I had a bit of luck with this one, and it didn't cause more pain to everyone because of two important things:
- People reacted in several places, urging me to take action! - VERY IMPORTANT!
- I was luckily awake (and around) because I was troubleshooting something on my Hive API node, so I could take action and stop the idiot.
But first...
THANK YOU ALL! 😳😍
It's in these times that I really feel humbled by the huge Hive family we have around the world. Trying to help, protecting others, making sure the "hacker" does minimal damage.
In these situations, the best direction is always to protect first, investigate later. So, when these things happen, change your passwords, check that your MFA still works, log out of all sessions from everywhere (apps should have this flexibility; otherwise don't use them), and very importantly, review access to the logins/APIs/apps permissions to your account (I will go into detail about what happened below).
If you do this, you can at least stop whatever you might yet NOT understand why or how. And in this case, this is related to the Discord app, but it could have been related to any other app, for that matter. If needed, even disconnect from the internet, etc...
When and How I noticed?
Yesterday (for me) around 3:42 PM to 3:44 PM UTC, my Discord handle DMed a couple of people I had chats with, some MrBeast spam, and also set those DMs to "Ignore" and "Muted". This tactic ensured that even if I was around (which I was), I could not notice the process... because DMs that are muted can't notify me, and if they are ignored, I can't see them anymore on Discord (and it requires you to go check which ones you ignored in order to unignore).
What the idiot forgot was that I have a ton of people interacting with me, and after a while I was finding it a bit weird having so much interactivity with me at that time of the night. And I decided to check... and found out!
What happened then?
After changing passwords and checking my sessions, I quickly tried checking if this was an account hack (or possible bug) but I had no suspicious sessions, so it didn't explain (although they could have stolen my fingerprint too), and then I decided to check all the Authorised Apps to my Discord and found two old ones (out of 3) that I haven't used for ages, which had write permissions to my account. And then I thought it could have been write permissions from the app that could have done this... one of them I know was hacked in the past, and this app had write permissions, hence my first suspicion.
But now, after reading and learning a bit more, Discord says it blocks this kind of ability... for explicit DMs etc... so either your cookie was stolen, and the hacker didn't manifest itself until sometime in the future (quite possible), or something else I don't yet quite understand. Either way, I can't even verify, so even if Discord says it can't happen via app permissions, I can't say otherwise because I don't have access to the code.
I had 3 apps that had write permissions, and 2 of them I was suspicious about (one of them because I know they got hacked).
I am now waiting for Discord to compile the logs for me to download them and see if I can trace things back more accurately, and if I find anything plausible, either going to create a report for the police, or going to just reach out to the app.
Moral of the story...
Maybe the best with web2 is to constantly change passwords/tokens, etc every week/month/year (whatever is deemed necessary)... because the level of crap that is out there becomes really hard for any of us to monitor 1000 things. And you will get compromised... I can tell you that! It's not if, it's when, so the more prepared you are, the better.
Check for things you might not recall doing... which often tells you something is already hacked. And that should tell you, go change the password NOW! If it was just amnesia, you don't lose much... if it's a signal of a compromised thing, then you can avoid it, hopefully in time.
Also check things you don't use anymore and uninstall them, deauthorise them, etc... this is probably the biggest fail of many, and hackers use these things to get either additional information or trigger situations that can make you expose secret stuff. And if you suspect something weird happened (which I think it might have been the case with me), and nothing happens immediately, change passwords just as a precaution. I failed to ignore something weird that happened on a Discord channel a while ago, and I suspect it was that... which tells me how much this hacker wants to deceive me (or just had me on the victims list for "one day").
Once I get the logs, maybe I will find out more.
Fricking idiots! 🤬
At the same time, of this...
Because yesterday I had a crash of my API node, it coincidentally made all my day really crap, hence why I was up in the middle of the night. But this was coincidental, as the server hung into a mode that could not even reboot, but it was powered on, and no console screen, nothing, and I had to force reboot it. First time this happened, so hopefully it's just "DUST", hence why yesterday it was a good moment to do a general cleanup.
Stay vigilant!
This is always very frustrating, and all it does is make you lose time... Not that I think someone is after me, but I am gathering more and more evidence that they know where I live and the attacks are on purpose in the middle of the night. Hopefully I am just delusional.
