As we've navigated our post-hack plan the last few days, a lot of people (including myself) were surprised to hear that Xin's 2FA account protection didn't do anything to stop a phishing attack.

If you're one of those people, I figured I'd share a Reddit post by u/tropix126 that explains what happened in simple terms. You can find it here or just read on.

TL;DR: A hacker doesn't need your login if they have your auth token, and phishing links inject you with software that steals the token. So keep 2FA on, never give out your token, and treat any link from any stranger as a red flag.

Overview

So. Recently, there have been several concerns over a new account-credential stealing bit of software identified as "AnarchyGrabber". This isn't actually the first token logger software, but it's by far the most accessable easiest to deploy, making it gain some traction recently. So, what can you do to avoid getting infected?

First off, I want to explain what the token essentially is. If you are familliar with OAuth and/or discord's internal structures, you can skip this bit. Essentially, the token is a string of letters and numbers unique to your account. This token is used internally by the client for login requests. With this, you can instantly log into an account with the correct token. A common misconception is that the token is the same as the password, which is false, although changing your password will regenerate the token. Mainly this is used for bot accounts and development, however this system is also utilized by normal accounts.

Now a quick look at the malware. Anarchy is usually spread through a single executable file. This makes it relatively easy to spread in many ways. It may be bundled with software, or be used in some of those "free nitro" scams. Once the victim successfully runs the file, anarchy will first kill the discord client process. Then, it injects itself into the following directory.



C:\Users\Tropical\AppData\Roaming\Discord\0.0.306\modules\discord_desktop_core\index.js

C:\Users\Tropical\AppData\Roaming\Discord\0.0.306\modules\discord_desktop_core\4n4chy

Essentially, the malware will inject itself in a similar fashion to client mods. The "4n4chy" folder holds the necessary files for the program to run. It also injects itself into the index file. The index file essentially contains instructions for which files and code snippets to run on discord startup. A normal non-infected index file will look like this.

module.exports = require('./core.asar');

If you have a client mod installed, this will most likely be different. Either way, this isn't a place to discuss those things. Essentially, the victim will then re-launch discord and be greeted with the login screen. This is a real login screen, however now that the malicious code is running, you are no longer protected. Once the credentials are entered, the user will login as normal, however the now unprotected token is logged by anarchy, and sent to a specified server. Congrats, your account is now compromised. This specific logger will also attempt to bypass and disable 2FA.

How can I avoid this?

Firstly, and one of the important aspects to avoiding this, is not clicking suspicious links. Since the program is a single file, this means its entirely versatile and thus can be spread in many different ways. The most common way is DM scams. I myself have been sent DM's of people claiming to have a "Free Nitro Generator". They attached an executable. I had a friend of mine decompile the file, and sure enough. It was anarchy. One weakness of anarchy, is that it doesn't have a digital signature. This means that Windows SmartScreen should filter it out and show that it's unverified software. Keep in mind this can affect Mac as well, since discord still runs on the same framework (electron). TLDR: Don't click on suspicious links.

I think i've been infected!

First thing. Check for the malware. Go to C:\Users\Tropical\AppData\Roaming\Discord\0.0.306\modules\discord_desktop_core\. Check for a "4n4chy" folder, or anything besides the default 3 files. (core.asar, index.js, package.json). If there are any suspicious files, immediately uninstall discord. Then, delete the entire \discord folder from your appdata. DO NOT LOG IN. Assuming you have found the folder, you want to log into the web or mobile client, and change your password. This will regenerate your token, invalidating the old one. From there, you want to run a malwarebytes scan, just to be safe. Finally, reinstall discord. You should be fine from there. Check again for the 4n4rchy folder. If it's back, you have a bigger problem. This means a seperate program is injecting anarchy. Consider finding the program or reinstalling your OS. If you were sent the file from a DM, report the user to Trust and Safety here.

Mobile?

No. It wont affect mobile. Discord desktop is built on Electron, which is essentially a glorified chrome window (also why it runs so horribly). Mobile runs on an entirely different framework, and thus isn't vulnerable.

A little while ago today, one of our admin accounts (with 2FA!) was hacked on Discord and someone was able to nuke the NGP server.

If you're in the server, go ahead and leave it for now. Definitely do not share links to other servers in it.

Keep an eye on NGP Twitter, updates from us will probably come from there!

Happy Pixel Day to everyone! It's probably my favorite holiday on NG, if for no reason besides it's the one I can contribute to the most. I'm so happy with what @moawling and I came up with this year, it's a funny little concept elevated to sheer levels of awesomeness by their incredible way of rendering pixel food. I still can't get over it, like, the second time you watch it you just gotta pause and admire everything.

