Warning that's circulating

chmuse

chmuse

Public Nuisance 🦜🐧🦅🦚🦃🦢🐓🦆🦉
Member Since
Oct 11, 2024
Posts
1,525
Likes Received
4,242
From
Basgiath
1000013613.png1000013614.png1000013615.png

Been posted in a few of my discords and forums.

If someone smarter than me can chime in and explain, it'd be welcome, because it sounds like it was a breach of your device itself, not just your passwords and accounts. Staying logged in on a device that also had stored credentials for your financial institution is the problem, is the gist I am getting.
 
As someone who works in this field, some of these comments do not make sense. Being able to sniff unencrypted traffic does not allow you to hijack someone's IP address. Using a web app should not allow someone to compromise your device - this would be a major vulnerability in the web browser itself.

Using a VPN will not help you if you are sending sensitive information across an unencrypted website - it will only encrypt the traffic in between you and the VPN you are connecting to, and not the traffic between the VPN and Pepchat.

If I had to guess, they are sending files that people are downloading and those are installing backdoors or similar, or they are being phished or otherwise scammed into giving people sensitive information.
 
exploitedworkerbee said:
That platform was a sketchy junk show from the jump. It’s possible the forum owner, who has always been trying to figure out how to monetize his involvement in the peptide community, finally did so.
Click to expand...
I'm gathering that it's the Revolt one. I have an account, but when I click it I'm logged out, and now I'm afraid to log in and see the dealio. Might grab one of my old phones and format it before logging in, but I'm kind of dumb when it comes to this stuff. Maybe I shouldn't try it on my home wifi.
 
Looks like it does have a valid SSL cert and attempting to connect over http force redirects to https.

That doesn't mean that whoever is running it can't see all of your messages, however. Treat it as if the "staff" for the peptide.chat server can see everything you send, and for further safety, assume that there is always a chance that they can/will be compromised, so even if you trust them for whatever reason, do not trust that they will forever be the only ones with access to the data.
 
hexagonal said:
Looks like it does have a valid SSL cert and attempting to connect over http force redirects to https.

That doesn't mean that whoever is running it can't see all of your messages, however. Treat it as if the "staff" for the peptide.chat server can see everything you send, and for further safety, assume that there is always a chance that they can/will be compromised, so even if you trust them for whatever reason, do not trust that they will forever be the only ones with access to the data.
Click to expand...

I wonder what's really going on. I have an account, but I don't think I've ever actually posted there.

Are you implying Brute Enforcer Emeritus can see all my messages with Oyster? 😱😱 Oh man, I'm doomed.
 
chmuse said:
I wonder what's really going on. I have an account, but I don't think I've ever actually posted there.

Are you implying Brute Enforcer Emeritus can see all my messages with Oyster? 😱😱 Oh man, I'm doomed.
Click to expand...
Without an addon allowing it I don't believe moderators can see PM contents by default in XenForo.

Anyone with access to the database the PMs are stored in can read 'em, though.
 
hexagonal said:
This is why we need to take the discussion about this peptide purchase out of DMs, please click this link to purchase your Reta 30 kit for $.30/mg: hxxp://totallysafewebsite.ru/DefinitelyNotABackdoor.doc.exe
Click to expand...
Oh, thank you! That sounds much safer. Why is it asking for my credit card, though?

Edit: I put in my credit card and nothing happened, should I try my debit card?
 
chmuse said:
Oh, thank you! That sounds much safer. Why is it asking for my credit card, though?

Edit: I put in my credit card and nothing happened, should I try my debit card?
Click to expand...
Debit card, your mother's maiden name, your social security number, the name of the street you grew up on, the name of your first dog, and your favorite teacher from high school.
 
hexagonal said:
Debit card, your mother's maiden name, your social security number, the name of the street you grew up on, the name of your first dog, and your favorite teacher from high school.
Click to expand...
My real answers, or the fake ones I use for security questions?
 
chmuse said:
I wonder what's really going on. I have an account, but I don't think I've ever actually posted there.

Are you implying Brute Enforcer Emeritus can see all my messages with Oyster? 😱😱 Oh man, I'm doomed.
Click to expand...
I can’t but it’s possible that Zippity can. Not sure how things work on the back end. It would be safest to assume we can though.
 
I
chmuse said:
Updates via other forums/ discussions:

Possibly just drama and shit stirring.

Most likely dummies who use the same passwords for grey market sites as their financial institutions.

Don't click links from randos.
Click to expand...
Dont appreciate being called a dummy. You mean we're not supposed to use the same password for everything? But 'password123' is so easy to remember!
 
I work in tech as well and was immediately skeptical of the message. Phishing is by far the most utilized means of compromising data these days. We just don't see many exploits these days. Much easier to saturate unsuspecting targets with stick and carrots. A 1% catch rate is massive when sufficiently saturated. Never understood why there are people out there that get off on trying to generate hysteria.
 
tul9033 said:
I work in tech as well and was immediately skeptical of the message. Phishing is by far the most utilized means of compromising data these days. We just don't see many exploits these days. Much easier to saturate unsuspecting targets with stick and carrots. A 1% catch rate is massive when sufficiently saturated. Never understood why there are people out there that get off on trying to generate hysteria.
Click to expand...
There were warnings going around this morning, one of which I didn't share because it wasn't mine to share. That one implied the accounts were being drained when people left the app signed in overnight somehow.

That's why I posted. I knew enough to know it sounded a little weird, but not enough to be sure it wasn't.
 
chmuse said:
View attachment 5561View attachment 5562View attachment 5563

Been posted in a few of my discords and forums.

If someone smarter than me can chime in and explain, it'd be welcome, because it sounds like it was a breach of your device itself, not just your passwords and accounts. Staying logged in on a device that also had stored credentials for your financial institution is the problem, is the gist I am getting.
Click to expand...
Thank you for the info and update!
 
You must log in or register to reply here.

Trending Topics

Latest Posts

Members Online

Total: 248 (31 Members & 217 Guests)

Forum Statistics

Threads
3,597
Posts
56,648
Members
8,412
Latest member
KcOsully

Share This Page!

Top Bottom