Exploit test

[Vinata]

beep boop

[mazzilliu]

its down now. bring it back

let me keep poking at it

[Vinata]

EVE-NEWS: Kugutsumen Spreads Trojan

Would anyone care to post comments correcting the error this website has made?

[RansomList]

http://www.kugutsumen.com/showthread...l=1#post244331

In other words, kugu users just shit their pants

Whats this new eve news site?

[Vinata]

Whats this new eve news site?

I've been told that it is a creation of Hubris.

[RansomList]

I've been told that it is a creation of Hubris.

extreme haughtiness, pride or arrogance. Hubris often indicates a loss of contact with reality and an overestimation of one's own competence or capabilities, especially when the person exhibiting it is in a position of power.

Sounds pretty standard for EVE. How many alliance execs doesn't this apply to? Anyway...

http://www.eve-news.com/ this new EVE News site accusing Kugu of acts of lamentable morality....wait a minute something looks familiar.

maintained by my company Adminor AB and you can send an email to xxxxx (do a whois on that IP) to verify our control of this IP.

Please help swiftly
Signed,
Name redacted in full
important person
Pandemic Legion

Quote taken from http://www.kugutsumen.com/showthread...l=1#post188131
Oh, thats right. I remember now. Interesting, no?

[Mr Coloredshirt]

i clicked the link and now my dog killed me

[RansomList]

The mastermind is a swede. We can't reveal his true identity beyond that however.

There a legal reason for that? Because its pretty obvious who http://www.eve-news.com/2011/06/03/k...preads-trojan/ may be affiliated with. Hadn't the hatchet been buried?

[tgr]

Part of Noscript non-scrub crew checking in. I clicked the link, and I saw nothing.

[Vinata]

There a legal reason for that? Because its pretty obvious who http://www.eve-news.com/2011/06/03/k...preads-trojan/ may be affiliated with. Hadn't the hatchet been buried?

Many times, by many people, and always into each other.

[mazzilliu]

entire reason for the drama: shamis got a copy of the link from anthony with zero provided context, entire admin team of pl was hours deep in decompiling flash code before any of us even heard about this thread.

i was working while getting spammed by shamis, hell if im going to be browsing forums while im busy working and getting spammed about virus alerts at the same time

[mazzilliu]

oh yeah, if we are crossposting from pl forums so am i
luls forum porn

what a waste of my day

i could have spent my entire day playing with lasers instead i am dealing with shit because people cant communicate.

if you look at post #9, that is basically the exploit file in question. you can see there is a working exploit there, but no virus payload. there is a chunk of obfuscated shit there that could be a virus, i dont think any of us know what it is yet. it's the safest practice to assume the worst until someone can pick apart the code and prove it is okay.

i dont do reverse engineering of flash code, i only have been relaying information.

there would have been no drama if anthony did not send shamis the link. none of us knew the exploit thread existed until several hours after we started picking apart the code. i was working at the time and not browsing forums, so i literally couldnt have known about anything except shamis's messages. this wasted a lot of my time.

you download an unknown file with an exploit in it, always assume it has a payload too, and change your passwords, regardless of where or who it comes from, unless you also trust this person with full unmonitored access to your computer. i'm guessing shamis does not share this trust with anthony, so i'm not going to suggest to shamis that he does nothing.

anthony should not have been sending exploit links without providing context. even if he really did accidentally send shamis the link, he should have provided context afterwards, or else i really dont understand how you cannot see something like this coming. hes a security professional and he should know that.

[Mr Coloredshirt]

Clearly this is a big deal and the public deserves an EIIST mirror or at the very least a fresh PL shamis mirror.

[Vinata]

anthony should not have been sending exploit links without providing context. even if he really did accidentally send shamis the link, he should have provided context afterwards, or else i really dont understand how you cannot see something like this coming. hes a security professional and he should know that.

The Clom told me half his job was protecting the site from Mulla. I'm going to be honest and say that it felt like much more than half.

[Fix Lag]

I clicked that link and now my dingdong is tingling all funny.

[Vinata]

ok case closed.

th?s comes from p?stb?n.com and ?s useless for mulla to do anyth?ng with but scare the shit out of someone. He prob found this somewhere and decided to fuck with shamis.

its a bit over a month old and its exact to what i decompiled out of hiq.swf. hell half of that is basically broken as well. it has a loading area that loads nothing but a black background of a default .swf.

