https://www.bleepingcomputer.com/news/security/discord-will-switch-to-temporary-file-links-to-block-malware-delivery/ BleepingComputer.com logo * * * * [ ] [Login] [Sign up] * * * * [ ] [Login] [Sign up] * News + Featured + Latest + Mortgage giant Mr. Cooper hit by cyberattack impacting IT systems Mortgage giant Mr. Cooper hit by cyberattack impacting IT systems + HelloKitty ransomware now exploiting Apache ActiveMQ flaw in attacks HelloKitty ransomware now exploiting Apache ActiveMQ flaw in attacks + New macOS 'KandyKorn' malware targets cryptocurrency engineers New macOS 'KandyKorn' malware targets cryptocurrency engineers + Ace Hardware says 1,202 devices were hit during cyberattack Ace Hardware says 1,202 devices were hit during cyberattack + Discord will switch to temporary file links to block malware delivery Discord will switch to temporary file links to block malware delivery + Apple 'Find My' network can be abused to steal keylogged passwords Apple 'Find My' network can be abused to steal keylogged passwords + This Babbel subscription is only $139.97 (reg. $599) through November 9th This Babbel subscription is only $139.97 (reg. $599) through November 9th + The Week in Ransomware - November 3rd 2023 - Hive's Back The Week in Ransomware - November 3rd 2023 - Hive's Back * Downloads + Latest + Most Downloaded + Qualys BrowserCheck Qualys BrowserCheck + STOPDecrypter STOPDecrypter + AuroraDecrypter AuroraDecrypter + FilesLockerDecrypter FilesLockerDecrypter + AdwCleaner AdwCleaner + ComboFix ComboFix + RKill RKill + Junkware Removal Tool Junkware Removal Tool * VPNs + Popular + Best VPNs Best VPNs + How to change IP address How to change IP address + Access the dark web safely Access the dark web safely + Best VPN for YouTube Best VPN for YouTube * Virus Removal Guides + Latest + Most Viewed + Ransomware + Remove the Theonlinesearch.com Search Redirect Remove the Theonlinesearch.com Search Redirect + Remove the Smartwebfinder.com Search Redirect Remove the Smartwebfinder.com Search Redirect + How to remove the PBlock+ adware browser extension How to remove the PBlock+ adware browser extension + Remove the Toksearches.xyz Search Redirect Remove the Toksearches.xyz Search Redirect + Remove Security Tool and SecurityTool (Uninstall Guide) Remove Security Tool and SecurityTool (Uninstall Guide) + How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo + How to remove Antivirus 2009 (Uninstall Instructions) How to remove Antivirus 2009 (Uninstall Instructions) + How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller + Locky Ransomware Information, Help Guide, and FAQ Locky Ransomware Information, Help Guide, and FAQ + CryptoLocker Ransomware Information Guide and FAQ CryptoLocker Ransomware Information Guide and FAQ + CryptorBit and HowDecrypt Information Guide and FAQ CryptorBit and HowDecrypt Information Guide and FAQ + CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ * Tutorials + Latest + Popular + How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 + How to use the Windows Registry Editor How to use the Windows Registry Editor + How to backup and restore the Windows Registry How to backup and restore the Windows Registry + How to open a Windows 11 Command Prompt as Administrator How to open a Windows 11 Command Prompt as Administrator + How to start Windows in Safe Mode How to start Windows in Safe Mode + How to remove a Trojan, Virus, Worm, or other Malware How to remove a Trojan, Virus, Worm, or other Malware + How to show hidden files in Windows 7 How to show hidden files in Windows 7 + How to see hidden files in Windows How to see hidden files in Windows * Deals + Categories + eLearning eLearning + IT Certification Courses IT Certification Courses + Gear & Gadgets Gear + Gadgets + Security Security * Forums * More + Startup Database + Uninstall Database + Glossary + Chat on Discord + Send us a Tip! + Welcome Guide * Home * News * Security * Discord will switch to temporary file links to block malware delivery * * Discord will switch to temporary file links to block malware delivery By Sergiu Gatlan * November 4, 2023 * 11:16 AM * 0 Discord Discord will switch to temporary file links for all users by the end of the year to block attackers from using its CDN (content delivery network) for hosting and pushing malware. "Discord is evolving its approach to attachment CDN URLs in order to create a safer and more secure experience for users. In particular, this will help our safety team restrict access to flagged content, and generally reduce the amount of malware distributed using our CDN," Discord told BleepingComputer. "There is no impact for Discord users that share content within the Discord client. Any