Slashdot Mirror
What's In Your Hand? This Malware Knows
An anonymous reader writes with the story that ESET researchers have uncovered spyware targeting online poker players, called Odlanor, which works by sending screenshots of a player's game (along with that player's in-game identity) to the attacker; the attacker can then search for the player with that ID, and enjoy an unfair advantage. (Also at The Inquirer.) From the ESET report:
In newer versions of the malware, general-purpose data-stealing functionality was added by running a version of NirSoft WebBrowserPassView, embedded in the Oldanor trojan. This tool, detected by ESET as Win32/PSWTool.WebBrowserPassView.B, is a legitimate, albeit potentially unsafe application, capable of extracting passwords from various web browsers. ... The trojan communicates with its C&C, the address of which is hardcoded in the binary, via HTTP. Part of the exfiltrated information, such as the malware version and information identifying the computer, are sent in the URL parameters. The rest of the collected information, including an archive with any screenshots or stolen passwords, is sent in the POST request data.
Why do these arrogant pricks never consider cross-platform capability? I demand malware that works on free operating systems!
Unencrypted HTTP back channel? I would be tempted to leave this running and wait for someone to try to use it, then at a crucial times (on a big bet) change what is being sent back to them to make my hand look weaker than it is. Then you tell your AV to nuke it and change your passwords.
I read the internet for the articles.
You beat me to it. Yep. I predict this will fail big time. If I had mod points and bothered to login I'd up vote as insightful.
Here's a simple solution: Don't play poker online.
This is great news. I hated only being cheated by the site operators.
I'm an American. I love this country and the freedoms that we used to have.
You seemed to have posted this several times today. I don't get it - what response are you hoping for? If it's mild confusion and wondering what it is that might motivate someone to devote a lot of time to doing this then I suppose I'm guilty of feeding the trolls.
(1.21 gigawatts) / (88 miles per hour) = 30 757 874 newtons
Duh. Is there ever a situation where you wouldn't enjoy an unfair advantage?
Solving Unix problems since 1989...
I would be tempted to leave this running and wait for someone to try to use it, then at a crucial times (on a big bet) change what is being sent back to them to make my hand look weaker than it is.
This. or goatse.
Even without this, it's way too easy to cheat online. From simple collusion between multiple players, to bottom-feeders that spend all their time collecting a few bucks playing several nickle-ante games at once, it all adds up.
On the internet, there is no such thing as a friendly game of cards.
His ignorance covered the whole earth like a blanket, and there was hardly a hole in it anywhere. - Mark Twain
What's In Your Hand? The Shadow Knows
FTFY - Link below for the /. youngsters.
https://en.wikipedia.org/wiki/The_Shadow
"What's in your hand?" Your penis. That's where it always is. Let 'em see a pic of THAT.
I assumed this was about porn.
-Dave
Glad I am not the only one that was left scratching my head of sorts. I skimmed quickly and then thought to myself: what a waste of time.
You're about to be modded down by on-line poker players who desperately want to believe that they are not being cheated and feel compelled to silence anyone who says otherwise.
I'm an American. I love this country and the freedoms that we used to have.
What's In Your Hand? Your dick. At least for 99% of slashdot users.
You could tweak the thing to intentionally send the wrong information to the people controlling the malware. They might think you have one hand and bet accordingly, when in fact you have something completely different. The problem is that they would figure out that something was wrong pretty quickly.
This nonsense has been posted for months. Usually it gets modded down to -1 pretty quickly so most people won't even see it, but someone out there chooses to waste their time posting this gunk.
He doesn't necessary need a response. He is merely fulfilling the important role of keeping Slashdot's venerable troll tradition visible. While they might not be to your particular taste, greased-up yoda dolls and GNAA are a major part of the culture that Slashdot has built up over the years, a complex of shared references that bind this community together. Like many people whose Slashdot experience goes back to the turn of the millennium, I read this site as much for the troll lore as the tech news.
That depends. Does your camera have sufficiently high resolution?
I don't get it - what response are you hoping for?
ANY! Don't feed the trolls!
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
I mean, sure, it knows. But it really wishes it didn't.
Um fuck no. If you go that route, you nuke the whole PC after.
Anyway, depends how its implemented. If they are smart, it grabs your hole cards at the begining of the hand, before any real information exists for you to switch them on. If they do that, its going to be harder to pull this off.
Better strategy is to just make your cards, as far as he sees them, random on each round, and visible to you....so you know what he thinks you have. Even better, you stack the table with friends and start out "playing straight" with him and let him win a little, then turn on the randomizers and fuck his world.
