Roger that, thanks for clarifying. It seems it would be difficult to figure out what they're up without taking on a major project ...

-K



On 09/04/2016 09:24 PM, Michael Butash wrote:
Obfuscated code, apparently this is more common these days to do.  There's something that does a hash off the posted payload input that interprets the real code and functions behind it as it is read.

I was reading about something like this not long ago the motions to reverse engineer malware payloads from hacker-news posted research used to keep their business under wraps.  They figured out how to reverse the algorithm and read the code the same as they would to interpret the payload and run it when hitting the site, noting what sort of havoc was being performed when executed, some sort of windoze 0-day.

They do something like this with android apk apps to keep them "secure" and keep crappy other devs from pilfering code.

I always run noscript for firefox and scriptsafe on chrome's, it's worth the hassle.

-mb


On 09/04/2016 02:39 PM, Parabellum7 wrote:

Greetings fellow penguins,


Today I received a suspicious message with a link to some rather odd looking (javascript?) code. If you'd like to see it I put it on pastbin. Obviously, don't download it or run it.

http://pastebin.com/B1f9M70U


It came from this URL:  Don't click this unless you're up on dealing with unknown. I purposely put spaces in it so someone here doesn't accidentally click it anyway, like I stupidly did.

h e l p - m e m b e r . c o m / e b a y d o c s / s c r e e n s h o t s . p h p


Fortunately I have no script running so I don't think ... er, hope ... nothing happened.

Any idea what this is?


Thanks!

--Kenn




---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss




---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss@lists.phxlinux.org
To subscribe, unsubscribe, or to change your mail settings:
http://lists.phxlinux.org/mailman/listinfo/plug-discuss