๐ Megathread of my bots and other services ๐
Iโm both a Discord security auditor and a Discord bot developer, use this thread to find links to everything I have to offer!
๐จ I was just targeted by the same hackers that compromised Giveaway Boat and MEE6 ๐จ
I didn't fall for it, my account is safe, and my bots were not compromised. I even reset my Discord password after interacting just to be 100% sure.
Here's how they're targeting bot staff ๐งต๐
Hey, you! Is your project new to Discord?
Do you want a secure Discord server but you donโt want to spend the money on a "Discord audit"?
Here's a ๐งต explaining how to do it in 3 simple steps ๐
๐ Ledger Nano X Giveaway ๐
๐ Having a hardware wallet is an essential part of keeping your NFTs and crypto safe!
โน๏ธ To enter:
1) Like and RT
2) Follow
@lukenamop
3) Tag 2 friends that are new to NFTs
I will contact the winner in 3 days!
1/ There's a new phishing attack for NFT admin/mod Discord auth tokens going around, hacking/exploiting servers to post fake minting announcements. Recent victims include
@catsinthecups
,
@wolfdotgame
, and
@wendropio
. Read the ๐งต for more info on protecting your community ๐
#ProjectAtmos
holders will be getting a free pfp drop sometime this month...
I just swept 5 NFTs off the floor of
@ProjectAtmos
and I'm going to sweep 1 more for every 5 retweets this exclusive sneak peek gets! Check out the genesis project here (DYOR):
I think I've swept 45
@ProjectAtmos
NFTs by now - way more than I had to, but I love them too much to stop!
I'll drop
#5550
(double Bad RV) + a random floor piece to whoever sweeps the most in the next hour. DM me your wallet address if you participate!
#ProjectAtmos
holders will be getting a free pfp drop sometime this month...
I just swept 5 NFTs off the floor of
@ProjectAtmos
and I'm going to sweep 1 more for every 5 retweets this exclusive sneak peek gets! Check out the genesis project here (DYOR):
Okay, I never post about NFTs I buy, but these banners are from Project Atmos Genesis by
@bloqparty_nft
and I gotta say, Iโm a huge fan! Iโm the proud owner of these 4 ๐ฅ
If someone asks you to test their P2E game on - donโt get tricked into thinking that itโs safe just because itโs on an domain.
Apps and games on TestFlight do NOT go through Appleโs App Store review process. They can be malicious.
Servers hit in the last 8 hours via MEE6:
RTFKT (165k)
Alien Frens (74k)
Cool Cats (101k)
PXN (32k)
HAPE (479k)
Axie Infinity (739k)
PSSSD (80k)
My Pet Hooligans (31k)
Blockworks (6k)
Moonbirds/PROOF (17k)
Memeland/9GAG (238k)
Magic Eden (194k)
โ ๏ธ ๐๐ข ๐ก๐ข๐ง "drag buttons to your bookmark bar" to "verify" on Discord. โ ๏ธ
Honestly, don't ๐ฆ๐ท๐ฆ๐ณ leave Discord to visit ๐ข๐ฏ๐บ link.
6 months later, bookmarklet phishing is still one of the primary things scammers are using to compromise Discord servers. Details below ๐
3/ The end goal is to invite you to a very legit-looking server, take you through a fake verification link, and run code in your browser using what's called a "bookmarklet" to snag your Discord auth token (bypassing your password and even 2FA). This video shows how it works:
๐ค Now announcing: Wallet Collector Discord bot!
Wallet Collector is a FREE bot which allows you to collect wallet addresses on Discord and export them to a spreadsheet. Share to anyone who might need this!
The bot doesnโt need ANY special permissions.
Another day, another free Discord tool:
In-channel captcha verification!
โ No more directing your users to click links
โ No more asking your users to open their DMs
โ Verification handled privately, directly in your server!
โ Free, forever
1/ So, let's recap tonight's events. $2m+ (600+ ETH) of stolen NFTs, originally attributed to an exploit in OpenSea's new listing contract. Here's a ๐งต on what we know, what we don't know, and some of the current best guesses as to what may be happening.
Some servers have reported MEE6 being used to post unwanted messages. There is no technical breach in our systems. This was due to one of our employee's account getting compromised.
โ The issue is now fixed and we've taken all the steps to make sure it never happens again.
๐ Discord Pro-Tip ๐
If youโre making an announcement in your server, put your @ everyone ping at the very end of the message rather than the beginning!
