| 01:55.32 | *** join/#arl pompy1 (~Mike@c-50-166-85-212.hsd1.nj.comcast.net) |
| 02:00.42 | *** join/#arl Ac-town (~actown@osuosl/staff/actown) |
| 02:45.15 | *** join/#arl Ac-town (~actown@osuosl/staff/actown) |
| 14:06.38 | *** join/#arl Ressy (~resa1983@WoWUIDev/WoWAce/ARL/Ressy) |
| 14:06.38 | *** mode/#arl [+v Ressy] by ChanServ |
| 16:17.27 | Ressy | Torhal: Did you know that NPCScan & its overlay are on wowmatrix? |
| 16:17.45 | Ressy | "by Saiket." |
| 17:07.53 | *** join/#arl pompy (~Mike@c-50-166-85-212.hsd1.nj.comcast.net) |
| 17:07.53 | *** mode/#arl [+v pompy] by ChanServ |
| 17:29.54 | Torhal | Ressy: GPL |
| 17:54.55 | Ressy | gpl? |
| 18:18.21 | Torhal | Aye - the license. |
| 22:14.08 | *** join/#arl Ressy (~Ressy@WoWUIDev/WoWAce/ARL/Ressy) |
| 22:14.09 | *** mode/#arl [+v Ressy] by ChanServ |
| 22:14.13 | Ressy | so Torhal.. |
| 22:14.23 | Ressy | Now that I'm done fixing wow's trojan problem. |
| 22:14.26 | Ressy | Collectinator? :) |
| 22:36.05 | Ac-town | what was the trojan problem? |
| 22:36.15 | Ac-town | only saw the blizzcs people say its okay now |
| 22:37.10 | Ressy | new fake curse client. |
| 22:37.20 | Ressy | That came with the real client, and a new trojan. |
| 22:37.24 | Ressy | nothing was picking it up. |
| 22:37.44 | Ressy | And it would pick up the computer name, IP address, and then go into your registry to expire your authenticator code. |
| 22:38.00 | Ressy | SO, the login would request the auth code. |
| 22:38.36 | Ressy | When you put it in, it would take the auth code, delay your login, and use the Computer name, fake the ip address, and the new auth code to log in as you. |
| 22:38.57 | Ressy | once that was done, unless you changed your password, they had your info saved and could get in any time. |
| 22:39.19 | Ac-town | so the trojan was in a fake curse client? |
| 22:39.24 | Ressy | yes |
| 22:39.28 | Ac-town | do you have a copy of it? |
| 22:39.36 | Ac-town | would like to look into it/at it |
| 22:39.38 | Ressy | I have a copy of the .dll.. but not the installer. |
| 22:39.42 | Ressy | its the real curse client. |
| 22:39.58 | Ac-town | want to throw the files that are important my way? |
| 22:40.00 | Ressy | it connected to the curse servers to download the real client. |
| 22:40.25 | Ressy | I sent'em to the Warden team, and about 20 antivirus companies who didn't have definitions for it... |
| 22:40.45 | Ressy | If you have VirusTotal account, you can get the file here: https://www.virustotal.com/en/file/850dc3ebb2437edaf3352eee79ee704cdb881779684c2128f1f07d8dd79c0344/analysis/ |
| 22:42.57 | Ac-town | will make an account when I get home then |
| 22:43.10 | Ressy | I think its pay tho |
| 22:45.35 | Torhal | Ressy: This weekend. Doubt it'll be tonight. |
| 22:46.02 | Ressy | mkay :) |
| 22:48.18 | Ac-town | Ressy: if it is would you throw me the dll? |
| 22:48.36 | Ac-town | just wanna take a look at it for research |
| 22:49.45 | Ressy | Ac-town, are you a security researcher? |
| 22:50.17 | Ac-town | I deal with security for networks/linux systems |
| 22:50.22 | Ac-town | planning on getting into it more |
| 22:50.23 | Ressy | cuz frankly, we've had about half a dozen people come in asking for a copy of it, and said they weren't a researcher or anything related, and they just want to 'play' with it. |
| 22:50.55 | Ressy | including a geeksquad employee who said blizzard couldn't afford him when I told him I wouldn't give it to him. >.< |
| 22:51.12 | Ac-town | geeksquad lol |
| 22:51.24 | Ressy | and after someone recommended he apply to blizzard for an open security researcher position. |
| 22:51.31 | Ressy | yeah. that was my first thought. |
| 22:52.53 | Ressy | it hit Kotaku. >.< |
| 22:52.57 | Ac-town | well if its worth anything, I run snort/bro at work's office and a home to get an idea for whats going on with our network |
| 22:53.14 | Ac-town | so if I can pull out a port/ip/data from what it sends then maybe a snort rule could be written |
| 22:54.01 | Ressy | heh. second time I've made Kotaku now. |
| 22:54.06 | Ressy | Ars a few times. |
| 22:56.14 | Ackis | were these people who got keylogged trying to use a pirated version of the curse client? |
| 22:56.46 | Ressy | no.. |
| 22:56.56 | Ressy | They used websearches to find curse client or wowmatrix. |
| 22:57.01 | Ressy | and clicked the ad instead of the actual site |
| 22:59.20 | Ackis | ah |
| 22:59.34 | Ackis | well if they were searching for wowmatrix they deserved it! |
| 23:05.04 | Ressy | def |