• 1 Post
  • 25 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle
















  • what I want to stress out at this point is that due to the techniques required to crack a game (dll injection, ssl pinning bypass, syscall hooking and more) are used by malware

    that though leaves you completely unaware if the crack is benign or not. It could be or it could be not. “but it worked fine for me” is also not a good enough pointer as it’s very common practice making the malware run only under certain conditions (after a month, only when the PC is idle or the screen is locked, or make it extremely lightweight - just upload all your browser cookies once a day

    if you get hit by something like this there’s no going back. you need to format. there are very, VERY weird ways that a malware can replicate/hide itself to.

    software has, is and always will be a game of trust. do you trust the cracker? or even the company that makes the software? and if so, why

    I always suggest to never run cracks on a machine that is used to log into personal accounts

    The only crack that I actually trust is mass grave (windows & office crack). It’s a powershell script so you can just read its source code





  • as more people use a software it’s not easier to find exploits but much more profitable - and you see that propagate, as in:

    • More people start to use a software
    • Inevitably it gets hacked - by a kid most probably
    • The company starts panicking due to bad press
    • They start fixing the security bugs
    • (some years pass)
    • Now its quite difficult to find exploit as many security bugs have been fixed
    • Exploit prices skyrocket since it would affect many users and it’s difficult to develop
    • Bug bounty skyrockets since the exploits are so pricey

    Now the last 2 steps tend to cycle since the security of the product fluctuates

    Now the above have nothing to do with “residual” products - such as custom roms. And actually, you have so many deeply specialized people around the main product that finding a bug and developing an exploit on the residual is just a matter of “who the fuck cares”.

    So you’re basing your security of your phone on “care”, also known as security through obscurity (some times at least).

    Another example of “who cares” security is libreoffice. When I started as a security engineer the veteran (and boss) referred to it as training material to find security bugs. I found some, but who cares? Ain’t nobody gonna pay for them as “nobody” uses the software (keep in mind that we’re referring to millions of daily users rather than thousands per month)

    Sorry for sheet! ❤️ Be safe and use a password manager