• RobotToaster@mander.xyz
    link
    fedilink
    English
    arrow-up
    88
    ·
    2 months ago

    HBO also noticed this bonus episode through its anti-piracy partner Marketly and took action in response. A takedown notice posted in the Lumen Database shows that the company asked Google to remove an “infringing” link to the non-existent release earlier this week.

    They’re claiming to own the copyright to the Trojan horse?

    • Fonzie!@ttrpg.network
      link
      fedilink
      English
      arrow-up
      27
      arrow-down
      1
      ·
      2 months ago

      I think they’re issuing a take down notice for using the name and posing as them.

      • FaceDeer@fedia.io
        link
        fedilink
        arrow-up
        21
        ·
        2 months ago

        “Takedown notice” has legal meaning, it’s not some random cease-and-desist letter that you can draft for anything you want and that has no legal weight other than that it might be scary.

        • millie@beehaw.org
          link
          fedilink
          English
          arrow-up
          1
          ·
          2 months ago

          Using someone else’s IP, such as claiming that something you’re distributing is an episode of their show, most certainly qualifies for a valid DMCA takedown notice.

          • FaceDeer@fedia.io
            link
            fedilink
            arrow-up
            9
            ·
            2 months ago

            DMCA is about copyright (that’s what the “C” is). The name of a show isn’t copyrighted, it’s trademarked. Different type of IP altogether.

  • Kanzar@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    71
    ·
    2 months ago

    Suspect Sonarr users didn’t have any issues, as it wouldn’t have gone looking for an episode 9.

    • Appoxo@lemmy.dbzer0.com
      link
      fedilink
      English
      arrow-up
      6
      ·
      2 months ago

      They need to go through tvdb anyway and then it would need to be added by a user. Afaik it takes a while to be propagated to sonarrs skyhook/tvdb integration.

  • jet@hackertalks.com
    link
    fedilink
    English
    arrow-up
    48
    arrow-down
    1
    ·
    2 months ago

    This isn’t exactly special. People have been putting viruses into torrents forever.

    You should assume anything you download from the internet has a virus!

    • Tar_Alcaran@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      43
      ·
      2 months ago

      What? Are you telling me that “baby one more time.mp3.exe” I got off of Napster isn’t actually reliable? Gasp!

      • jet@hackertalks.com
        link
        fedilink
        English
        arrow-up
        12
        ·
        edit-2
        2 months ago

        This is a perfect use case for having a VM, to handle all of your downloads before you play it.

        Quite frankly in the bad old Napster days, when you downloaded random shit, if it only had a virus you were lucky, there was a tendency for MUCH worse surprises to be included.

        • yo_scottie_oh@lemmy.ml
          link
          fedilink
          English
          arrow-up
          4
          ·
          2 months ago

          Aren’t we still vulnerable through VMs, though? I seem to remember reading something about why Qubes OS is safer than a regular VM, having to do w/ zero trust, etc.

          • jet@hackertalks.com
            link
            fedilink
            English
            arrow-up
            8
            ·
            2 months ago

            Qubes has more layers to the security onion, its true.

            But a VM is still a REALLY strong level of containment.

        • Taleya@aussie.zone
          link
          fedilink
          English
          arrow-up
          4
          ·
          2 months ago

          My fave was spending a weekend downloading the good omens radio series to find it was Queen’s Greatest Hits

        • BigDanishGuy@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          2
          ·
          2 months ago

          there was a tendency for MUCH worse surprises to be included.

          Yeah, like strange unreleased Weird Al tracks with sex and drugs references… Every spoof was labeled weird Al back in 2000

  • AsakuraMao@moist.catsweat.com
    link
    fedilink
    arrow-up
    39
    ·
    2 months ago

    The torrent was titled as .mkv (normal and expected) but the actual file was .lnk (not normal)… so you would have had to open a weird random .lnk file to activate the trojan?

      • Uriel238 [all pronouns]@lemmy.blahaj.zone
        link
        fedilink
        English
        arrow-up
        24
        ·
        edit-2
        2 months ago

        Unhiding extensions is one of the first things I do when setting up windows, but it will still hide the .lnk extension on shortcuts, so it’s still a vector for phishing attacks (specifically, tricking the user to do something that runs malicious code).

