« first day (1061 days earlier)      last day (2741 days later) » 

12:01 PM
I especially don't like the name
 
With the user name, Yes. Nuke it
 
Even without the username it's still a bit rude
 
@NathanOliver SD report?
I was mildly unsure
 
!!/alive
:(
 
@Tunaki Guess who nuked it before you reported, dear =)
 
12:03 PM
@Tunaki He was alive... 1 hour 2 hours ago :(
2 hours ago, by SmokeDetector
@Henders plz send teh coffee
 
!!/alive
What are we going to do now?!?
 
@Tuna Smokey is down, you're not allowed to get your eyes off SO now
 
@NathanOliver Panic
 
PAAAAAAAAAAANIIIIIIIIIIIIIC
 
AHHHHHHHHHHHHHHHHHHH
 
12:06 PM
attack!!!!!
 
@Hat panic!!1
 
SO will be flooded with spam...
And now the oneboxapocalypse is upon us...
The only thing missing is the flower, and our fate is sealed :|
 
@Tunaki Meh, I had flagged that as NAA. Could've flagged for name deletion rather than a nuke. :/
 
Sam
rip
 
12:11 PM
rene's only love are the bees
Samey \o/
 
Sam
Hi guys
o/
 
Hi, I'm alone -> so guy
 
Hiya Sam
 
See a living NO \o
 
Hiya Sam
 
12:12 PM
YAY, smokey was still alive in the tavern, I rebooted him, and he should be back
!!/alive
 
@Ferrybig You doubt me?
 
Hiya @Bhar @Ferry
 
YEAHHHHHHHHHHHHHH
 
@kayess Hiya
 
All praise Ferrybig <3
 
12:14 PM
and morning peeps. And plops
 
Plop Machavity!
 
plop
 
Sam
plap
 
plop
 
12:15 PM
plip
 
plep
 
pulp
 
@Kyll y u do dis :/
 
Starting and breaking trains. What a nice day.
 
I like trains
 
12:17 PM
@Kyll That's like giving a child candy only to take it away from him :(
@NathanOliver Wait!!.....
 
@Seth Once that's moved to the graveyard, You'll be the train breaker
 
@Seth trains be rollin yo
 
@BhargavRao I came in like a wrecking ball...
 
@Seth Like stealing candy from a baby came about as it is a favorite spearrel past time.
 
@Machavity Aye :p But trains shouldn't be broken mere seconds after being created o.o
 
12:18 PM
@gnat I'm unpinning this since the effort is over as far as the room is concerned. There is one question left, which ought to be salvagable. I know rene is on it.
 
@Seth yeah
 
@NathanOliver Kyll is a cruel spearrel...
 
@Seth Pleonasm.
 
@Seth This is new to you? ;)
 
@Kyll I had to google that :|
 
12:21 PM
@Seth =D
 
@NathanOliver It's always new to me :c I just look at this picture of a happy spearrel, enjoying the sun (maybe looking at dead trains?!), and seconds later he destroys what he created ~10 seconds ago :|
@Kyll ô,ô
 
@Seth He is happy as he is watching the baby cry
 
@Seth And then I hide the bodies...
Now you broke it.
 
Curses!
 
12:24 PM
These ransomware spammers are becoming very creative
 
Did they do something new again?
 
A real looking application mail with a real .zip with 2 real and 1 fake document inside, with a real photo, real return adress, clean scans
The only giveaway is that one of the files in the zip is named : Firstname_Lastname_Application.pdf.js
exactly in such a way that the default winrar file name display only goes to .pdf and you have to extend the column to see the .js
A normal user is easily fooled by this
 
@Seth that is a spearrel for you
 
@Magisch Interesting
 
@ColdFire :-( ..
 
12:26 PM
Interesting indeed
It was even customized to look like an application for our specific open positions
Methinks either boss hired some pentesters or we're being targeted by spearphishing
 
@Magisch Is it good though? Really no giveaways, as in no spelling mistakes, no suspect links, no nothing? O_O
 
So glad to have Smokey back
 
^.
 
@Seth Indeed
No spelling mistakes, references the position we're advertising directly, even has 2 real, clean documents in the zip
non-stock photo, real name, referral from the Arbeitsagentur
 
I'd contact the Arbeitsagentur then @Magisch :)
 
12:28 PM
Its all there the only giveaway is that one damning file extension. And sure enough, its a downloader for a ransomware
 
Ask them to run a BG check on the persons that got that referral :P
 
Thankfully our secretaries are super paranoid and noticed
 
@Magisch Woah. Great!
 
@Magisch We get something like this a couple times a year. I have all my user trained to ask me before the open an attachment if it is from someone they do not know.
 