On mobile, Discord notifications only include the first 2 lines. This way, the notification can include actual content.
โ DO NOT open "Developer Tools" or "Console" on your browser. EVER. โ
RT and share.
Sc
@mmers
have found a new way to snag your Discord credentials using these tools. Details below ๐
Hey
@OthersideMeta
, I see your Discord has been compromised. Please reach out to me,
@Jon_HQ
,
@Plumferno
, or
@GrassyEth
. Weโre happy to help you recover at no charge and we can also run a full audit to upgrade your security protocols. Check out our profiles for more information.
โญ What should you expect from a quality Discord audit?โญ
This is what a Discord server security audit report looks like. Each one is 8+ pages long, detailing all changes made to secure the server.
This report follows a format that I developed with
@Jon_HQ
and
@GrassyEth
.
๐ Discord security breaches aren't slowing down. I wanted to build something free to help all servers:
Server Supervisor Discord bot
โ Monitors & logs every webhook update
โ Option to delete existing webhooks
โ Option to filter verified bot webhooks
You may know me from the HENI NFT Discord - I'm also a Discord bot developer and I've created a verified bot called Spam Defender to protect NFT servers from spam and scams. Check out all the info here and tell your friends:
#Discord
#NFTCommunity
3/ The end goal is to invite you to a very legit-looking server, take you through a fake verification link, and run code in your browser using what's called a "bookmarklet" to snag your Discord auth token (bypassing your password and even 2FA). This video shows how it works:
Iโm proud to announce my proprietary security bot, Server Supervisor, is officially Discord verified! If youโd like to learn more about how it works or get it set up in your server, you can check it out here:
My Discord bot, Spam Defender, has been acquired by
@HashbotOfficial
, and Iโll be joining their team as a Project Manager! Iโm very excited for what this means for every community that depends on both SD & HB to keep their servers free from impersonators and scammers ๐
๐ Enable ๐ 2FA ๐ on ๐ Discord ๐
Yes, Discord authentication token compromises bypass any 2FA you might have. However, there are 2 things an auth token *canโt* bypass if you have 2FA enabled:
1) Transfer Server Ownership
2) Delete Server
Iโm going live with
@QueenyMartha
this coming Monday to talk about Discord security, specifically for NFT servers. Iโll have some tips for general users as well as some for project managers, and weโll do a Q&A! I hope to see you there!
Taking down malicious phishing sites left and right ๐
Stay vigilant. If youโre targeted by these sc
@mmers
, please send malicious Discord invites and URLs my way via DM and Iโll follow up to get their shit shut down.
The most secure NFT <-> Discord verification bot on the market,
@VulcanAuth
, just got a huge update!
Now you can migrate roles that you're managing through other bots into Vulcan. No more starting over from scratch!
5/ Some info, if you want to check your servers to see if any of these scammers/hackers are present.
"Staff" user IDs: 959568833331474472
622545616265936896
759990948208967730
847293369553518623
292379315214090241
959569775372144660
7/ Please share this thread to warn as many people as possible. These hackers have been targeting NFT server staff for months but they just recently started targeting Discord bot staff. Stay safe out there friends.
Thanks for the custom
@angy_chubbies
NFT!
My username everywhere is "lukenamop," aka "luke and a mop," and this artist perfectly captured what I was looking for. Now I can clean up the web3 universe, with mop in hand, in true chubby fashion!
Step 2/
Learn the ins and outs of your Discord bot options. This requires ๐ฟ๐ฒ๐ฎ๐ฑ๐ถ๐ป๐ด ๐๐ต๐ฒ ๐ฑ๐ผ๐ฐ๐ and ๐ฑ๐ผ๐ถ๐ป๐ด ๐๐ผ๐๐ฟ ๐ผ๐๐ป ๐๐ฒ๐๐๐ถ๐ป๐ด.
There are important security bots:
- Wick
- Server Supervisor
- Spam Defender
- Good Knight
- Hashbot / Beemo
- Sledgehammer
Solrarity (166k)
Okay Bears (84k)
The Habibiz
Lazy Lions (152k)
HYUNDAI (142k)
Akutars (15k)
Gangster All Star (50k)
A total of 2,765,000 users. Kick MEE6 now until you hear more from reputable security specialists. THIS IS STILL ONGOING.
2/ The predators behind this exploit spend multiple days developing relationships and building trust. It's important to stay on your toes, even while building what may seem like a real relationship! There are a few red flags ๐ฉ to look for which I'll point out.
