[HN Gopher] Discord will switch to temporary file links to block...
___________________________________________________________________
Discord will switch to temporary file links to block malware
delivery
Author : leotravis10
Score : 59 points
Date : 2023-11-04 19:11 UTC (3 hours ago)
(HTM) web link (www.bleepingcomputer.com)
(TXT) w3m dump (www.bleepingcomputer.com)
| turminal wrote:
| I have a hard time believing this is about blocking malware.
| Discord doesn't want to be a free file hosting platform anymore,
| and that's fine, but they shouldn't pretend this is about
| something else.
| jfim wrote:
| Seems like it's two birds with one stone.
| BoorishBears wrote:
| I don't think anyone who's worked at a product company can't
| imagine how some CISO whipping up a bunch of VPs into a frenzy
| over malware is the most likely scenario.
|
| Definitely more likely than someone actually complaining that
| the money furnace was burning money in a way that increases
| engagement, gives people something to stream, and gives people
| a reason to buy their premium subscription.
| somnic wrote:
| Discord allowed hotlinking their files until recently, so it
| wasn't necessarily driving as much engagement as all that.
| BoorishBears wrote:
| Hotlinking doesn't happen in a vacuum: if people were
| seriously congregating to setup shares and paying for Nitro
| for the 500MB limit, I doubt anyone would have cross their
| "activation energy" to blanket ban the links rather than
| dealing with disruptive servers as needed
| izzydata wrote:
| I also don't want them to be a perpetual file hosting platform
| either. I also wish they cleared sufficiently old text messages
| as well. Of course they won't delete text messages though
| because they can make more money from them then they can by not
| storing them.
|
| This just happens to not be the case for larger files. I bet
| they have tried to find a way to monetize the data harvested
| from user image associations or possibly image AI training
| already.
| badrabbit wrote:
| Pleas change your belief then. Discord is a very popular
| malware distribution platform. It is reliable and corporate
| networks don't block it. This only solves the malware dropper
| problem, you still have a ton of stealers that post stolen
| creds to discord rooms via webhook. Perhaps rate limiting might
| help there.
|
| But I promise you this is a very prevalent problem, to the
| point where discord is blocked companh wide at some places
| because of this this issue.
| mdasen wrote:
| As someone who worked at a company that hosted content, I can
| believe it. Malware folks always want to get their content onto
| legitimate domains where 99.999% of the content is legitimate.
| The amount of time spent trying to keep your domains clean can
| be a nightmare. Dealing with abuse can become a major cost.
|
| This doesn't really change Discord away from being a free file
| hosting platform for anyone that gets the link on Discord. It
| just prevents someone from uploading a file to Discord and then
| sending a link to the file along a different medium
| (email/text/etc).
|
| Hosting files really isn't that expensive given Discord's tiny
| file size limit and Discord's scale. Cloudflare's R2 charges
| $0.36/million downloads. The problem is that if you're hosting
| content on your domains, you have a certain responsibility for
| the files on those domains. Your domain gets a reputation and
| at a certain point starts appearing on lists (even if you're a
| multi-billion dollar company). People trying to spread malware
| love taking advantage of any place they can store a file on a
| reputable domain or get a reputable link shortener to redirect
| to them. I don't blame Discord for wanting to cut them off.
| Shorel wrote:
| It can perfectly be both. I mean, there's no reason to polarize
| every decision. On the contrary, the more points it covers, the
| better justification it has.
| madeofpalk wrote:
| Are you suggesting it's about something else?
|
| > _After the file hosting change (described by Discord as
| authentication enforcement) rolls out later this year, all
| links to files uploaded to Discord servers will expire after 24
| hours._
|
| > _CDN URLs will come with three new parameters that will add
| expiration timestamps and unique signatures that will remain
| valid until the links expire, preventing the use of Discord 's
| CDN for permanent file hosting._
|
| This seems like a pretty straight forward change?
| lemoncookiechip wrote:
| No Text To Speech[1] covered this in his video a few weeks ago.
| It seems like a good thing for the health of the platform in
| general. People like to use Discord as a file locker on 3rd party
| platforms, and that can cause unnecessary financial strain on
| what is a free product that has been trying to find ways to
| monetize itself for quite a while now, (animated profiles being
| the latest thing).