Never seen such a well done attempt at phishing
I award them 9/10 points for effort, and another 0,5 points for sneaking their virus downloader past a up to date kaspersky installation.
 
12:33 PM
They are getting good. We got an invoice in last week that was so well done AP was going to pay it except is was missing a PO# so they came to me. Looked totally legit.
 
Blessed are our super paranoid secretaries
 
It is sad that we have to be this way but at least they are. It is scary out there on the interwebz
 
I don't like Kaspersky. Does it get past Ms Defender?
 
@Seth Bulk spam is mostly amateur hour. Spear phishing is highly sophisticated and often carried out by state-backed hackers
 
Makes me wonder just what about us is so interesting
 
12:38 PM
@JanDvorak regardless of the outcome, uploading the samples to VirusTotal would be extremely helpful for the wider community
 
@NathanOliver Electric shocks for ignoring the policy proved effective, eh?
 
I guess Kaspersky simply doesn't check Javascript files
 
@Magisch can you upload to VT? virustotal.com
 
That someone took the time to go through our open positions and then write a otherwise super-legit looking application email from an actual professional email account
So they hacked a real persons email just to try and phish us
 
@Machavity I actually started adding subliminal messages in the login script ;)
 
12:40 PM
@tripleee When I get home. I sent a copy to myself out of curiosity
 
@Magisch excellent, thanks!
if you can share the SHA256 for us to see, that would be awesome
example for the EICAR test file virustotal.com/en/file/…
 
@Machavity Dayum o.o
 
Our accountant had an especially freaky one a few months back. Looked like it was from the owner, requesting a bank transfer. Was written just like he'd write one too and we do that sort of thing frequently. Only his presence of mind to call him saved us from losing money
 
@Machavity We got one of those too. Wanted us to wire $50,000 to some international bank.
Like we are not going to double check that.
 
Another question that's willing to spread infections :|
 
12:53 PM
anybody has installed usb 3.0 drivers in laptop
 
I have USB 5.1 on mine.
 
my laptop has no internet connection becoz of drivers and no usb drivers prohibits inserting any usb device
 
Much better. Has integrated soundtracks during transfer.
 
:|
 
@ColdFire What OS are you using?
 
12:55 PM
any idea how to install 3.0 drivers
windows 7
 
@tripleee I've uploaded it to VT
 
And it doesn't have default drivers for a thumb drive?
 
Apparently a fair few scanners are detecting it
Kaspersky proper does too but the email extension checking slipped by
 
Sam
@Tunaki 7.1 over here ;)
 
@NathanOliver no
it is DOS based laptop no drivers
 
12:56 PM
@Magisch that's kinda typical, it's incredible how a 1990s hack like double extensions is still viable
 
i installed windows 7 on it somehow
 
Wow. Does it have a CD ROM drive?
 
yes
 
Well you could always burn the drivers onto a disc and then copy them onto the computer through there
 
@tripleee virustotal.com/de/file/… the report
 
12:58 PM
i dont have a cd
 
@Magisch yay, thanks!
 
need to purchase one :/
my bike is punctured :/
 
@Sam Nice! Does it cook waffles when you're waiting?
 
@NathanOliver isnt there another way
 
Sam
@Tunaki And coffee!
 
12:58 PM
I need to upgrade!!
 
@ColdFire So do you have any working external connections?
 
@Sam 10.0 here which can bake tuna's instantly
 
@tripleee I can get you the JS file source code if you want
And if I can get it onto pastebin without pastebin banning me
 
@NathanOliver nope no lan drivers even
 
You do not have any CD-R's or DVD-R's that you could add the files onto the end of the disc?
 
1:01 PM
@Magisch thanks, I think I can get it from Virustotal directly
 
@tripleee can you?
I just opened it in Notepad++ in a secure sandbox
Looks like highly obfuscated JS code
 
nope NO
 
@Magisch Can you screenshot that? :P Just curious as to how it looks
 
@ColdFire NO is lethally cancerous
 
@Magisch they have a private API for partners which I have access to through work
 
1:04 PM
@tripleee You work for an antivirus vendor?
 
@Magisch .... no comment (-:
I work with computer security, yes
 
HEY EVERYONE. We finally know that tripleee is working for no comment.
 
@ColdFire AFAIK if you do not have working USB and lan is not working then the only thing you can do is put the drivers on a disk and copy them that way. What I assume you need is the motherboard drivers as win& is told old to support your board out off the box.
 
you really risk getting banned from pastebin with that
 
@Magisch Humanity?
 
