid succession in an infinite loop, then just sort of left it on a shared drive with a conspicuous name. Sure enough, a few days later, someone ran it out of curiosity and got in trouble, but of course the file had my username in the metadata, and my computer teacher was like “Chris, you knew what you were doing, don’t do this again.”

        It was the kind of “good clean fun” sort of prank that doesn’t get you in hot water or suspended, but was hilarious to watch play out.

        Edit: Just re-read and saw that your friend got expelled for doing basically the same thing I did. That sucks. I’ll note that I went to an IT-focused votech school, so I think a lot of folks had a better sense of perspective as to how serious net send pranks actually were in the grand scheme of things.

      • jamal-kumar a day ago

        That's wild, because the only way we were able to mount network drives that had stuff hidden on them by other students in the know was "net use". The drives would be visible to us on the network but if we merely clicked on them it would give us access denied, but a little two line bat script would let us mount and open the drives with no problems. Must have been windows 2000 server badly configured. I remember some other kid getting in trouble for the net send thing but I think he was being obscene to someone else who got mad enough... Everyone saw the obvious viruses and didn't click them but that one kid. As soon as he did that they found our little secret network share and closed it off. We definitely referred to him as a 'skiddie' after that lol

        We just used it for a place to run scorched earth from on the whole network without having to download it to our home folders where it'd get noticed and punished

      • sbarre a day ago
        4 more

        Expelled or suspended? Expulsion seems disproportionate for that kind of prank.

        • vrighter a day ago
          3 more

          you wouldn't believe how scary computers were to most people. Once i added a batch file with the shutdown command in the startup folder of one computer, as a prank (trivially fixable by booting into safe mode) and got banned from the computer rooms because "i compromised every computer in the school" apparently.

          They never discovered the rats we actually had installed on all their computers. They were still there years after I left, until they upgraded the computers.

          • sbarre 19 hours ago
            2 more

            I was in high school in the late 80s and early 90s, I'm well aware. :-)

            We (a few friends and I) were basically the Novell Netware admins because our school didn't have a full-time computer tech and none of the teachers knew anything about it. We convinced them to let us help them in exchange for letting us read the manuals and tinker around, and we actually did help with problems and troubleshooting, mostly printing if I remember.

            They never figured out it meant we also had access to the teacher-only folders though.

aaza a day ago

Years ago when DDoS tools were being distributed on 4chan I fixed a bug in one of them and redistributed it there.

My fixed version also had the handy feature of having a 50% chance of wiping the user's entire drive if they actually used it as part of a DDoS.

It was pleasingly brutal. First it would zero out and delete all files in the user's home directory, and then if it had access to the hard disk device it would overwrite the sectors directly from the start onwards. If not, it would iterate through all other files and corrupt whatever it had access to.

I'm satisfied to report that hundreds of script kiddies had their data irreversibly destroyed before my handiwork was noticed. I hope it was a valuable lesson to them.

  • junon a day ago

    Was this a particular tool that required charging up a lazer, by chance?

    If so, I might have been one of the people you taught a lesson to. :D

    • wrs a day ago

      How did you feel about it? Were you dissuaded from further script-kiddieing?

      • junon a day ago
        2 more

        Well, yes and no. I was more interested in what it did and how it worked rather than 'using' it, I just remember it causing a lot of problems. But yes, this was around the time I learned not to run random executables I found on the internet.

        • throwaway5752 a day ago

          I was going to ask you the same thing as wrs, and would have answered similarly. Overall I am grateful for people like aaza for helping others to understand how it felt to be on the receiving end, and also a lesson about trust and maturity. "There is no honor among thieves" is a facile interpretation, but over time I've come to feel like this is necessary tough love for certain problem kids who might be too clever for their own good at certain points of life.

  • codechicago277 a day ago

    I hope you realize what a god complex you had at the time thinking you had the right to harm others just because they were doing the same. This code of ethics is the source of hate in the world. I guarantee these people didn’t learn their lesson but instead started doing the same thing to others even less powerful than themself.

