Jason Thor Hall / PirateSoftware / Maldavius Figtree / DarkSphere Creations / Maldavius / Thorwich / Witness X / @PotatoSec - Incompetent Furry Programmer, Blizzard Nepo Baby, Lies about almost every thing in his life, Industry Shill, Carried by his father, Hate boner against Ross Scott of Accursed Farms, False Flagger

Black Willow Lurker said:

The VPN shit is especially funny when Mald attempts to show off his 20 years of h4x0r experience:
View attachment 6906106
The "gotcha" is that the "weird service" that Mald "unraveled" is TunnelBear, which is obviously a VPN service, which Mald doesn't seem to realize, so the next hypothetical step in Mald's master plan would be to "arrest the dude". So what Mald has demonstrated is a pretty good case for VPNs, I'd say.

Click to expand...

The lead in to your clip has Maldy saying the IP that he's referring to (107.170.236.5) has a lot of hits for malware on Virustotal (link to IP page) and then presumably links IP2location. At this point, Maldy thinks he's cracked the case and that the attacker is using a jump box as described in the clip but really it's just the Tunnelbear VPN... which isn't a jump box obviously. The victim in the video is clearly not hacked as they expect because he says the hacker doesn't get the server ID until his delayed stream shows it.

Looking online, Malwarebytes apparently likes to pretend it's doing extra work by notifying a user anytime an external IP is hitting their own computer, even if it's on closed ports that wouldn't get through anyway, which is what's shown in the clip. Maldy looked up the port and was like "ah ha so they tried to connect to your computer over port 135 from a rented machine on digitalocean meaning you probably have a trojan!!!" but if they had a trojan there are much better ways to get through the firewall and poking the computer over a Tunnelbear VPN connection on port 135 is one of the worst ways. For example, using the infected computer to reach out to the command and control server and creating a reverse shell.



Mald jumped the gun in an effort to look smart and continues to insist that this is evidence that the hacker can directly connect to his machine, even though the attempted connection was blocked and that port would be publicly blocked by default on Windows as well. It also implies the computer is effectively directly connected to the internet or at least the network forwards traffic it shouldn't which is peculiar but Mald never brings that up.

The guest, ImperialHal, then says, "Jim burns just stated in my chat that he did a full reinstall of Windows before the tournament started." Mald replies, "You could still have persistence on the machine but that is interesting..." then mentions hardware persistence and that likelihood decreases slightly. No, it decreases significantly.
Further on, ImperialHal says someone in his chat says you can do a reverse DNS on the IP and tell that it isn't a jump box. Maldy is quick to say akshually you can't tell and proceeds with his tunnel vision on the IP going to a rented server to launch attacks from because Virustotal has some flags for the IP.

Maldy is constantly fixated on the IP being an "attack box" when it obviously isn't. He even says having the IP is a huge win when it isn't. If the connection was ever established then it'd be in the event logs anyway which would also be where you can start pulling more threads. All of this said, I'm pretty sure that Malwarebytes popup is a red herring, the hacker himself said the hacks "never went outside of the game" in a TechCrunch interview which Mald goes through in the stream instead of letting Justin Hammond talk who knows more about this subject than Mald. Justin Hammond did a video showcasing some OSINT that was done that uncovered more about Destroyer2009, the Apex hacker, and nothing indicates he's hacking player computers.

At 57 minutes in, Mald says his forte is "physical access control systems, which is breaking and entering, wifi vulnerabilities, web related vulnerabilities, and social engineering..." Around 2:30:00 Mald talks about working at Blizzard doing a pentest and getting caught picking a lock on a door, then he restates his skills verbatim as if it's a practiced phrase for him, which it probably is. He admits malware isn't something he's as knowledgeable on but then turns around and says every day he's looking up new vulnerabilities and updating his home lab to "try stuff on."

Humorously, at 2:42:00 he talks about how you shouldn't berate people for making honest mistakes. Funny considering how he talked down to Shaye for not understanding how he wanted her to edit the sign for their game and spent half an hour bullying her live over it, literally calling her dumb.

As for ImperialHal's weird inbound connection, it could be a lot of things and likely has nothing to do with the Apex hack. It'd be funny if he personally had Tunnelbear installed at the time and a service erroneously went across the internet and back to his public IP.

Justin Hammond knows what he's talking about as far as I know, I can't stand his videos personally but haven't heard him say anything wrong from the few I've listened to. I don't know why Hammond puts up with Mald's blatant ignorance and lies so he can look smart to his ignorant audience. It ends up lending Mald credibility through association which is frankly irresponsible as he says a lot of really stupid things the more you listen.

That's the most Maldy I've struggled through to date and he's literally nonstop with the bullshit, it's incredible.