106 pointsby Cider99869 hours ago13 comments
  • gnabgib8 hours ago
    This seems to lack the full story, despite the headline.. Krebs' coverage is more in-depth (39 points) https://news.ycombinator.com/item?id=46976825
    • darig2 hours ago
      [dead]
    • walletdrainer2 hours ago
      [flagged]
      • notpushkin2 hours ago
        Could you elaborate a bit? It’s hard to take such a claim seriously without any evidence presented.
        • walletdraineran hour ago
          Every single person who has bought the phishing kit claims the seller is a scammer. Krebs’s article is based entirely on the sellers description of the (imaginary) product, rather than actual observation of the phishing kit in the wild.

          See the exploit.in thread for example https://temp.sh/XOWUP/STARKILLER_V6.0.1___ULTIMATE_WEAPON__B...

          Krebs has access to these forums, he could’ve checked this story out in less than 3 minutes but did not.

          Even if Krebs wasn’t a subject matter expert, it’s still inexcusable that he didn’t do the most basic work here. You don’t need to frequent underground runet forums to know that a journalist should be able to verify the stories he puts out.

          I think it’s also particularly telling that he didn’t bother to source reasonable quality screenshots for the story, which he would have been able to do had he ever witnessed this phishing kit working.

          • Roark66an hour ago
            >See the exploit.in thread for example https://temp.sh/XOWUP/STARKILLER_V6.0.1___ULTIMATE_WEAPON__B...

            "Maximum download limit reached" - it's gone. Also, not present in the archive.org :-(

          • pests29 minutes ago
            > Krebs’s article is based entirely on the sellers description of the (imaginary) product, rather than actual observation

            I noticed. While researching I had a feeling of "is this just makeup on a pig?". Anyone can make pretty graphics or make claims. I tried reading a few selling points and I was weary.

            One claimed to handle a MFA token handover and then somehow got access to the token and they could proxy it for you? The user types in the MFA token, they get the token. I cant figure out how they would bypass all browser protections to pass on the highly-secured token via a proxy. I've been online for 25 years, I understand on a deep level on the internet works and the web and what is happening in this situation, as I'm sure most here are.

            Without a 0day, this just doesn't make sense. But this is pretty technical, and unless you hang out here then the above sounds perfectly reasonable but to us sounds like bullshit.

            > he didn’t bother to source reasonable quality screenshots for the story

            Also noted. Quickly found better quality versions myself with a quick search.

      • pests2 hours ago
        This is so odd. I tried to verify your claim and I give up. It might be but I really hate how information is becoming like this. There is other reporting out there on "Starkiller" (the phishing kit in kerbs most recent post) and I can find other articles on it, but sources seem to be circular. The source mentions Jinkusu forums, which do seem to be real, but any links I find aren't loading for me and still no conclusive findings of Starkiller.
        • walletdraineran hour ago
          https://temp.sh/XOWUP/STARKILLER_V6.0.1___ULTIMATE_WEAPON__B...

          These forums are mostly private, but Krebs certainly has access to them. There can really be no excuse for how he handled this.

          There are multiple posts by people in different places claiming to have bought this phishing kit, and then being delivered totally non-functional vibecoded garbage. The vibecoded garbage is not the advertised product though, as the author never managed to get the AI to finish his project.

          • pests25 minutes ago
            I figured the forums were real, just was blocked for some reason so thanks.

            I do not doubt this story for a second. Its crazy Kerb's is basically freely advertising this blackhat slop.

        • flipped20 minutes ago
          Krebs lack any sort of real credibility. He's pushing out slop with a govern-mentalist propaganda. Tech journalists are the worst form to gather any actual information.
  • jjmarr7 hours ago
    From the main article, I2P has 55,000 computers, the botnet tried to add 700,000 infected routers to I2P to use it as a backup command-and-control system.

    https://news.ycombinator.com/item?id=46976825

    This, predictably, broke I2P.

    • infogulch7 hours ago
      That's an interesting stress test for I2P. They should try to fix that, the protocol should be resilient to such an event. Even if there are 10x more bad nodes than good nodes (assuming they were noncompliant I2P actors based on that thread) the good nodes should still be able to find each other and continue working. To be fair spam will always be a thorny problem in completely decentralized protocols.
      • 01HNNWZ0MV43FF4 hours ago
        Finding good nodes is a thorny problem for human friendship, too!
        • kkfx2 hours ago
          That's why the Web of Trust, or classic GNUPG key signing parties are a forgotten/ignored must have. Anyone can change and go rouge of course, but it's statistically less likely.
      • sandworm1016 hours ago
        No. They should not try to survive such attacks. The best defense to a temporary attack is often to pull the plug. Better than than potentially expose users. When there are 10x as many bad nodes as good, the base protection of any anonymity network is likely compromised. Shut down, survive, and return once the attacker has moved on.
        • conradev3 hours ago
          This is why Tor is centralized, so that they can take action like cutting out malicious nodes if needed. It’s decentralized in the sense that anyone can participate by default.
          • notpushkin2 hours ago
            > so that they can take action like cutting out malicious nodes if needed

            How does that work?