    • tgv a day ago

      It depends on your world view. There was also harm prevented, so that might cancel it out. You could also see it as a punishment, though not delivered by the judicial system. Your solution seems to be to do nothing. That can be construed as silent approval. So it really depends on your world view.

      • zmgsabst a day ago

        This depends on who the DDOS was targeting, otherwise the DDOS was legitimized by this logic (targeting bad people) and this becomes bad again (harming good people to aid bad people).

        Of course, that was never considered nor was collateral damage because the ethical justification is just a pretense to excuse harming others.

    • c0redump a day ago

      > I guarantee these people didn’t learn their lesson

      Your argument totally falls apart here, because you’re just outright wrong. There are a ton of kids who are curious would-be hackers that turn away from the dark side forever after getting pwned while trying to do something sketchy.

      • zahlman a day ago
        2 more

        > There are a ton of kids who are curious would-be hackers that turn away from the dark side forever after getting pwned while trying to do something sketchy.

        ... How do you know?

        • genewitch a day ago

          Feel and vibes. Or anecdote of 1.

    • simplify a day ago

      "god complex" is very reaching. No one got physically hurt in this scenario. Also unlikely you can "guarantee" this didn't teach anyone any lessons.

      • amelius a day ago

        > No one got physically hurt in this scenario.

        This is not certain.

    • oliwarner a day ago

      Anarchic dickbaggery is brand 4chan behaviour. You don't go there expecting ethics.

      More to the point, I don't understand why you want to spank them for this now. Kids do stupid stuff and this is far less stupid and dangerous than a lot. Indeed a lot of no-effort hackers get burnt on this stuff and stop. I know people who tried and failed. Adding peril to the process scares off a lot of would-be bad behaviour.

    • throwaway5752 a day ago

      Zeroing out home, the boot sector, and everything else would cause no harm by the same ethics logic that a DDOS causes not harm. It is just information. This seems like the poster is a hero, because he prevented wrongdoers from causing harm to potentially innocent people. There's not an ethical way to execute a DDOS. It targets someone, and the botnet is compromising and stealing compute from someone.

      It taught them a valuable life lesson about trust and humility, and maybe even ethics and the risks of criminal activity in very mild fashion. Recovering from being hacked might stir feelings of empathy for their victims and lead them to learn valuable forensics skills.

      Stories like this are part of the personal evolution of a lot of white hats. I think aaza did a real service to the world.

  • hildolfr a day ago

    You're bragging about a cyber crime.

    One wonders how many parents-of-script-kiddies were affected, having their data or work destroyed by blind retribution for having naive children.

    • threatofrain a day ago

      One wonders how many parents of non-script kiddies were affected by these destructive criminals, or how many of these script kiddies are professionals making a living.

      This story concerns 18,000 script kiddies. Imagine the scale of impact we're talking about when magnified to their victims.

      • wink a day ago

        I think you just can't compare those 2 scenarios, 25 years apart.

        Back then: We got the 2nd computer in the household in 97, exactly so I would not have to use the family (actually business) computer anymore.

        Now: I mean ok, maybe it's already swung past a certain point that there is actually only one non-mobile device in the home, but the chance that it is the targeted script kiddie's machine (and not the important family computer) is so much higher.

      • serf a day ago
        8 more

        why does this logic make sense to anyone, ever?

        someone does something bad -- by all means that gives whoever carte blanche to do whatever is just as bad or equally so to the victimizers.

        This doesn't make sense -- even less sense when you realize that 'script kiddies' is anyone who ran an executable from an image board; you couldn't ask for a lower bar.

        Half the people who downloaded the thing probably didn't even know what the fuck an IP address is, they probably shouldn't be the ones saddled with taking on the entirety of repercussion that was meant for the person(s) who wrote the tool.

        tl;dr : I bet half of the '18,000' people were 11 year olds who typed 'google.com' or their least favorite AIM screen-name into the target criteria of this already half-assed 'tool', yet people act righteous for wiping their hard-drives as if they were the real culprit.

        read : wiping the not-culprits parents hard-drives in many cases, I would bet.

