CIRCLE WITH A DOT

RE: https://social.lol/@otaviocc/116076383907156741

I have no words to thank everyone for helping yesterday.

Great news: Yesterday on the omg.lol IRC server, folks investigated and discovered the GitHub account was part of a network of bots. These bots republish open source projects, modifying their READMEs with malicious links, and distribute Windows malware through fake builds.

After documenting the findings, we reported everything to GitHub. Within hours, they took down the repositories and an account for violating their Terms and Code of Conduct.

Thank you for investigating, reporting, and sending coffee. You're all amazing!

I planned to write a blog post today, but @brennan already wrote something better than I could. You should read it:

The Curious Case of the Triton Malware Fork

Today, a weird malware distribution campaign targeting users of omg.lol and Triton, an open-source macOS client of omg.lol, was found. The attack leverages the trust of GitHub, creating a malicious fork where the download link has been replaced with malware hidden in presented .zip file.

brennan.day (brennan.day)

Many thanks to @brennan, @chilli, @adam, mattl, @cygnoir, @annika, @jarunmb, and everyone else who helped!

#OpenSource #macOSDev #omglol #GitHub

@chilli thank you!! As soon as I’m on my computer I engage there.

@chilli I am. I tried to post to the general channel and venting channels, but I’m having a hard time with the mobile safari. I’ll try again from my computer. But I tried to post there.

@jarunmb I’m trying that. I’m collecting some evidences why I think they should be taken down.

Thanks for the coffees MB! I really appreciate it. Thank you!!!

@maique thanks!

@carstingaxion thanks!

@chilli there is, it’s MIT. But clearly the intentions aren’t good. They created a website, uploaded builds (to to a release, but to the repo itself, hidden with other assets), and are pointing to the file in readme and website.

JaoAureliano is their username there.

A person just “stole” Triton, my native omg.lol client, and removed all the references from the README file where I ask people to reference the original project and give me credit for the app.

They didn’t fork it, so that people don’t realize it’s a fork of another project.

They also changed their README file to point to their own zip file, which I’m not downloading, and neither should you. I don’t know what’s in it.

They even created a website, hosted on GitHub Pages, for it, with a link to their “builds.”

That pisses me off. Really. I spent years building the app. I put a lot of my personal time into building it for me and for the community, only for someone to steal it as theirs, publish builds, and wipe my name from it.​​​​​​​​​​​​​​​​

Help me with a Star on the original project to keep it higher in search results. Thanks!

GitHub - otaviocc/Triton: A native macOS client for omg.lol with support for Statuslog, PURLs, Web Pages, Now Pages, Weblog, Pics, and Pastebin

A native macOS client for omg.lol with support for Statuslog, PURLs, Web Pages, Now Pages, Weblog, Pics, and Pastebin - otaviocc/Triton

GitHub (github.com)

#OpenSource #macOSDev #omglol #GitHub #Triton