Basically its completely junk and empty‚ render?ng it completely worthless ?s you can see from my screen shots of the decomp?led .swf.

hey v?per, ?ts very doubtful he wrote a single character of it. there was no testing of something bla bla. If he told you that and you believed it your a gullible retard‚ or better yet your a ly?ng f?ggot w?th that bullsh?t story you just told. But n?ce to see you whitenighting and trying to help troll shamis.

Can we just kick viper this time for good?

[bobbechk]

clicked and some 20 children in Africa instantly died, but maby they would have died anyway v0v

[mazzilliu]

i dont know if your account can read links so here is the rest of the post
link omitted in above post
http://pastebin.com/iKjBHNX6

these posts came later

It only loads a black box for you or a patched adobe flash installation, but that could still be a bufferoverflow to do other stuff.

There's no telling if it does more or remotely executes something if it writes a string to memory (or whoever it works).

its a random string of characters. it holds nothing, never tried to access anything, and never executes a single thing. Granted this could be someones main script to template something that does bad things (maybe, prob not) but on its own it wont even load a url or store anything correctly as is.

seriously he opened a new flash document/project and dumped this into the first frame action window. nothing more.
to be more specific he used flash compatible with CS4 (10).

[Madrak]

So how do I get this story straight? Damn this thread is confusing - so Mulla posted thing, someone saw it on Kugu and sent it to Shamis like heh check this out, and then omgomg decompile ---> pastebin link.

Looking at the code, I don't see any actual payload happening.
The reason's people reported their laptops frying is probably this:

while (_loc_4 < 400)
{

alloc(_loc_2, 1048576 - 3840 - 36, this.load_trigger);
_loc_4++;
}

Actually kugu, if you're reading, having a computer run the N-QUEENS problem for high values of N will also DOS pretty good too.

[Endie]

I clicked the link and the neighbouring coalition died

[Stronke]

EVE-NEWS: Kugutsumen Spreads Trojan

Would anyone care to post comments correcting the error this website has made?

I posted such a nice insult there but

Your comment is awaiting approval.

so I am sure it wil get deleted before the world can appreciate it

[Viper ShizzIe]

The Clom told me half his job was protecting the site from Mulla. I'm going to be honest and say that it felt like much more than half.

This shit is hilarious, I don't even care outside of having all of my PL.com services removed for telling Ander and Hubris to calm down when they went on one of their monthly kugutsumen.com witchhunts.

[Celexi]

It did nothing to my chrome 12 beta

[riverini [banned]]

Sent 5 hours ago

sup Viper, I was sent this, you might wanna check it
*posts the tip he got saying that k.com was spreading AIDS

His response

Re: Foreplay
you are fucking retarded

Just trying to help!

[Viper ShizzIe]

Sent 5 hours ago



His response


Just trying to help!

I might not care about every news tip Hubris sends you that we've been dealing with for nearly 24 hours already, thanks though~

[riverini [banned]]

I might not care about every news tip Hubris sends you that we've been dealing with for nearly 24 hours already, thanks though~

I think you are giving hubris just too much credit. anyways, foreplay getting boring nao, so time to post some stuff...

[Mulla Nasrudin]

I think you are giving hubris just too much credit. anyways, foreplay getting boring nao, so time to post some stuff...

You nearly got banned yesterday... by mistake.

[riverini [banned]]

You nearly got banned yesterday... by mistake.

I think I have shown my fair share of "fair play" to k.com, anyways I was greeted today with several "tips" regarding Ebil-kugu and their "thuggish" methods of spreading cyber-AIDS

[Iseeyouseemeseeyou]

opened link, dbrb's dog died.

OP SUCCESS.

[Vinata]

You nearly got banned yesterday... by mistake.

I'm the genius who finally figured out eve-news.com and evenews24.com are not the same website.

edit: Sadly what gave it away wasn't the names of the sites being different, but that Riverini is really proud of how EN24 looks visually and eve-news.com is ugly.

[riverini [banned]]

I'm the genius who finally figured out eve-news.com and evenews24.com are not the same website.

edit: Sadly what gave it away wasn't the names of the sites being different, but that Riverini is really proud of how EN24 looks visually and eve-news.com is ugly.

LOL you just made my morning... ^__^

[boatviolence]

Elite h4x0rs innit?