        • voakbasda a day ago
          5 more

          First, parents are responsible for the actions of their children.

          Second, we assign blame to the person that pulls the trigger, not the maker of the gun.

          Third, these people are likely to never face any other form of punishment.

          Personally, I think these facts justify this level of retribution. That doesn’t make it “legal” or “right”, but I definitely do not think it is “wrong”.

          • celticninja a day ago

            Just because something is legal it doesn't make it moral and just because something is illegal it doesn't make it immoral

          • jrflowers a day ago
            3 more

            > Second, we assign blame to the person that pulls the trigger, not the maker of the gun.

            The analogy here is more akin to a booby trap than a gun, in which case we do assign the blame to the person that made the contraption intended to harm the unwitting user.

            That aside, considering once it was discovered how the drive wiper that OP (aaza) claims to have made works, it basically just became a drive wiper that any bad actor could drop into a target system and run, “I intentionally distributed malware that I think, but have no way of verifying, only hurt The Wrong Sort Of People” isn’t just illegal and wrong, it’s stupid.

            • nulld3v a day ago
              2 more

              > That aside, considering once it was discovered how the drive wiper that OP (aaza) claims to have made works, it basically just became a drive wiper that any bad actor could drop into a target system and run, “I intentionally distributed malware that I think, but have no way of verifying, only hurt The Wrong Sort Of People” isn’t just illegal and wrong, it’s stupid.

              Imagine copying an entire binary onto a system just so you don't have to run `cat /dev/zero > /dev/sda`

              • jrflowers an hour ago

                > Imagine copying an entire binary onto a system just so you don't have to run `cat /dev/zero > /dev/sda`

                Imagining script kiddies using stupid software in stupid ways very clearly and easily, also imagining a script kiddie pasting `cat /dev/zero > /dev/sda` into the windows command prompt of the computer he’s controlling with sub7 and getting very frustrated

        • ForOldHack a day ago

          "when you realize that 'script kiddies' is anyone who ran an executable from an image board; you couldn't ask for a lower bar."

          Wow. Just wow.

          I looked at keygens and whacked an entire site of 900+. Not a single one did not have a virus, and some more than one. I kept it as a zoo to test scannets.

          Astalavesta baby.

      • amelius a day ago
        2 more

        With LLMs, everybody can be a script kiddie. Imagine the scale ...

        • wwtl12 a day ago

          Running software from LLM output is like building a bomb with the Anarchist Cookbook.

    • worstan a day ago

      Fucking up the family computer is a formative experience for many techies.

      • te_chris a day ago

        Amen! I still remember the time I tried to install fedora in the late 90’s and set a bios password in the boot loader then forgot it. I was like 11

    • morkalork a day ago

      I'm going to echo the unjustly dead comment:

      >Fucking up the family computer is a formative experience for many techies.

      It's true, I did it myself!

    • throwaway5752 a day ago

      The poster was preventing a crime against innocent parties. His "victims" were the criminals. The script kiddies were responsible for running malware and trying to launch attacks from their parents' computers in this scenario, and they would be the ones responsible for data erasure of others using the same computer.

      In that sense, file deletion is destructive but honest. The poster owned the systems at this point and could have exfiltrated data or used the control of the systems for further attacks. This was decidedly mild.

      • beng-nl a day ago
        2 more

        It’s not black and white, so I won’t argue for black or white, but an important factor to me is: ddos eventually stops and then everything is back to normal; no permanent damage is done.

        • ForOldHack a day ago

          Unless your doctor is waiting on the kidney biopsy, might as well remove the heart and brain.

          Shall I goggle ddos attacks that have cost people their lives?