|
| Of course there's ways around it as it is right now, as shown in
| NTTS' video, but it requires effort, which the general user won't
| bother with.
|
| [1] https://www.youtube.com/watch?v=rZ73h1qWb3c
| amiga-workbench wrote:
| I hope this change gives more people pause about stuffing the
| entirety of their projects online presence into Discord.
|
| It sucks for search engine indexing and it sucks for providing
| support for stuff because the conversation moves on before
| anybody who might help will see your query.
| xeonmc wrote:
| Zig is probably the worst offender of this, especially
| exacerbated by the lack of adequate documentation.
| Etheryte wrote:
| This may sound odd, but it sounds like the tragedy of a
| project's success. In the old days you would often find help on
| an IRC channel, but it worked out, because they were not very
| busy. These days if your project blows up, no matter what
| platform you use, you will be overrun with questions because
| there's just more people jumping on the next hot thing.
| chatmasta wrote:
| On the other hand, it's a lot better than Slack which charges
| you to search through all your messages in a channel. At least
| in Discord you can search all messages, even if you can't find
| them directly from a search engine.
|
| One simple solution to this would be a Discord bot that
| publishes a log of all messages in a channel to a website, thus
| making them indexable by Google. This used to be common
| practice for IRC channels and you'd sometimes find an answer to
| a programming question in the published logs of some IRC
| server.
|
| Of course, an even better solution would be for Discord to
| offer this natively to server admins. Give them an option to
| make their channel indexable by search engines, and then mirror
| all the posts to a subdomain. It could even be a funnel for
| Discord since they could get new users to signup when they land
| on an answer and need to signup to ask a follow-up question. It
| could also be a wedge to compete more directly with Reddit.
| cobertos wrote:
| Does this apply to images? Article didn't mention it and I can't
| find other info on this
| leotravis10 wrote:
| See here: https://news.ycombinator.com/item?id=37697030
|
| It's every type of file, including images that are affected.
| jonplackett wrote:
| Bet midjourney will be unhappy.
|
| I'm sure one of the reasons they operate purely as a discord bot
| is to save $$$ on hosting and bandwidth
| furyofantares wrote:
| I think discord is very happy with Midjourney, who they do
| billing for, who they've done significant work to support
| (they're by far the largest discord, and discord has also done
| UI work to support the midjourney inpainting feature.)
|
| I think it's extremely unlikely this is aimed at midjourney or
| will affect them negatively. Most of their bandwidth will still
| happen over discord where users see the images generated to
| begin with.
| andybak wrote:
| I'm more concerned about the loss of content that should
| probably be preserved in historical grounds. Obviously not all
| of it is significant but you can't pick and choose and at least
| some of it will turn out to be of interest to future historians
| and researchers.
| dns_snek wrote:
| I don't see how this affects Midjourney at all? Expiring links
| are a technical implementation detail that won't affect regular
| users of Discord in any way. It's not like they're charging for
| hosting or bot access unless I missed something.
| 63 wrote:
| I can see how this could be annoying in some contexts e.g. going
| to some project's discord to get answers to a question, searching
| a channel and finding the perfect answer from awhile back but
| then not being able to download the file that was attached at the
| time. I don't think that's super likely to happen though. IME
| most answers I've searched for were entirely encapsulated in text
| anyway. The larger problem of using a discord server for such
| projects still exists, but I don't think this makes it all that
| much worse.
| an-unknown wrote:
| As far as I understand it, this change is not supposed to
| change anything about files posted on Discord, as long as you
| actually view the channel where they were posted. Means: if you
| find an old post on Discord with a file attached, this should
| still work. This change is only supposed to make it impossible
| to take a _link_ to such a file and post that link outside of
| Discord (e.g. on a website), in which case the link should then
| expire within 24h after the enforcement is implemented.
| pests wrote:
| Yep - lets not forget links are an abstraction Discord
| provides for us to access the files. The files themselves
| would be linked to messages via some internal id, correct? So
| they can re-generate the link on every message view.
| alright2565 wrote:
| They're not deleting old files, they're just using signed per-
| user urls to serve them on.