Looking for a bot to privately and securely collect whitelist/allowlist wallet addresses on Discord? Iโve got one in early beta testing, to be released to the public soon!
Contact me for early access ๐
Happy New Year, everyone! May 2022 bring peace and good fortune to all.
My resolution is to do everything in my power to keep NFT
#Discord
safe by sharing security tips/tricks and continuing to develop the Spam Defender bot into the ultimate
#NFTCommunity
protection machine.
Step 1/
Learn the interaction of every permission on Discord (in both role and channel settings). Here's a quick-start guide:
Make sure to check every role and every channel to be sure nothing slips through. (This includes bots - don't give them Admin!)
To be clear, this is not a new technique. Clicking the image itself isnโt an issue. The issue lies in clicking the โView Originalโ link, which will take you to a website and *then* access your token. Continue to use normal levels of caution when interacting with links and files.
โ ๏ธNew Discord Hack Techniqueโ ๏ธ
If you received a DM with a picture not loading;
DO NOT OPEN IT !
It will steal your Discord session Token and let the hacker change your password and use your account freely
The A2F does not protect against !
Report suspect activity to admins
3/ I didn't click any links or leave Discord at any time. I'm trained to recognize these scams so I was careful the entire time. While I was there, I saw the "staff" (aka hackers) were targeting a bunch of other bot support servers. STAY ON YOUR TOES.
4/ How would you end up at this point in the first place? Someone will reach out offering to hire your or collab with you. They'll probably sound "too good to be true" (๐ฉ
#1
). Over time they'll show you what looks like a legit website and a large Twitter account.
โOut of 3,207 [apps leaking Twitter API keys], 230 are leaking all four authentication credentials and can be used to fully take over their Twitter Accounts and can perform any critical/sensitive actions.โ
Revoke access here:
If you reset all staff Discord passwords and delete all existing webhooks then the current hackersโ access will be fully revoked and you can start recovery.
1.1/ Make sure dangerous permissions aren't assigned to ๐ข๐ฏ๐บ๐ฐ๐ฏ๐ฆ, not even staff, and make sure critical staff have secondary "Cold Admin" accounts. See the quoted thread from
@Jon_HQ
for more info on why this is necessary and how to set it up:
๐จ Jon_HQ Cold Discord Admin Protocol v.1 ๐จ
Something I've been having troubles with explaining to teams is both the setup and usage of Cold Discord Admins for an NFT project.
So here is my guide on both setup, and usage, for free, as always โฅ๏ธ
Ever had a verification bot "break" when too many people try to join? Here's how you can improve this in your server ๐
MEE6 and other "reaction role" bots slow down when too many people try to use them:
I noticed a server in the wild which failed to protect their invite URL as outlined in this very brief thread, so I parked their invite URL for them. Please, make use of this tip! The chance of a friend catching your mistake before scammers do is very low!
๐ Discord Security Tip ๐
Opening & closing a server gives scammers a chance to โstealโ your invite URL and trick people into joining the wrong server. If you use a vanity URL, you need a 2nd server at full boost level to โparkโ your invite URL when you arenโt using it.
I'm back with another useful YAGPDB custom command! This one will let you bulk assign a role to up to 45 members at a time. It works with both @ mentions and raw user IDs.
You can copy the code here:
Another
#NFT
#Discord
security audit complete, this time for
@RedKiteNFT
! They brought me in a few days ago to help secure everything for their community. I left them 4 pages of notes, but thatโs one of the โeasierโ audits Iโve done lately! ๐
If you missed our chat today we discussed security, audits, bots, alternate platforms to Discord, how to protect servers, and just generally shared as many tips as possible. Weโre going to try to do this weekly! Most likely Fridays at 8pm US EST.
Scammers can use bots to hide scam links behind real links.
Never trust links on Discord, especially if they're sent by a bot.
This scam will steal your Discord authentication token, which even bypasses 2FA.
All project staff are targets of this scam.
โ ๏ธ ๐จ๐ฝ๐ฑ๐ฎ๐๐ฒ ๐๐ฝ๐ฝ๐น๐ฒ ๐๐ฒ๐๐ถ๐ฐ๐ฒ๐ ๐๐ฆ๐๐ฃ โ ๏ธ
One of these exploits can be triggered by "maliciously crafted web content [that] may lead to arbitrary code execution." Don't sleep on this. If you have an Apple device, you're being targeted by these exploits.
