 I have made a post about some Mastodon instances being associated with malware and explaining what I found: https://github.com/mastodon/mastodon/discussions/18688 I think it can be interesting for people who are #mastoadmin + would love to have people from #cybersecurity have a look and share any feedback. Thanks. 14 comments
 @hugo here is key bit from the above: “… an attacker creates a profile on a social media site like anyone else. Then adds the URL of their profile (or RSS feed) to the malware bot. Once the bot infects a third-party computer, it fetches the social media profile of the attacker and looks for instructions. The attacker can then issue instructions/commands using standard social media tools, and the bot follows those instructions . “ cc: @mastohost  @hugo Thank you for this! We had the same issue with mstdn.social on the exact same day as mastodon.social but fort i my response was in time to not get 'banned'. I have done many scans since this issue but never found anything else than the one account with a "ping IP" in the bio! I've spend a load of time getting us from all VirusTotal related sites since many just copy paste the result :sad_cat: @stux Thank you so much for sharing. How did you mstdn.social out of VirusTotal? I could do it on CRDF Threat Center but don't know how I can do it on VirusTotal. @tchambers @hugo Aiii.. I see indeed! https://www.virustotal.com/gui/domain/indieweb.social Just give you a +1 at least ❤️ @stux@mstdn.social @tchambers@indieweb.social @hugo@masto.pt out of curiosity i checked my own domain,  @hugo@masto.pt AV companies continue to do questionable things, no surprises @hugo around 20 years ago various large IRC channels were shut down because they were being used for C&C. I then wrote a test program that made Twitter usable as a C&C frontend. At that time there was still an RSS feed and you could easily search it for commands. I then steganographically hid the commands in cat images that were delivered as PNG. @hugo wait so mastodon safe to use? Also one of my old friends is a cyber security expert that researchers these sort of thing an also crazy about crypto security. |
Gregory's Server
@hugo we are taking that hugely seriously and do think a means of cross-instance warning would make sense…. Certainly posting to #mastoadmin is one way. Bet there could be others.