      • genewitch a day ago
        6 more

        Detonating a bomb is illegal in many jurisdictions, regardless of property damage or injury to humans.

        The person who called this a cybercrime is more correct than people disagreeing

        • throwaway5752 a day ago
          5 more

          They are both cybercrime. I'm not disagreeing with that. But if you sabotage a bombmakers tools and they blow their own household up instead of other innocent people, is it the same thing?

          Let's be very specific: "if they actually used it as part of a DDoS.". This wasn't embedded in warez or cracking tools, it was in botnet controllers, and ran when someone had pulled the trigger to execute an attack.

          • alt227 a day ago
            2 more

            What if the bomb maker lives in a shared house with innocent people, or even in their parents basement?

            Thats a more relevent analogy here, as probably most of those script kiddies were using the family PC which had other other innocent peoples important stuff on.

            • tester457 a day ago

              One home is worth less than dozens of homes that bomb maker can damage. The same is true for script kiddies.

          • genewitch a day ago
            2 more

            you are saying it was "botnet controllers" all the op said was "ddos tool on 4chan" - LOIC wasn't a "ddos" tool. it was a DoS tool. sub7 wasn't a ddos tool. BO wasn't a ddos tool. butttrumpet wasn't a ddos tool.

            A "botnet controller" requires a botnet. The OP made malware. A program, when run, that would delete your files without permission.

            merely having the thought of doing something illegal isn't illegal and afaik the catholics have the only guidelines on how to deal with illegal thoughts, and "delete all the files on their hard disk or otherwise corrupt their system" wasn't in the canon that i saw.

            • throwaway5752 a day ago

              I quote:

              "Years ago when DDoS tools were being distributed on 4chan I fixed a bug in one of them and redistributed it there"

              "if they actually used it as part of a DDoS"

              You are incorrect, they said it was a DDoS tool. You are incorrect about "merely having the thought", it required executing an attack. FAFO. Again, this is part of the personal evolution of tons of security professionals who longer do juvenile stupid shit. Or at least learned how to do so in a hardened sandbox vm.

  • vunderba a day ago

    There were dozens of compromised versions of the LOIC tool back at the height of Anonymous that I'm sure many kids downloaded and in their attempts to "stick it to the man" inadvertently infected themselves.

  • Ekaros a day ago

    Honestly, probably at time pretty affordable lesson in thinking what you run when you download from web, and importance of backups.

meter a day ago

In middle school we had a “computer” class where we’d learn how to type, as well as navigate a computer. This was Windows 2000 days.

As a prank, my friends and I would do the following:

* Hide all the icons on the desktop

* Trigger an error message

* Take a screenshot of the whole screen

* Open the screenshot in MS Paint

* Carefully paint over the error message to say “You’ve been hacked.”

* Change the desktop background to be the screenshot above

* Restore all the icons.

You’d end up with a convincing looking error message that wouldn’t close, obviously.

The next class, the teacher lectured us for 45 minutes on the definition of “script kiddy” vs. “real hacker” and how we should be embarrassed.

This made the whole thing even funnier.

It’s true though, I was a script kiddie.

neilv a day ago

I hadn't heard the term "script kiddie" in a very long time.

But it seems that's most of what Software Engineers do lately, spending most of our coding time figuring out the arbitrary bureaucracy (not fundamentals, nor insightful inventions) dumped on us, by the massive piles of stuff churned out by other people. Such that we understand very little of what we do, and consequently create very little.

Do people still say "script kiddie", or does it resonate a lot differently than it used to, maybe a little too close to home?

neurostimulant 16 hours ago

> Once a machine is infected, the XWorm malware checks the Windows Registry for signs it is running on a virtualized environment and stops if the results are positive.