6/ These are the primary phishing attempts we're seeing from hackers like this:
1: Scanning a QR code (usually via a fake Wick bot).
2: Asking you to drag a "bookmarklet" (aka button) into your browser's bookmark bar to verify.
4/ I've already let these bot servers know they're being targeted, but I still recommend reducing the total bots you're using and limiting permissions of the bots you're using to the minimum they can possibly have while still functioning properly.
Discord Transparency Report: โOne notable trend is that accounts disabled for authentication token theft rose by 740% (in Q3 and Q4 2021).โ
Itโs clear Discord is aware of the hacks on their platform. Hopefully they take steps to protect communities.
The official OpenSea Discord server was compromised a few hours ago. EVERY SERVER can be hacked, no matter how professional your team is. The best way to reduce the chance of compromise is to bring in a full-time security specialist to perform an in-depth audit.
1/ A user joined my Spam Defender support server and immediately DMed me asking to "collab" (๐ฉ
#1
). They directed me to open a ticket in their server (๐ฉ
#2
). The server's "verification" had two steps. The first step was a typical "reaction role" button.
... ๐ผ๐ฟ ... you could save yourself hours, days, WEEKS, of work by bringing in an auditor who spends every day doing everything I've detailed in this thread.
Well-reviewed auditors may not be cheap, but they can jumpstart your community and provide lasting protection.
5/ If you look closely you might notice that they aren't followed by anyone you're following (๐ฉ
#2
) or that their account is even stolen/purchased (๐ฉ
#3
). See the screenshot in this Tweet:
Another tweet coming out very shortly about today's compromises, but here are two little red flags to look out for if an NFT project approaches you about a collaboration...
This twitter account is a scam, if you join their Discord it'll try to get you to verify and phish you.
โ ๏ธ DISCORD SECURITY ALERT
The "Manage Roles" permission gives Discord mods the ability to enable this permission for roles in your server, even if they *don't* have "Mention Everyone" perms.
IF MODS HAVE "MANAGE ROLES", THEY HAVE THE ABILITY TO @ YOUR VERIFIED ROLE.
10/ With new forms of phishing exploiting big-name projects left and right, it's important to stay ahead of the game. Find sources you trust and follow them for more info like this. I personally like
@Jon_HQ
,
@Plumferno
,
@ddotFi
,
@wilxlee
to name a few.
Hey, you! Is your project new to Discord?
Do you want a secure Discord server but you donโt want to spend the money on a "Discord audit"?
Here's a ๐งต explaining how to do it in 3 simple steps ๐
@alsaai_eth
@NFTherder
Hotshot says he blurred out the context "to shine a light on the behavior, not calling out the ppl or project involved." I, for one, am happy to be associated with the words I've written. Here's the full context.
2/ The second step was a fake external link that asked me to add a bookmarklet to my browser (๐ฉ
#3
) and then click it to verify and join the server.
1.3/ User roles should be sorted from highest permissions to lowest permissions.
"Vanity roles," to give cool colors or titles, should have no permissions.
In general, channels should not have any explicit โ /โ permissions except "View Channel" and "Send Messages."
Flashy graphics and marketing tactics don't replace detailed written reports. Look for someone who will be available to help you as things evolve long-term.
Someone like
@Jon_HQ
,
@Plumferno
, or one of the many other auditors contributing to the public
@Server_Forge
community.
@Jon_HQ
@Server_Forge
ServerForge is one of the most unique communities Iโve ever been privileged to be a part of. Itโs so incredible to see info and resources spread far and wide by every member of the group. Keep up the good work, everyone ๐
1.2/ Aside from explicit permission settings, you also need to give some attention to the role order (or hierarchy). If this is wrong, all your hard work setting permissions would be for naught.
Bots should be no higher on the role list than they need to be.
This is the last tweet in a thread from Giveaway Boat detailing how the dev was compromised (fake verification bookmarklet scam) and how the hacker was able to use the bot (โevalโ command that may have exposed the botโs token). This is โresolved,โ but I wonโt use this bot again.
As for how they got access to the bot's token when I had 2FA enabled, the only likely way is that they used eval command in the bot using my account, which is a cmd that many devs use to run codes privately.
This might be the only way they could get token, I've removed it now!
6/ When you're starting to think they might be trustworthy, they'll invite you to check out their Discord and help you through their fake "verification" process, stealing your auth token. As soon as they have your token they have full access to your account, even if you have 2FA.
