OSS Project pushed malware in an update, which wipes your disk if you happen to have Russian or Belorussian IP address - Kotaku In Action 2

posted 2 years ago by Senketsu 2 years ago by Senketsu +126 / -0

104 comments download

104 comments share download save hide report block hide replies

You're viewing a single comment thread. View all comments, or full comment thread.

Comments (104)

sorted by:

▲ -19 ▼

– weezkitty -19 points 2 years ago +1 / -20

While this is egregious, it doesn't wipe your disk. It writes a text file to the desktop.

permalink save report block reply

▲ 7 ▼

– JustHereForTheSalmon 7 points 2 years ago +7 / -0

From the CVE:

The maintainer removed the malicious code in version 10.1.3.

permalink parent save report block reply

▲ -3 ▼

– weezkitty -3 points 2 years ago +2 / -5

I looked through the change log in the module and didn't find it anywhere

permalink parent save report block reply

▲ 18 ▼

– JustHereForTheSalmon 18 points 2 years ago +18 / -0

It was deleted.

Here's a backup that was also helpfully de-obfuscated. It also contains his API key to the geolocation service.

permalink parent save report block reply

▲ 10 ▼

– fauxgnaws 10 points 2 years ago +10 / -0

// A 50% chance that all of your files will get overwritten.
// It's actually 62.5%, somehow. -Seq
if (Math.round(Math.random() * 4) > 1) return;

x4 makes the range [0,4] so (1,4] is 75% of range. Rounding down [1,1.5) to 1 is 1/8th of total range made not >1. 75% - 12.5% = 62.5%

Oiginally written by Brandon Nozaki Miller

Fuck Joe Brandon

permalink parent save report block reply

... continue reading thread?