Startups in 2018

I have written a Chromium plug-in that, upon requesting a web site under the

.io

TLD, instead redirects me to a Russian virus site and downloads Ransomware. Such is the state of Startups in 2k18.

testicle-sized brain: bumping everything
coconut-sized brain: saging threads that you disagree with
earth-sized brain: polite sages
sun-sized brain: saging every thread but your own
galaxy-sized brain: saging every thread, including your own
universe-sized brain: starting your own thread with a sage
god: not posting anything because you are a nude man living in a mountain without any electricity.

I'm making my own programming language. It's called A++ (short for Autism)

I cannot even trust my back button anymore. Gratuitous overuse of the

history

API should be stopped. Of course, half of the time it's broken, so I click on the link, the URL changes, and nothing happens because there is a

js

error in the 800-LOC function handling state change.

>>4
Recent API change often. For example pre 52.x Firefox javascript and post 52.x are from different standards.
https://developer.mozilla.org/en-US/docs/Web/JavaScript/New_in_JavaScript/ECMAScript_Next_support_in_Mozilla

Ransomware is old news. It's all about crypto miners.

>>6
i think most people would rather get infected by crypto miners than randomware

>>7
yeah but what I'm saying is that crypto miners are a newer trend that make more sense from a malware developer's standpoint because very few people pay the ransom and it's harder to cash out and all that jazz

crypto miners? no need to get someone to run an executable or install flash, all you need is javascript and visitors going to an insecure website

Crypto miners are trivial to thwart because many modern browsers have scripting protections out of the box, so you're counting on a user actively allowing the payload. It's similar with ransomware, but a single user will net you multiple bit coins and not $0.0012/hour.

corporations would and do definitely pay the ransom

>>10
not if they have backups

>>9
you have to get a user to run an executable in order for them to get your ransomware payload

but there are just javascript-based crypto miners that will run in a browser tab, no need for special permissions or trying to get the user to run an executable

literally all you need for crypto mining is to get someone to visit a website

sometimes possible with flash-based exploit kits for ransomware, but fewer and fewer people use flash

>>12

literally all you need for crypto mining is to get someone to visit a website

How long are they gonna stay on it?

>>13
Doesn't matter. There will be tons of visitors, but you don't need to put any extra effort in. Find a website with a file upload or file inclusion vulnerability, then add a link to a Monero JS miner or some shit, and that's literally all you have to do. Ransomware takes so much more effort. More effort per person, and there's a low success rate too. And people get upset about ransomware too. And crypto miners seem less mean too. Ransomware is definitely mean.

Ransomware is potentially more profitable, but also takes more effort. JS crypto miners are super easy. Good for lazy people.

I'm not advocating for doing either of these things, as they are both illegal. But if you had to pick one, JS miners are easy and not that bad. Less profitable? Maybe.

Let me elaborate: file inclusion leads to a web shell, which can be used to edit web pages to include the script link, which will run unbeknownst to the users. You can even try to rate limit it so that it doesn't cook their CPU.

This is all theoretical, of course, since I don't do malware stuff.

>>14

There will be tons of visitors,
Find a website with a file upload or file inclusion vulnerability
you don't need to put any extra effort in.

Finding a large city like that with such a vulnerability that doesn't patch it out very fast isn't easy.

>>16
I guess. Less profitable? Sure, but also less effort.

Ransomware involves:
•Cryptography
•Packing/polyloading/polymorphism (to get around AV)
•Veil framework or some other stealth shit
•Social enegineering
•More in-depth knowledge of software development to actually make the ransomware -- maybe C or C++ with GTK+ for a simple GUI
•C2 infrastructure
•Tor hidden service or some shit -- a secure way for the ransomware to connect to a server that will contain the decryption keys
•Customer support (yes, really -- people who are dumb enough to get ransomware are too dumb to figure out how to use Bitcoin, so you need to help them)
•Bitcoin address(es)
•Some way of cashing out, which is easier said than done
•Spamming or otherwise getting people to click on your ransomware and running it -- possibly a trojan via some shit like CreateRemoteThread
•If you want it to be browser-based, you need a dark web EK like Sundown EK or whatever it is that people use these days -- but the problem is that more people are on mobile than desktop OSes, and even on desktop platforms, modern browsers typically have click-to-run for Flash
•Requires stolen credit cards if you want to buy ads on websites in order to drive traffic to your ransomware site (or in some cases, you can just use Flash ads to directly deliver the ransomware to people on sites that have ads (assuming the user doesn't block ads), but many ad agencies vet ads and disallow malware)
•Etc.
One problem with ransomware is it's usually Windows-only, so you will miss out on some potential victims. Of course, I've heard of things like traffic distribution systems like Keitaro, so in theory you could deliver different payloads to different users, but that's a lot of effort, don't you think? Also, some people actually do have backups, so they won't pay the ransom. Or some people simply can't afford to pay the ransom. So infecting someone with ransomware doesn't guarantee that they'll pay.

JS crypto mining involves:
•Using Tor, but not needing to set up a Tor hidden service for a server
•Shodan or something else for mass scanning (like masscan) to find insecure sites
•Basic knowledge of web shells and file inclusion or file upload vulnerabilities
•Adding <script src="miner.js"></script> to a web page
•Monero/CoinHive shit

Which do you think is easier?

Obviously, you shouldn't do either of them.

And I completely forgot to mention the browser locker tech support scam, which spawns pop-ups (or alert boxes or something?) to make it so a user can't click out of it, and then you trick them into paying for fake antivirus.That one is browser-based and OS-agnostic, which gives it the advantage over ransomware. Scammers like that usually charge around $400 or so.

These days, people are less likely to install things. They're less trusting of .exes and .dmgs. But they still go to websites. Web-based scams and malware is where it's at. Client-side shit is for boomers who still think of computers as primarily offline devices.