๐ค Wallet Collector bot
- Collect wallet addresses on Discord
- Export submitted addresses to a csv spreadsheet
- Only allow users in specific roles to submit their wallets
- Does not require any server permissions
Docs & Invite:
Price: Free
๐ Discord Security Audit Service
- Audit & update all settings, permissions, roles, and channels
- Audit & update existing bots
- Set up additional security bots
More info: Message me or schedule a free introductory call at
๐ Discord Security Tip ๐
A day or so before your mint (or other scheduled events), have all of your moderators and team members reset their passwords. Even if they have 2FA! This will reset their Discord auth tokens and boot out hackers lying in wait.
Introducing Stormwatcher โ๏ธ detecting wallet drainers without even having to connect your wallet or simulate a transaction.
Watch it in action now โฌ๏ธ
๐ก Discord Security Tip ๐ก
Don't give your mod team "Manage Roles" permission! If they need to be able to assign whitelist roles, use this YAGPDB custom command I wrote. Reach out to me if you need help with this. Once it's set up, it's as easy as "-whitelist
@lukenamop
"!
Look for someone with positive reviews from other auditors, not just someone that other project founders recommend.
Look for someone who has a track record of proactively providing public, free resources, who will go out of their way to protect servers they don't even work with.
Feel like the chips are down? Spend some time improving yourself:
โข Take an online class
โข Reach out to someone you haven't talked to in a while
โข Go hiking/climbing/running/biking
โข Help your local community
Things will bounce back, take advantage of your downtime!
An update on this free tool:
I just made the source code for a standalone version of Server Supervisor's Webhook Protection feature available to the public here:
๐ Discord security breaches aren't slowing down. I wanted to build something free to help all servers:
Server Supervisor Discord bot
โ Monitors & logs every webhook update
โ Option to delete existing webhooks
โ Option to filter verified bot webhooks
9/ Okay, what if you or someone you work with falls for this and their auth token is grabbed? Immediately reset your password! Even though the auth token bypasses your password and 2FA, resetting your password will actually also reset your auth token and they will lose access.
Step 3/
Research the various attack vectors scammers use to compromise Discord accounts. Bookmarklets, QR logins, etc.
Understand how to protect your staff from these attacks (hint: 2FA is definitely recommended, but it will ๐ป๐ผ๐ protect you from these phishing scams).
3.1/ This one is kind of on-going. Scammers are evolving & innovating every day. You're going to want to check for new trends fairly often to make sure you don't miss anything and can give your team plenty of warning.
@Jon_HQ
To add to this: It's okay to admit you made a mistake! Everyone does. This happens to be a mistake that has huge repercussions, but it's better to admit and work to make amends than brush it under the rug and pretend like nothing happened.
To clear up what happened last night:
1) Captcha Bot is not hacked!
2) Ticket Tool had an issue with the โaddโ command which allowed people to add Manage Webhook permissions to themselves.
3) Ticket Tool was the only problem.
4) The โaddโ command was fixed last night.
๐ Discord Security Tip ๐
Opening & closing a server gives scammers a chance to โstealโ your invite URL and trick people into joining the wrong server. If you use a vanity URL, you need a 2nd server at full boost level to โparkโ your invite URL when you arenโt using it.
2.3/ And, don't forget, you're going to want to limit the permissions of each bot as much as possible. By default, most bots will ask for more permissions than they actually need to function, which creates additional risk.
This Discord error is affecting all bots, including Spam Defender and Server Supervisor.
For Spam Defender, the protection features are still working but all /commands are down. For Server Supervisor, webhook protection is working but all verification panels are frozen.
โ ๏ธ DISCORD BOT WARNING โ ๏ธ
Discord has introduced an API error that is causing most bots to respond with "<bot-name> is thinking..." when executing a command
All we can do is wait until discord fixes this
Here are some examples of accounts Spam Defender can protect your community from, these are accounts that attempted to use alternate fonts & symbols to sneak in, but they were caught immediately. More info available here:
macOS is becoming more โhackable.โ If you use a Mac, please be wary of the things you download so you donโt inadvertently install something like this. Stay safe, friends!
#ALERT
we have observed A new macOS information-stealing malware named 'Atomic' (aka 'AMOS') is being sold to threat actors via private Telegram channels for a subscription of $1,000 per month. And I just got in.
#cybersecurity
#infosec
#malware
#macOS