links within the client will be auto refreshed. If users are using Discord to host files, we'd recommend they find a more suitable service. "Discord developers may see minimal impact and we're working closely with the community on the transition. These changes will roll out later this year and we'll share more info with developers in the coming weeks." After the file hosting change (described by Discord as authentication enforcement) rolls out later this year, all links to files uploaded to Discord servers will expire after 24 hours. CDN URLs will come with three new parameters that will add expiration timestamps and unique signatures that will remain valid until the links expire, preventing the use of Discord's CDN for permanent file hosting. While these parameters are already being added to Discord links, they still need to be enforced, and links shared outside Discord servers will only expire once the company rolls out its authentication enforcement changes. "To improve security of Discord's CDN, attachment CDN URLs have 3 new URL parameters: ex, is, and hm. Once authentication enforcement begins later this year, links with a given signature (hm) will remain valid until the expiration timestamp (ex)," the Discord development team explained in a post shared on the Discord Developers server. "To access the attachment CDN link after the link expires, your app will need to fetch a new CDN URL. The API will automatically return valid, non-expired URLs when you access resources that contain an attachment CDN URL, like when retrieving a message." A giant leap forward in the battle against malware This is a much-anticipated move toward the ongoing challenges Discord faces in curbing cybercrime activities across its platform, seeing that its servers have long served as breeding grounds for malicious activities associated with financially motivated and state-backed hacking groups. Discord's permanent file hosting capabilities have frequently been misused to distribute malware and exfiltrate data gathered from compromised systems using webhooks. Despite the escalating scale of this issue in recent years, Discord has so far struggled to implement effective measures to deter cybercriminals' abuse of its platform and decisively address the problem or, at the very least, limit its impact. According to a recent report by cybersecurity company Trellix, Discord CDN URLs have been exploited by at least 10,000 malware operations to drop second-stage malicious payloads on infected systems. These payloads primarily consist of malware loaders and scripts that install malware, such as RedLine stealer, Vidar, AgentTesla, zgRAT, and Raccoon stealer. According to Trellix's data, various malware families, including Agent Tesla, UmbralStealer, Stealerium, and zgRAT, have also used Discord webhooks over the past few years to steal sensitive information like credentials, browser cookies, and cryptocurrency wallets from compromised devices. Related Articles: Qubitstrike attacks rootkit Jupyter Linux servers to steal credentials Discord still a hotbed of malware activity -- Now APTs join the fun Shadow PC warns of data breach as hacker tries to sell gamers' info Discord is investigating cause of 'You have been blocked' errors * CDN * Content Delivery Network * Discord * DMALocker * Hyperlink * * * * * Sergiu Gatlan Sergiu has covered cybersecurity, technology, and other news beats for more than a decade. Email or Twitter DMs for tips. * Previous Article Post a Comment Community Rules You need to login in order to post a comment [Login] Not a member yet? Register Now You may also like: [INS::INS] Popular Stories * Microsoft Exchange New Microsoft Exchange zero-days allow RCE, data theft attacks * MrCooper Mortgage giant Mr. Cooper hit by cyberattack impacting IT systems Follow us: * * * * * Main Sections * News * VPN Buyer Guides * Downloads * Virus Removal Guides * Tutorials * Startup Database * Uninstall Database * Glossary Community * Forums * Forum Rules * Chat Useful Resources * Welcome Guide * Sitemap Company * About BleepingComputer * Contact Us * Send us a Tip! * Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2023 Bleeping Computer^(r) LLC - All Rights Reserved Login Username [ ] Password [ ] [*] Remember Me [ ] Sign in anonymously [Login] Sign in with Twitter button Sign in with Twitter --------------------------------------------------------------------- Not a member yet? Register Now Reporter Help us understand the problem. What is going on with this comment? * ( )Spam * ( )Abusive or Harmful * ( )Inappropriate content * ( )Strong language * ( )Other [ ] * [ ] Read our posting guidelinese to learn what content is prohibited. Submitting... SUBMIT