"I opened my eyes, and everything went dark again"
Is it "Odlanor" or "Oldanor"?
The Confederate Navy wants you to know that this is a modern fleet. This is not your great-great-great-great-great-great-grandfather's navy. We welcome all. Gays, Niggers, Gayniggers, even chicks. You are all invited to join. Best of all, the most popular Confederate flag is actually a naval ensign, so you can fly it from your mast and be truly authentic. Come join today. It's simple. See a story that's just too PC or stupid, or just don't like it? Post a few lines, and then "You have been sunk by a Confederate submarine. BOOM! Glug, glug, glug.". That's all it takes and you're in. Don't be a racist though. You'll be keel-hauled, I swear. Trolling, not hate.
just saying
My cock is in my hand right now... ok well currently as I type it's in my girlfriend's hand, and pretty soon it will be somewhere else, but whatever ;-)
Unencrypted HTTP back channel? I would be tempted to leave this running and wait for someone to try to use it, then at a crucial times (on a big bet) change what is being sent back to them to make my hand look weaker than it is. Then you tell your AV to nuke it and change your passwords.
Damn, someone should make a movie of this. It's got everything.
See subject: I never GET malware @ all -> APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o...
FREE & adds speed, security, + reliability, doing more with less, more efficiently vs. browser addons & locally installed DNS servers @ home + fixes DNS' redirect security issues - obtaining its data vs. online threats & adbanner blocking from 10 reputable sites in the security community - using something you already have vs. "bolting on browser addons 'MOAR' that's usermode slower & increases messagepassing, cpu + ram overuse overheads & actually SPEEDS YOU UP 2 ways (adblocking + locally cached in RAM favorites placed @ the TOP of hosts for fastest resolution speed), whereas by way of comparison, other "so-called security 'solutions'" SLOW YOU DOWN!
* :)
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news...
&
It's GUARANTEED safe & clean per it being checked by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...
+
In its 32-bit model also https://www.virustotal.com/en/...
---
"The premise is quite simple: Take something designed by nature & reprogram it to make it work for the body rather than against it..." - Dr. Alice Krippen: "I am legend"...
APK
P.S.=> By "yours truly" - "The Lord of Hosts" so-to-speak:
PERTINENT QUOTE/EXCERPT:
"The image this title brings to mind is of a mighty military commander, one who can at a mere word summon rank upon rank of protective power" from https://answers.yahoo.com/ques... & THAT WORD = hosts!
(Accept NO substitutes!)
...apk
Random? How does that work without tipping him/her off, since there's a reasonable chance that one of the cards you have in your random hand is already in his/her hand, right ?
Won't work as the play is still stacked against you considerably.
With the exploit working as expected: the scammer knows your hands perfectly while you know nothing. The scammer plays to eek out as much of your money as possible and (if smart) will win and lose a few so you feel you're having an "unlucky" day.
With the exploit exploited as you suggest: the second the scammer sees that your cards were not what was expected he/she knows the game is up and leaves the game. Immediately. Of course the hand may get big, but the caps mean that the scammer will never really lose much. And, you then have an online adversary with a grudge and l33t skillz on your tail!
Golden Palace?
OTOH....
He might assume that there is a flaw in his program or even that the poker company is on to him, and might waste hours trying to figure out what the problem is...and that could be some serious win.
"I opened my eyes, and everything went dark again"
is a moron and deserves to get sheared like the sheep he/she is.
What's In Your Hand? This Malware Knows
I was just scratching an itch!
systemd is Roko's Basilisk.
Wow, I just have to reply .. I almost gave up scrolling since it was that long! Is that a randomly generated text or an experience with chimps typing ?
It has no idea what I have in my hand.
that sounds fun.
too bad you will never know WHEN you are playing vs the scammer, as you will not know their handle.
Yeah, once you change the cards once the scammer will know something is up. Once there is a discrepancy between the publicly available information and his back channel he will bail. You can fold a lot to reduce the amount of information you make public, but sooner or later you gotta show your hand.
I read the internet for the articles.
I assume this Win32/PSWTool malware only works on Microsoft Windows ..
Dude it's a bot. STFU it won't respond anyways.
A legitimate application they call it, and then say it steals passwords.
So which is it? Once it makes that step to steal passwords the app is no longer legit.
I guess they mean it doesn't try to hide? As in it shows up in task/resource manager? If that's all it takes to be a legit app then some versions of crypto locker and all those rogue A/V programs and many Trojans are legit too.
... What evil lurks in the hearts of men? THE SHADOW KNOWS!
Then it makes even less sense.
(1.21 gigawatts) / (88 miles per hour) = 30 757 874 newtons