
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
cryptochat
Advanced tools
Encrypted P2P chat over ICMP (Internet Control Message Protocol).
I strongly advise you to pick a high-entropy encryption key to avoid the possibility of brute-force attacks.
Uses raw-socket for ICMP handling and terminal-colors to spice it up a bit.
Make sure you have node 0.10.x
(tip: use n) and then install the package globally with sudo
.
sudo npm install -g cryptochat
Three variants of cryptochat are available depending on your use case:
Send and receive messages
$ sudo cryptochat <ip> <encryption_key>
Receive messages
$ sudo cryptochat server <encryption_key>
Send messages
$ sudo cryptochat client <ip> <encryption_key>
Because it relies on stdin
for input, it is possible to use pipes to send data:
cat cryptochat.js | sudo cryptochat client <ip> <encryption_key>
bits 0-7 | bits 8-15 | bits 16-31 |
type = 0x08 | code = 0x00 | checksum |
identifier | sequence number | |
payload |
The message data is attached as the ICMP payload.
Messages are piped from stdin
and split into payload packages, which are encrypted and sent as ICMP Echo requests. The payload size per request is currently set to 32 bytes. The first byte is the length of the message and the rest is the message itself.
The first request contains a salt and an initialization vector needed to decrypt the payloads.
byte 0 | bytes 1-15 | bytes 16-31 |
0x3e | salt | initialization vector |
An "end" request is sent in order for the receiver to know when a message is completed. The end request has the following format:
byte 0 | bytes 1-31 |
0x3e | 0xffffffff... |
When the end request is received, the full message is printed to the screen.
As always, contributions are much appreciated.
FAQs
encrypted P2P chat over ICMP
The npm package cryptochat receives a total of 21 weekly downloads. As such, cryptochat popularity was classified as not popular.
We found that cryptochat demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.