This is a very sensible change. It’s an open secret that discord has been leveraged by hackers for quite some time. You can even search Github and find examples where exfiltration of data is done via discord. Discord is not a file host and should not be used as such. I’m just glad they’re doing it in such a way to minimize the impact on users and devs.
I don’t know how much of a difference it will make.
It’s easy to host files. Even if the malware “author” is clueless and just buying a customizable malware, either they’ll figure out how to host files or file hosting will be provided along with the service they’re buying.
It may not stop Discord from being the file host either. Malware distributing bot accounts could keep copying a new link to the file, or could upload a new version of the file on demand.
Discord can’t expire webhooks the same way so webhooks will continue to be used for exfiltration. Pointing out that it’s used for exfiltration as if it were related seems like bad reporting. It’s a difficult problem because if they did break webhooks it’d only make things more difficult for legitimate users. These malware packages usually hijack the user’s Discord installation and could send out the information as the user without using webhooks.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !technology@beehaw.org
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
This is a very sensible change. It’s an open secret that discord has been leveraged by hackers for quite some time. You can even search Github and find examples where exfiltration of data is done via discord. Discord is not a file host and should not be used as such. I’m just glad they’re doing it in such a way to minimize the impact on users and devs.
I don’t know how much of a difference it will make.
It’s easy to host files. Even if the malware “author” is clueless and just buying a customizable malware, either they’ll figure out how to host files or file hosting will be provided along with the service they’re buying.
It may not stop Discord from being the file host either. Malware distributing bot accounts could keep copying a new link to the file, or could upload a new version of the file on demand.
Discord can’t expire webhooks the same way so webhooks will continue to be used for exfiltration. Pointing out that it’s used for exfiltration as if it were related seems like bad reporting. It’s a difficult problem because if they did break webhooks it’d only make things more difficult for legitimate users. These malware packages usually hijack the user’s Discord installation and could send out the information as the user without using webhooks.