            • cypharan hour ago
              While anyone can run a Tor node and register it as available, the tags that Tor relays get assigned and the list of relays is controlled by 9 consensus servers[1] that are run by different members the Tor project (in different countries). They can thus easily block nodes.

              [1]: https://consensus-health.torproject.org/

              • flipped29 minutes ago
                It's 10, not 9. And there are severe problems with having a total of 10 DA be the essential source of truth for whole network. It would be trivial to DDoS the DAs and bring down the Tor network or at the very least, disrupt it: https://arxiv.org/abs/2509.10755.

                It's the only complaint I have of the current state of Tor. Anyone should be able to run directory authority, regardless if you trust the operator or not (same as normal relays).

        • 5 hours ago
          undefined
        • martin-t6 hours ago
          Why would an attacker move on if it can maintain a successful DoS attack forever?
          • flipped25 minutes ago
            The mentioned botnet didn't intentionally take down I2P. It's run by bunch of kids who don't know what they're doing.
          • xmcp1235 hours ago
            Because botnets are mostly there to make money nowadays. Or owned by state actors.

            Either way, it’s opportunity cost.

    • Dylan168072 hours ago
      I guess "predictably" is valid but what actually went wrong? After going through multiple sources I can't tell if the botnet nodes were breaking the protocol on purpose, breaking the protocol on accident, or correct implementations that nevertheless overwhelmed something.
  • kace917 hours ago
    Man, I feel so out of depth with cybersecurity news.

    Why does i2p (per the article) expect state sponsored attacks every February? Where are those forming from, what does the regularity achieve?

    How come the operators of giant (I’m assuming illegal) botnets are available to voice their train of thought in discord?

    • WaitWaitWha6 hours ago
      > Why does i2p (per the article) expect state sponsored attacks every February?

      Because The Invisible Internet Project (I2P) allows government dissidents to communicate without the government oversight. Censorship-resistant, peer-to-peer communication

      > Where are those forming from, what does the regularity achieve?

      At least PR China, Iran, Oman, Qatar, and Kuwait. censor communication between dissidents.

      > How come the operators of giant (I’m assuming illegal) botnets are available to voice their train of thought in discord?

      How would you identify someone as 'operators of giant botnets' before they identified themselves as 'operators of giant botnets'?

      please read https://en.wikipedia.org/wiki/I2P

      • margalabargala4 hours ago
        Sure, but why February and not the other 11 months?
        • n2d42 hours ago
          Likely it's just a coincidence — there were other Sybil attacks that are not in February too, so the chance that you'd get 3 in Feb isn't all that low.
      • Zambyte5 hours ago
        This answer is missing the key "regularity" part of their questions, which I would love to know more about.
        • braingravy5 hours ago
          That’s a great question… Currently we’re in the main Chinese holiday period with the Lunar New Year/Spring Festival/Chinese New Year, so perhaps people traveling back home from foreign lands might use the service more during this time?
    • OgsyedIE7 hours ago
      Many state bodies involved in adversarial action have dedicated budgets for offensive cyber-warfare, credential thefts, supply chain compromises and disinformation. If they haven't used all of their budget by the end of the budget period, they'll be allocated a smaller budget for the next budget period.
      • rollulus2 hours ago
        Cool theory but that should result in other attacks that peak in February too, can you give examples?
      • kace917 hours ago
        Oh ffs. Whenever I think my opinion on the state of the world can’t get any lower, things somehow manage to get dumber.
        • flipped23 minutes ago
          State sponsored cyber attacks are news to you? It's been a thing since more than 2 decades now.
        • bryanrasmussen7 hours ago
          I mean this is a common pattern in many large organizations, governmental and non, if you didn't use your budget it means we can save money, yayyyy! I hadn't really considered it would apply to state-backed hacking but makes sense.
        • busko4 hours ago
          [dead]
  • charcircuit4 hours ago
    >hostile nodes

    >they accidentally disrupted I2P while attempting to use the network as backup command-and-control infrastructure

    So were they hostile or were they using it normally?

  • shevy-java2 hours ago
    > The I2P development team responded by shipping version 2.11.0 just six days after the attack began.

    Not wanting to be overly critical, but any net-infrastructure project kind of has to keep bot-attacks in mind and other attack vectors, in the initial design stage already. Any state-actor (and other actors, though I would assume it is often a state financing the bot network behind-the-scene) can become potentially hostile.

  • Roark6640 minutes ago
    Is there a shittier summary anywhere, please? Or did the author reached the peak of enshittification?

    Honestly, did the bot implementation have bugs or was it a proper implementation that crashed the network due to sheer numbers?

