Programming

27803 readers

440 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Follow the programming.dev instance rules
Keep content related to programming in some way
If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev

founded 3 years ago

MODERATORS

snowe@programming.dev

Ategon@programming.dev

UlrikHD@programming.dev

bugsmith@programming.dev

Spyro@programming.dev

Anyone know what this is? (programming.dev)

submitted 1 day ago by mark@programming.dev to c/programming@programming.dev

22 comments fedilink hide all child comments

There's this weird github repository

https://github.com/OOOO00000000OOOO/OOOO00000000OOOO

I noticed there was someone attempting to proxy to this repository on my site, causing it to show up in the logs. It was detected as spam but this repo doesn't look like it's built by some normal spammy company. The owner has gone through great lengths to try to stay anonymous. And I can't make out what the repo is or what it's for. Does anyone know or have any ideas?

Thanks

you are viewing a single comment's thread
view the rest of the comments

[–] urushitan@kakera.kintsugi.moe 7 points 1 day ago (1 children)

Their goal? Can't say. They clearly have a drive to make art, especially mathematical fractal binary minimalist art. Whether they also are actually producing malware or are just trying to piggyback as many services as possible to archive and keep their stuff online is another question. The vast majority of what I saw in my quick recon of their online presence was mostly glitch art/unicode/ascii art, blender stuff, fractals, web based d3 animations, that sort of thing. That being said, as you said, they appear to have gone to great lengths to be anonymous, I've only found a couple of raw IPs in there that mirror their stuff.

That being said, it seems they also clone their backups to anyone who hosts a free forgejo/gitea instance:

OOOOOOOOOOOOOOOO\ꓨЯO.ꓨЯƎᗺƎᗡOϽ CODEBERG.ORG/OOOOOOOOOOOOOOOO
OOOO\MOϽ.ᗺUHƧꓨAᗡ DAGSHUB.COM/OOOO
OOOO\u\MOϽ.ƎᗡOϽƎᗡOHЯ.ƎᗡOϽ CODE.RHODECODE.COM/u/OOOO
oooo∽\TH.ЯƧ.TIꓨ GIT.SR.HT/~oooo
OOOO\ꓨЯO.ꓨUᗺATOИ NOTABUG.ORG/OOOO
O\000Ԑ:მ4.111.78.ਟ81 185.87.111.46:3000/O
O\HϽƎT.TƎꓨƎᗺ.MUTИƎꓨA.TIꓨ GIT.AGENTUM.BEGET.TECH/O
O\ᗡI.Oꓨ.ᗺAꞰꓨИAᗡƎMUƧ.TIꓨ GIT.SUMEDANGKAB.GO.ID/O
OOOO\ƎTIƧ.ƧƎOᒐƧIƧIHT.TIꓨ GIT.THISISJOES.SITE/OOOO
O\UƎ.ЯƎꓨИIᒧᒧƎ.TIꓨ GIT.ELLINGER.EU/O
O\HƧ.1ᗡIꟼ.AƎTIꓨ GITEA.PID1.SH/O
O\ᒧИ.ИƎЯƎOᗺЯƎIVIᒧO.TIꓨ GIT.OLIVIERBOEREN.NL/O
O\ƎM.YꓨOᒧOИYƧ.ꓨИOƎᒐꞰƎ.AƎTIꓨ GITEA.EKJEONG.SYNOLOGY.ME/O
O\𑪽Ͻ.ϽƎVOЯOᗺꞰƎИƎᗡ𑪽.TIꓨ GIT.ZDENEKBOROVEC.CZ/O
O\ꟼᒐ.ƧUᒧꟼTϽƎИИOϽ.TIꓨ GIT.CONNECTPLUS.JP/O
O\YИAꟼMOϽ.ꞰᗺƎ.AƎTIꓨ GITEA.EBK.COMPANY/O
O\MOϽ.ƧꟼOVƎᗡUAꞰA.AƎTIꓨ GITEA.AKAUDEVOPS.COM/O
O\ZYX.VƎᗡƎᒧᗺATЯOꟼ.AƎTIꓨ GITEA.PORTABLEDEV.XYZ/O
O\MOϽ.ƎꓨAMAIV.AƎTIꓨ GITEA.VIAMAGE.COM/O
O\TƎИ.OTYЯϽ.TIꓨ GIT.CRYTO.NET/O
O\VƎᗡ.ƧꟼAMO.TIꓨ GIT.OMAPS.DEV/O
O\MOϽ.ИƎMMƎH-ИAV.TIꓨ GIT.VAN-HEMMEN.COM/O
O\UƎ.ИƎVƧƎИ.TIꓨ GIT.NESVEN.EU/O
O\MOϽ.ᗡAƎЯᗡHTꟻIꟻ.AƎTIꓨ GITEA.FIFTHDREAD.COM/O

[–] mark@programming.dev 2 points 15 hours ago* (last edited 15 hours ago) (1 children)

Yeah. Just found that they're using this email address: OOOOOOOOOOOOOO@MURENA.IO. murena.io gives them 1GB of storage for free. Like you said, they appear to be attempting to keep a backup of a lot of data using third-party services, I'm guessing so that, in theory, even after their death, this data will be available... forever?

[–] sukhmel@programming.dev 1 points 14 hours ago (1 children)

Their repositories are really something, and the commits seem to only happen in bursts, I expected them to do a few commits every day, instead it's like 10 days a year with 1700+ commits total.

But I wouldn't assume they are conventionally malicious, more like a ~~paperclip~~ storage optimiser

[–] urushitan@kakera.kintsugi.moe 3 points 13 hours ago

Agreed, leads me to think they have some kind of script that rewrites filenames and directory names to be symbolic/symmetric and they run it manually rather than on some automated schedule. Then by storing it as a git repo they can find open git hosting and just mirror it there (the lastest copy I saw was like 7 or 8 GB so definitely not tiny, but also not enough to take down your average self hosting project)