Many (if not all) malwares do this now. Does this mean you don't need an antivirus when you run windows on a vm because any malware that happen to infect it would kill themselves when they noticed they're running inside a vm?

atum47 a day ago

I saw that back in the 90's when I was a script kiddie myself. Programs that we use to hack others like back orifice or netbus were being distributed infected

  • todd3834 a day ago

    I can confirm this personally as I had an infected version of Sub7. I thought it was so fun to mess with my parents with it until I realized I was now compromised.

    https://en.wikipedia.org/wiki/Sub7

    • myself248 a day ago

      What I saw, as often as not, is that the skiddies using these tools would configure their installer/dropper and start sending it to victims, but accidentally run it on their own machine too. Meaning their own machine was now listening for control connections.

      Which meant all a potential victim had to do was accept the file, not run it (renaming the extension was a good first step), and note the IP address of the skiddy who sent it to them. Inspect the file to see the port and password configured therein, run the control program, connect back to the origin IP with the given port and password, et voila.

      I wonder how many of them thought their tool was backdoored, not realizing it was they who had compromised themselves.

    • scrapcode a day ago

      Ah, the good ole' days of opening my friend(s) cd-rom drives. I was a wizard.

    • meroes a day ago

      Seems like every installation had a backdoor password hardcoded too from that article.

  • bdcravens a day ago

    I remembered playing around with Back Orifice, and absolutely knowing better, but being the kid (early 20s) who couldn't help but see "what will this do", turned on the server. Within seconds someone began wiping c:/Windows/system lol.

billy99k a day ago

Many years ago, I created a 'gold hack' for fun for a popular game when I was in highschool. I reverse-engineered the 'encrypted' (which was basic letter shifting) password stored for the account and my hack basically just decrypted the password and emailed me the username/password.

I got 100s of accounts, but never really did anything with them.

p3rls 17 hours ago

Who didn't run whatever they could find in "steal this computer book" section of the library when they were a kid? One publisher could have taken us all out. I was accidentally running the .bats on my own computer half the time already.

jimt1234 21 hours ago

> ...checks the Windows Registry for signs it is running on a virtualized environment and stops if the results are positive.

That caught my eye ^^^ Is there any virtualization software that makes VM environments indistinguishable from a "bare metal" environment?

sim7c00 a day ago

classic. this has happened not only to script kiddies, many times in the past. build your own tools. it will teach you properly how shit works, elevating your hacking skills and free you from this common risk. Assume there are no trusted sources for hacking tools.

rikafurude21 a day ago

hardcoding tokens seems like script kiddie behaviour to be honest

scaredhana 19 hours ago

Feeling uneasy, I took action and hired an ethical hacker online. It was a decision that changed everything. The hacker worked discreetly, uncovering the truth without raising any suspicions. If you're in a similar situation and need help, you can reach out to +1 (404) 941-6785 for text, call, or WhatsApp inquiries. You deserve to know the truth!

14 15 hours ago

I have trust issues with a lot of software free from random sources. Lots of YouTube videos trying to sell you on all sorts of weird programs all you have to do is go to some random weird site and download and run as administrator and ignore all the red flags.

For me I wanted an autoclicker for a few things. All sorts of sketchy sites and YouTubers recommending downloading some crap others would say is a virus and others would say are a false positive. I ended up finding a tutorial on how to write a python program and made my own autoclicker.

This will be a lesson these script kiddies probably needed. They are lucky as it does not seem nearly as bad as it could be in terms of malware.

sylware a day ago

Shall we talk about all those hacker systems protected on clouds? (microsoft|aws|gogol|akamai/linode|cloud.cn|etc)

scaredhana 19 hours ago

Once you identify your needs, it's crucial to find a skilled mobile hacker for hire who can deliver results. Keep in mind that not every hacker has your best interests at heart. Choosing the wrong one could lead to unsatisfactory outcomes or, even worse, compromise your personal information. Prioritize hiring a hacker with extensive experience in the specific service you require. Whether it's data recovery, phone hacking, or online investigations, the ideal hacker will have a demonstrated track record of success in their field. I confidently recommend tomcyberghost@gmail.com private investigator as the top choice for a competent hacker for hire.