    Also, how does changing the encryption standard affect anything if the bots tried to integrate correctly with the network?

    Is the problem "fixed" or is it not? Elsewhere I found large number if botnet devs got pissed off with this botnet operator and 600k nodes went offline. Might this have much more to do with the situation getting better than simply changing encryption?

    Also, was there any suggestion a quantum breaking attack was attempted? No. So why put the emphasis on "post quantum" in this article?

    Bad. Very bad.

  • pmontra4 hours ago
    This seems to be a better post about what happened, from the same site https://www.sambent.com/i2p-2-11-0-ships-post-quantum-crypto...
    • nneonneo3 hours ago
      Those are some weird-ass visualizations. I can only assume they were AI-generated.
    • KennyBlanken3 hours ago
      I'll save everyone else a click: AI slop text coupled with the strangest, most pointless visualizations I've ever seen.
      • SV_BubbleTimean hour ago
        Speak for yourself!

        I didn’t really understand the link between Alice and Bob until I saw a green floaty dot go through a pile of spaghetti with the word compromise beneath it.

  • rollulus2 hours ago
    This article (with high slop vibes) and another article on their site (linked in the comments) seem to suggest that post quantum encryption mitigated the Sybil attack, without explanation. I fail to understand how the two are even related.
  • hoppp5 hours ago
    Isn't I2P java? The botnet uses java? I thought python or C is preferred for that kinda stuff
    • mhitza5 hours ago
      The official router implementation is Java. i2pd is an alternative written in C++.

      Once established communication can transparently be processed through a socks proxy, or integration with SAM or similar https://i2p.net/en/docs/api/samv3/

    • rippeltippel3 hours ago
      Communication between bots use network protocols, it doesn't matter in which language those protocols are implemented.
    • monero-xmr5 hours ago
      Computers are so fast it doesn’t matter
      • flipped18 minutes ago
        "Since the abstraction layers have quadrupled, let's not just care about the actual performance anymore!"
  • illusive40807 hours ago
    Why does Discord allow a server for a botnet owner?
    • chmod7756 hours ago
      There's servers where they just hang out, but which themselves are legitimate. Cybersecurity related ones etc. You can ban them and they'll just switch to another account within a minute. Occasionally discord or a server owner does, but everyone knows its pointless. There's probably other servers that are mostly used by cybercriminals, maybe command-and-control backups, and security researchers may stumble upon these when taking some malware apart, join them, and end up getting in contact with the owner.

      In general I don't think law enforcement wants discord to take these down or ban them. These guys would have no problem to just make some IRC servers or whatever to hang out on instead, which would be much harder to surveil for law enforcement - compared to discord just forwarding them everything said by those accounts and on those servers.

    • samus3 hours ago
      Why wouldn't they? There are Discord servers about anything you can imagine and also what you can't or don't want to image. As long as they don't start disrupting their infra Discord couldn't care less.

      Also, how would you even go about classifying them as botnet operators?

    • ddtaylor7 hours ago
      Discord has a lot of terrible servers. This is one of the reasons they were not trusted when they came out and wanted to do identity verification. They already have a lot of information yet fail to do meaningful enforcement at scale.
      • Aurornis3 hours ago
        Only a couple years ago the outrage was that Discord was too eagerly banning servers and users.

        I know several people whose Discord accounts were banned because they participated in a server that later had some talk of illegal activities in one of the channels. There are similar stories all over Reddit.

    • xmcp1235 hours ago
      Ever tried to ban a botnet owner from a service they want to use?

      It’s basically impossible. They have money, IPs, identities, anything you could possibly want to evade.

      • bee_rider4 hours ago
        It would be pretty funny if the age verification stuff blocked some of these folks.
        • Aurornis3 hours ago
          Discord age verification is only for content filters, adult-themed servers, and a few other features.

          They aren’t requiring age verification for everyone to join servers and chat. The headlines and panic really got away from the actual story.

      • Cider99865 hours ago
        They are rich in regard to the tools needed to abuse services haha.
      • charcircuit4 hours ago
        If you just look at the messages in those kinds of discords. It's blatant. They aren't even trying to hide it.
    • bawolff5 hours ago
      I imagine because banning these things is both whack-a-mole and like finding a needle in a hay stack.
    • fragmede7 hours ago
      botnet owners don't typically come forwards and say they are trying to run a botnet, so there may be some difficulty in detecting them there.
    • fragmede7 hours ago
      botnet owners dying typically come forwards and say they are trying to run a botnet, so there may be some difficulty there.
  • Cider99865 hours ago
    The video seems to be a bit more in-depth.
  • richardfey6 hours ago
    I wonder how cjdns would have handled this
  • cookiengineer4 hours ago
    This was one of the worst writeups I ever read. Even a LinkedIn Premium post would have had more technical details, lol