1:07 PM
And here. We do not want this stuff in the transcript
Please delete
 
Had enough time to visit that
Not posting it again
 
Yeah, pasting a virus and telling people not to execute is like making a nuclear launch button and telling people not to push it
 
Seth wanted to see it
 
@NathanOliver what about installing usb 3.0 from usb in boot mode
 
1:08 PM
I didn't plan on keeping it beyond the grace period anyways
 
@Machavity "Don't push it Trump. Don't push it!"
That'd definitely work
 
@Rubisco I think his staff wishes they could delete the Twitter app from his phone
 
@tripleee Not logged in, thankfully
And our ip adress isn't static
 
@ColdFire Installing it to where? Do you have a linux distro on USB or disk?
 
1:10 PM
@NathanOliver i have a bootable pendrive and computer detect that pendrive if i boot with it
so maybe in installation procedure i can install usb 3.0 drivesr
 
> - What's the big red button over there?
> - It blows the building up
> - Sure? Let me try.
 
@ColdFire OK. So if you add the driver to the pen drive you should be able to boot with the drive and then copy the driver onto the HDD.
As long as it has that option.
 
@Rubisco The Mario 64 meme was better :P
 
I already removed it
Its okay
 
@Machavity The frogginess of this cheeto/man is amazing
 
1:12 PM
@NathanOliver there is no copy option, but when i try to install windows 7 it gives me no device drivers found and ask for driver location so maybe that will work?
 
@tripleee If you get a chance to analyse it I'd love to know which family of ransomware they wanted us to download
:P
 
the only problem is getting the driver 3.0 setup?
 
@ColdFire Can you specify a location on the USB drive?
 
@NathanOliver yes
 
user1228
http://stackoverflow.com/questions/40085195/automated-ruby-script-in-msfconsole‌​ is that how you guys not onebox here? Anyhow, just a lowlife script kiddie. Pls.
 
1:14 PM
@Tunaki Or you get what happened to rene
 
OK. If you can find the USB drivers then what you do is make a folder on the pen drive and up the contents of the driver download in there. You may need to extract the contents of the driver file into that location if it is a single file. What you should be left with is a bunch of files like
Then when setup asks you for the driver you just need to select one of/the only(depends on the driver files) .inf file(s).
 
@Magisch I don't think you are going to get any more analysis than you get from the VT results page
looks like more engines are catching it than earlier, or am I imagining things? currently 11/55
 
@tripleee Thats a shame
 
i.e. "some JavaScript downloader" and what it downloads could depend on a lot of things
 
I may run it on a sandbox to find out then
 
1:18 PM
Am I right that here the `//` is wrong and a semicolon is needed at the end?

DROP PROCEDURE `getStudent`//
CREATE DEFINER=`root`@`localhost` PROCEDURE `getStudent`()
BEGIN
SELECT * FROM stud_registration;
END

The code is from a question on SO.
 
Looks like a highly targeted spearphishing attack
 
Is that Mysql?
 
@NathanOliver only problem on hp site there is no usb 3.0 driver, i found one on intel site? what to use?
 
@Magisch the social engineering was impressive but it might still be just social engineering, and not actually spear phishing (they don't care who you are, just want you to be their zombie)
 
@ColdFire The Intel one should work since it is for the board in the machine.
 
1:20 PM
@tripleee Mhm
 
@Magisch What was it? o.o Didn't see.
 
@Seth Obfuscated Javascript code
 
@Magisch Y u dilit it then? :c
 
@Magisch So plain JS? ;)
 
@Seth Did you have your eyes open?
 
1:24 PM
@Tunaki Nope :(
 
@seth want a screen shot of it? (That shouldn't be an issue, should it?)
 
That explains it then.
 
@JacobGray Yes please :)
I just want to see how it looks :]
 
okay digs through history
 
1:25 PM
it's not like it's hard to obtain obfuscated JavaScript to look at
 
@Seth cause executing it is still a virus
And cause nathan threatened me ;)
 
Yes, No virus content in the room. You can start up a side room to share it if you want but please not in here.
 
@tripleee Ah, thanks :)
@NathanOliver Ay-Ay, captain! :)
 
@Seth imgur.com/a/kb94K here it is
 
1:28 PM
@JacobGray Thanks :)
I really need to learn JS :L
 
@NathanOliver thanks will try that
 
np. Let me know how it goes
 
uploading the actual sample to VT might get you significantly better results; many of the scanners there probably do not look inside zip containers
 
@Tunaki yes.
 
@tripleee Feel free to do so
I excorcised the file from the work pc now
 
1:33 PM
@Magisch nah, just in case you want to see what actual products would actually give you actual diagnostics
 
@Rizier123 probably they meant something like this
 
I just realized my first answer was on a really off topic question
^ delete that after please :)
 
@AndrewLi Active 5 months ago, FAQ rule 21... Meh. Oh well voting.
 
