The discord for Wild Life game got hacked. If you're a dev, here's how to prevent it from happening to you.

hakarlman

Engaged Member
Jul 30, 2017
2,091
3,253
First, watch the Wild Life developers explain what happened: . Read their Youtube description too, for the video. They deserve a lot of praise for providing so much transparency.

How the attackers took over their discord:

"One of our associates was hacked on Discord, and the attacker, impersonating them, convinced Guuii to visit their Itch.io page and download a build for playtesting. Unfortunately, this turned out to be a rootkit, a malicious program designed to steal a user's online identity and login credentials."

Okay, let's do some brain storming. Imagine you're a porn game dev with a discord. A user wants you to download their game to check it out. But, they've written a custom malicious program to target you. Heuristic virus scan might be able to detect malicious code in the exe, but you may think it's a false positive, when in actuality, it was an actual positive. Keep this in mind. Some of you are far more knowledgeable than me in this topic, and can probably chime in with ideas to prevent it from ever happening to any other devs.
 

Meaning Less

Engaged Member
Sep 13, 2016
3,540
7,078
Be careful on what you download and execute, that's common knowledge when browsing the internet.

Double check every time someone is asking you to give them information or download something...
 
  • Like
Reactions: c3p0 and hakarlman

Atemsiel

Developer of Stormside
Game Developer
Jan 4, 2022
711
1,865
This in general this sounds like a variation of a very common discord scam. The standard version of the same thing is that someone will contact you either telling you they're a developer of something, and ask you if you want to play it, or they just act friendly and ask if you want to play a game, usually something that has a steam page for the sake of credibility, but of course it isn't actually available on steam for whatever reason, so they have to send you a link, to what is usually a remote access trojan. Once that's installed, it may be almost impossible to get rid of.

From there they can do any number of things, but the more common ones include crawling your browsers credential caches for your passwords to any accounts you have saved, and fucking with your discord to spoof the login page so that even if you reset your password to it, they just get the new password as soon as you log in again, which they will often use to make you think there's no way out aside from giving them what they want. Something will usually be added to the startup programs which will most likely be whatever crawls the credential cache, but it may also grab the discord token, allowing the hacker to log in to your discord, and from there the scam is usually a case of trying to spook you into sending them money.

There's no 100% method to fix the problem after this happens beyond just scrapping the drive, since there are a lot of variations of this, but a lot of the discord control stuff is just standard shit you can download from github, and the people actually conducting these scams usually won't have the technical ability to do much outside of what those programs do. They make generic threats about ddosing you and all that sort of shit, but their real job is just to get you to download the thing, and then convince you to pay them. From a technical perspective, they are basically threatening to press the "Hack" button that someone has given them. (Usually)

As Meaning Less said, the best defense against this is to just not download things unless you're confident in their origins. If someone was already impersonating a dev, and the link was actually itch, then I can see how it might look quite real, but this is just kinda the sort of stuff people have to watch out for.

Also, it goes without saying, but don't send money to the people who do these scams. The amount they ask for at the start is usually a relatively small amount, for which they promise to give you your shit back. If you actually pay them, all that tells them is that you're taking it seriously enough to cough up money, and they'll most likely then just ask for a larger amount afterwards. They have no reason to ever actually give you your stuff back, so they might as well just keep asking for larger amounts of money, until they've got everything they can out of you.

Best bet is to use another device to reset your passwords for the most important things, starting with your email. (Also ensure these passwords don't auto sync between devices.) From there, you can start to reset passwords for everything else. Don't do this on the device that's fucked because depending on the specifics of what got installed, they'll just find out the new passwords right away. Once your most important accounts are secure, you can look at actually getting rid of the shit. Do this first, because getting rid of it won't be instant, and if you can limit their access to your accounts during that time, you can limit the damage they can do, assuming they're actually planning to do any.

Also, if this happens to you, and you're a discord server owner, in the time where you still have access to your discord account, transfer ownership of the server to someone you can trust, and have them remove your accounts permissions. (Emphasis on the trust part.) That can help to limit what the hacker can actually do to your server, if you're a dev.

This can happen to anyone though. Never fall into the trap of thinking you're smart enough to not need to be cautious. People like that are why this scam is carried out, because it works on people who aren't cautious. Vulnerable old people don't use Discord, "Smart" people do.


One thing I forgot to mention though, is that this is general advice. As a dev, you may find yourself targetted more specificially, like the devs in the video in the OP. I can't tell from the video exactly how it went down for those guys, whether there were actually any demands, or whether the person just wanted to fuck up their discord. If someone does this with only the intention of fucking up your stuff, then you'll likely have much less time to carry out any of these steps.
 
Last edited:

anne O'nymous

I'm not grumpy, I'm just coded that way.
Modder
Respected User
Donor
Jun 10, 2017
10,292
15,151
Be careful on what you download and execute, that's common knowledge when browsing the internet.

Double check every time someone is asking you to give them information or download something...
Execute any unknown software in a sandbox or, when you can afford it, a secondary computer isolated from your network and that you never use for anything else. Alternate, and cheaper, measure, always do your administration works from a dedicated (small) netbook with a strong IP filter that will reject all connection attempt.