|
| You'll still see old files.
| leotravis10 wrote:
| Related (now archived) discussion from a month ago: Discord as a
| filehost will no longer be possible by the end of the year (108
| comments) https://news.ycombinator.com/item?id=37697030
|
| This news that I shared is now official of course.
| badrabbit wrote:
| The number of people on this thread who don't understand how
| prevalent the discord malware problem is stunnig to me. I guess I
| forget there is a world outside of infosec sometimes. Just google
| discord malware and you'll find plenty of writeups.
|
| cdn.discordapp.com, if you see anything that isn't actually
| discord connecting to that domain in your corporate network then
| it's most likely malware.
|
| Matter of fact, get your own open source stealer malware, github
| is curating a topic for it:
|
| https://github.com/topics/discord-stealer
|
| I gotta make an HN submission for this lol.
| bigDinosaur wrote:
| Please do. I had absolutely no idea Discord was used for this
| purpose in any significant way (although on reflection of
| _course_ it is because what can be abused on the internet will
| be abused.)
| 0xDEAFBEAD wrote:
| How do these stealers work? Is the assumption that the victim
| will download and run an executable? If so, what's discord-
| specific about it?
| mips_r4300i wrote:
| A popular one is indie games. An attacker will copy the
| entire game and distribute it on various platforms as if they
| were the publisher, and add a setup program - either a MSI or
| an all in 1 exe. This installer usually has a powershell
| scripting extension DLL. The worm's first stage loader is
| this powershell script. It works because the setup program
| already asked for administrator access, so the PS script runs
| as admin.
|
| First thing it'll do is disable Windows Defender. Then run a
| base64 encoded script as a command line arg to powershell as
| a scheduled task. And so on. Telemetry is sent back to the c2
| about what AV was installed, and if it finds itself running
| in a sandbox or VM it will immediately exit.
|
| I haven't seen them using discord's CDN, but I'm sure some
| do. Redline seems to have a high amount of customization
| encouraged in its deployment. Each infection is a few megs of
| bandwidth, so if you're infection a lot of targets the
| bandwidth costs can be non trivial, hence using a CDN.
| 0xDEAFBEAD wrote:
| Interesting, thanks!
| badrabbit wrote:
| The stealers are spread some other way, discord is used as a
| place to send the attacker stolen info. Back in the day IRC
| bots were used in the same way.
|
| The recent discord change affects a different type of abuse
| though. The attackers upload their malware to discord and use
| the link to that attachment as part of the infection/dropper
| phase.
|
| Let's say you get a phishing link, a social media post such
| as on facebook,linkedin,etc... or a search result on google,
| malvertising,etc... then that lets you download the desired
| content except it's an iso,archive, lnk,etc... you open it
| and the file in it. Little do you know that triggere the
| infection where powershell, wscript, csc or whatever else is
| downloading the malware using the discord permalink, if it is
| any good it will still need additional unpacking and
| decrypting before it either settles in its new home on your
| computer or if it is a stealer, it grabs your browser stored
| passwords (never use that or login to chrome/edge!!! Or mix
| work/personal accounts!!) , crypto wallets, api keys ,
| interesting files such as config files, credit cards (again
| browsers lol) and more and posts that data archived using a
| webhook to the attackers channel/room and the malware will
| not even touch your disk before disappearing sometimes
| (reflective .net assembly loading, Thread injection,etc...)
|
| If you have relatives who are not technical, either make them
| use macos or turn on defender with tamper protection and
| cloud delivered protection and make sure extensions and
| hidden files are visible by default. Also change the default
| file association for js,jse,vbs,vbe,iso,7z,rar,hta,bat,cmd
| and I am sure I am missing more to notepad.
| 0xDEAFBEAD wrote:
| Thanks for the explanation!
|
| You write:
|
| >it grabs your browser stored passwords (never use that or
| login to chrome/edge!!! Or mix work/personal accounts!!)
|
| I actually don't know a ton about the Windows permissions
| model. If the malware can already install a keylogger at
| this point, doesn't avoiding the use of stored passwords
| just delay the inevitable? (I guess installing a keylogger
| could cause it to be detected by antivirus software?) Also,
| in terms of mixing work and personal accounts -- it's not
| enough to use separate browsers, I'd have to use separate
| devices, correct?