@Kyll I kinda want to disassociate myself
Oh.
Rule 21
 
@AndrewLi tsk tsk tsk answering off-topic questions tsk tsk tsk
The stigma will stick on to you forever . . .
 
1:40 PM
@Rubisco twas my first answer lol
> Do understand that this is a website for computer development and programming, not for installation and basic instructions
Hahahaha
@Kyll understood, hence I cv-requested
 
@Yam Nope
@AndrewLi I know, t'was a joke =p
 
throws @kyll
It feels good to be doing that again
 
morning!
 
throws @kyll into his own spear
 
has a delete vote on it Andrew
noo gunr is here
hide!! run!!
 
1:47 PM
@Tunaki Thanks!
 
Oh no
 
@AndrewLi bounces
 
Hiya gunr
 
Plop gunr
 
Pack the tuna and go
 
1:48 PM
@Tunaki no one can escape me!
 
@Tunaki No, it's ok. He has to go to another meeting :)
 
unless you add a backslash beforehand
 
/gunr2171
 
@NathanOliver, for those headphones, I'm guessing there is no indication when it's done charging?
 
@Magisch but that's a slash!
not a backslmash!
WHAT HAVE YOU DONE
 
1:49 PM
!!!
 
@Tunaki T/unaki
 
backslmash
 
Now it's pierced you.
Slow roast tuna everybody
 
Tuna tastes disgusting
 
@gunr2171 It's like a backslash, but typed really strongly
 
1:50 PM
/\/\/\/\/ Ascii Snek wants to heck off.
 
@gunr2171 The manual has Steady amber 100% Charging complete
 
ah, ok. I've never got to that point
also, that manual is not in the box
 
note to self, hide all things on page 11 or beyond ;)
 
you mean 13
 
@Tunaki agree, this cleanup looks over now. I am now considering next round cleanup with answers score starting from +5, maybe will ask to help in figuring it later (I am not yet sure if it is worth the effort, need to study SEDE results to find out)
 
1:52 PM
Says the info is on page 10 in the link i gave you
 
@gnat Ok, keep us in the loop :)
 
oh, I thought you mean the "dutch" version of the manual
 
sigh
 
:33533844 why
 
@tripleee Body - Position 646-659: nutrition.com, Position 804-817: nutrition.com, Position 974-987: nutrition.com, Position 2490-2503: nutrition.com, Position 2655-2668: nutrition.com, Position 2819-2832: nutrition.com, Position 2977-2990: nutrition.com, Position 3147-3160: nutrition.com
 
2:04 PM
pff
I found undeleted long path tool spam on apple.SE from 2015
 
@Tunaki I can't open that. All my anti-virus programs are not letting me open that link :p
 
@Rizier123 Try IE 5.
 
Oh, Edgey
 
@Tunaki My PC will destroy itself for my own safety when I would try that.
 
:)
 
2:10 PM
oh come on, IE 5 was actually good when it came out
So just use Windows 98 and you'll be fine!
 
@Magisch my malware analyst friend says it's interesting and would like to see the email if you still have it
it pulls down Cerber FWIW
which is slightly different from something which has been plaguing German recruiters recently, apparently
 
@tripleee I can get you the thunderbird file of the email tomorrow
 
gotta go, but if you have the email in RFC822 (basically plain text) format and can upload that to Virustotal, that would be extremely helpful
yeah "save as" + mbox folder
or whatever Thunderbird calls it
 
@tripleee can also do that
Basicly a copy-paste of the source code of the email
 
^ should I do X or Y for my unspecified project
 
2:22 PM
Well Z of course.
I mean. Wow.
 
none of the above
 
Tanks for the clarification.
 
thanks fellas
\o kayess
 
@Tim \o
 
I saw that
 
2:25 PM
Me too.
 
Praveen o/
 
Is this NAA? stackoverflow.com/a/40089059/4099593 The question asks for iOS, but the answer states that it works for Android
 
@BhargavRao NAA yes
 
@BhargavRao that's VERY borderline for me. Because of the last two sentences, I'd keep it
 
Could someone with insta-edit replace the large bold text style to normal here pls ?stackoverflow.com/questions/40089142/…
 
2:34 PM
@kayess on it
and never mind....
 
@kayess Fixed the formatting... Didn't actually read it though, so there might be other stuff that should be edited.
 
fixed the rest
 
Tanks guys
 
May your treads never break
2
 
God bless semafores and sing-alls
 
2:44 PM
semaphores?
 
Messages with flags
 
@tunaki I'm going to destroy that so hard
 
!!/test exoslim.site
 
> Bad keyword in body, bad keyword in title, bad keyword in username
----------
Title - Position 1-8: exoslim
Body - Position 1-8: exoslim
Username - Position 1-8: exoslim
 

« first day (1061 days earlier)      last day (2741 days later) »