        Experienced pirates will get into the habit of taking precautions against malware attacks and will distrust downloads until they are sufficiently vetted,

        • leftzero@lemmynsfw.com
          link
          fedilink
          English
          arrow-up
          3
          ·
          2 months ago

          Unhiding extensions wouldn’t help here, as the .lnk extension is hidden even if you unhide the others, as it’s the extension for shortcut files; you have to edit an obscure registry key if you want to unhide it.

          (That said, it being a shortcut it should have the small shortcut arrow in the icon, unless you’ve used a third party tool or the registry to disable it, so it should still be easily recognisable as a shortcut.)

    • Mr_Blott@feddit.uk
      link
      fedilink
      English
      arrow-up
      21
      ·
      2 months ago

      The comments from obvious teenagers on 1337x on pretty much every torrent suggests that a lot of people do this

        • ouRKaoS@lemmy.today
          link
          fedilink
          English
          arrow-up
          3
          ·
          2 months ago

          Operating a computer used to be a specialized skill, you used to have to look under the hood pretty often to make things work. Now all that prep work is taken care of for you, so end users are further away from the partial techs we all used to be.

          Dropping into a DOS command line to install software was a normal thing in Windows 95, now if you pull up a command line people think you’re a Microsoft Certified Technowizard™.

    • archomrade [he/him]@midwest.social
      link
      fedilink
      English
      arrow-up
      9
      arrow-down
      1
      ·
      2 months ago

      I believe the torrent included both an .mkv and a malicious .lnk file.

      .lnk files are dangerous because they can evade detection and automatically open other files or executable on a computer; AFAIK you would not have had to open the .lnk file yourself.

      • leftzero@lemmynsfw.com
        link
        fedilink
        English
        arrow-up
        2
        ·
        2 months ago

        AFAIK you would not have had to open the .lnk file yourself.

        Wait, what? A .lnk file is a shortcut… you still have to click those for them to open whatever they’re pointing to.

        • archomrade [he/him]@midwest.social
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          1
          ·
          edit-2
          2 months ago

          It depends on the attack vector. Typically you’re right, but malicious .lnk files are often paired with other malicious methods to infect machines. Sometimes they’re configured as a worm that copies and spreads when a flash drive is connected, sometimes they’re configured to download a remote payload when another script or program is started. The problem is that it’s a type of file that’s often overlooked because it seems innocent.

          It isn’t necessarily the case that the Trojan needs to be interacted with by the user in order to execute the malicious code. Just having the file on your machine opens the door for all kinds of attacks (especially if you’re using a headless setup: you wouldn’t necessarily know you have the .lnk file in the system unless you’re manually unpacking your downloads yourself). All it needs is for another piece of infected code to run and look for that file, and it can open the door for more traditional malicious code.


          Edit: just as a for-instance - If I was a black hat and wanted to spread some malicious code, I could include this .lnk file in a torrent (innocuous enough to slip by unnoticed by most people/unscrupulous pirates), and then maybe place a line of code in a jellyfin plugin or script that looks for that file and executes it if it’s found. Because the attack isn’t buried in the plugin or script itself (most people wouldn’t think much of a line of code that’s simply pointing to temp file already on your system), it could theoretically go unnoticed for long enough to catch a few hundred or thousand machines.

    • Zoidsberg@lemmy.ca
      link
      fedilink
      English
      arrow-up
      5
      arrow-down
      1
      ·
      2 months ago

      I wonder if an automated setup would play it without caring about the extension. If someone had something like Sonarr dropping episodes on a Plex drive, for example.

  • DebatableRaccoon@lemmy.ca
    link
    fedilink
    English
    arrow-up
    42
    arrow-down
    5
    ·
    2 months ago

    Mindlessly downloading an episode that doesn’t get a mention on the wiki page is amateur hour.

  • minimalfootprint@discuss.tchncs.de
    link
    fedilink
    English
    arrow-up
    9
    ·
    2 months ago

    Maybe it’s just me, but I think entities that deliberately spread and use malware should be punished and held accountable. Too bad these entities help write the laws.