|
| What are reflective .net assembly loading & thread
| injection?
|
| That's quite a list of file extensions! It seems like
| Windows is astonishingly willing to execute unwanted code.
| Like, I'm struggling to imagine why I'd be significantly
| worried about a downloaded .js file on Linux/macOS.
| jowea wrote:
| What even is the "educational and research purposes" of such a
| tool?
| baz00 wrote:
| Ah so they can temporarily allow malware.
| vore wrote:
| What would your solution be? Just stopping people from sharing
| files altogether?
| jwells89 wrote:
| It's so disappointing to me that it's practically a guarantee
| that free services (like Discord's file hosting) will come to not
| only be abused, but abused at scale if they remain free long
| enough. To me it's one of the many issues that has eroded away
| the wonder of the web.
|
| I can't imagine what it must be like trying to get a foothold as
| a new image host these days, for example. Your free offering will
| be misused as soon as you get the smallest amount of traction,
| which then prompts you to lock it down, which then stymies growth
| that funnels into paid plans.
| cma wrote:
| > There is no impact for Discord users that share content within
| the Discord client. Any links within the client will be auto
| refreshed. If users are using Discord to host files, we'd
| recommend they find a more suitable service.
|
| Is this the first big move to push people off the web onto the
| desktop/mobile client where they have much more potential to
| invade privacy?
| layer8 wrote:
| Web forums have been doing something similar for a long time:
| They only allow access to "attachment" links when the user is
| logged in.
|
| What I don't understand is why Discord still wants to allow
| temporary access outside their clients.
| jordigh wrote:
| I was surprised this ever worked to begin with. The first time I
| saw I could just right-click on a file link in Discord and post
| it elsewhere and it worked, I couldn't believe it. I then happily
| started to use it to share lots of files with people. I
| understand this feature has to go away, but it was nice while it
| lasted.
|
| I am on a very niche Discord for the Battletoads video game
| series. I'm a former world record co-holder of the 100% NES co-op
| category, so, big fan. :) We've been cataloguing and saving every
| bit of contemporary Battletoads materials we could find and
| archiving them in Discord: manuals, design materials, concept
| art, ads, magazine coverage. Snapshots of the franchise
| juggernaut that never was. I need to move that off Discord and
| store it somewhere so the whole world can see what we've
| unearthed here. Battletoads wanted to go real big but a series of
| unlucky events just never made it. I fear that the lukewarm
| reception to the latest 2020 game means the series will be
| dormant at least for another decade.
|
| Right now I'm planning to systematically download all of the our
| archived materials off Discord, move them up to archive.org, and
| perhaps start a little page on neocities curating the archive and
| highlighting some interesting stuff, for example:
|
| Battletoads costumes:
|
| https://cdn.discordapp.com/attachments/829695119803285504/10...
|
| Battletoads novel, written by Rare, as background lore:
|
| https://cdn.discordapp.com/attachments/829695119803285504/10...
|
| Design documents for some levels, suggesting that the Turbo
| Tunnel might have at one time been the belly of a beast and
| that's why it looks so organic:
|
| https://cdn.discordapp.com/attachments/829695119803285504/82...
|
| All of these links will be lost, like tears in the rain.
| andrewstuart wrote:
| When people use your platform for some other purpose, that is
| showing a clear gap in the market and product opportunity.
|
| Do you:
|
| A: kick them off your platform
|
| B: turn that usage into a real paid product that meets demand
|
| It's weird that people work so hard to come up with something
| that people want, and when it falls into their lap, it's seen as
| parasitic and killed.
| patmorgan23 wrote:
| Bruh. Discord did not invent a new product here.
|
| This is just people hot linking things and using discord as a
| free file host. A product/problem that has existed for
| literally decades.
|
| People wanting/using something for free does not mean you have
| a great business opportunity, in fact it's usually the
| opposite. To run a business you need someone to pay you for
| stuff.
| andrewstuart wrote:
| Fair enough.
|
| You're saying the key thing here is leeching bandwidth.
___________________________________________________________________
(page generated 2023-11-04 23:01 UTC)