To celebrate getting front page(!) I thought it'd be fun to share the original animatic we worked from. I'm kinda impressed with how much carried through into the final. Although for some reason I thought we'd have, like, sixty items. Maybe I thought this was gonna come out for Pixel Day 2039. Anyway, enjoy!

Hey everyone! I just released a lil tune, a lil journey into an 8-bit galaxy, and you can listen to it here:

As I was writing this I slowly realized that a) chiptune music would be REALLY fun to write live on a stream, since it's such a pure form of music and the songwriting happens so fast, and b) I totally have all the gear to do it. So starting next Tuesday, come join me on Twitch as I host an all-out music-writing chip-tuning piano-smashing party.

Right now I'm planning for my stream schedule to be Tues-Thurs at 9:30am EST. Early, I know, but I know some of you early risers are into that kind of thing.

hii im new. grounds. get it?

Anyway- i have afrog in my roof.

waht is your name>

have you ever had numonia?

id ther a god?

im on NE

ngp sux lol 8======D# mee

After over a year of helping run and grow @TheNewgroundsPodcast, I'm sad to say I have to be away for a while.

The reason is pretty standard life stuff: I've just finally settled into a permenent living situation and scored a regular job, but said regular job isn't working out -- the managers are disappearing, I'm getting in fights with the current supervisors, my work hours are slipping away, it turned out to be a super loud environment and is killing my voice, blah blah et cetera. Which means I've gotta put serious time into finding a new job, WHILE riding out this old one, AND doing freelance work to keep the wallet full. NGP's gotta be off my to-do list, because right now I can't contribute in any way that's fair to the guys.

I'm stepping down to our "Regular" role, which means I'll still be on the show some, but much less routinely and on a less formal basis. More importantly, it takes me out of the central group of people who keep the show running every week with recording times, segments, guests, edited episodes and special events.

Now that I'm gone, the current hosts will start working on bringing someone else into the mix. This new host will be someone who not only slays at the microphone and charms the heck out of guests, but also has the time and vision to contribute regularly to NGP's leadership and keep growing the show to its full potential. I'm kind of excited to see who's dorky and handsome enough to fill my BIG MASSIVE SHOES. Yeah, I said it.

Sidenote on that: We're not currently holding an open call on hosts, so at this point I ask that you don't message us about being the new fourth person. As I always say to anyone eager to contribute, the best way to be on the show is to let us champion YOUR amazing content or community event.

Will I be coming back? Well, I'm not completely leaving, but the true answer is "we'll see". Life is weird, it has a habit of going in different directions really really quickly, and over the last few years I've gotten used to having no mother-f-in idea where I'm gonna be next.

If you want to stay abreast of how NGP proceeds from here, make sure you're following it on NG and Twitter, and make even more sure you're part of its bustling and super-fun Discord server. And if you're curious about my own journey from here, I'd love it if you followed my own Twitter @willKMR as well.

I'm so amazingly proud of NGP. It's grown so far past what @GoodL and I originally thought it would be. I'm proud to say I can step down from my admin role and know in my heart it'll keep going, strong as ever.

As the robot announcer lady loves to say:

Goodbye.

This is part 5 of a lil blog series I'm writing about my 2020. Here are the previous posts:

• 2020: COVID drain, my NG life after Grounds Patrol
• 2020: The Newgrounds Podcast was born (and looked nothing like it does now)
• 2020: The Summer Block Party changed everything
• 2020: Courtney and I left LA and drove across the USA (again)

The present and future of NGP

After the Block Party, I think The Newgrounds Podcast felt a little different for me. The work I’d put in with @GoodL, @PsychoGoldfish and @Xinxinix had felt really good. I felt personally way more connected to the show, the core team, the audience.

Xin joining the team was a natural next step. Earlier I mentioned that we’d talked about not wanting to discredit his own brand with GRNDSbreaking and Art Talks, and we started the conversation a bit tentatively because of that, but he was actually really excited to merge the brands together and centralize the community. Better one big crowd than two small ones.

After that, it was time to change the structure of the show a bit. We still had the large pool of hosts who were all expected to help with everything equally, but it was hard to tell who was active, who wasn’t, who was busy, who was uninterested, who was straight up unavailable. We were also slowly learning what all needed to be done to keep the show running: finding guests, scheduling recordings, announcing things, doing promos, editing episodes. So we ended up drawing a line between “hosts”, the people meeting every week and carrying the recording and release schedule on their shoulders, and “regulars”, people who were tuned in and ready to come on the show but weren’t obligated to pitch in all the time.

After Courtney and I landed in Florida, I had a lot of time to develop things for the show. I started getting bigger ideas for things, and I also started to fear that I was close to getting a real job and not having time to put said ideas into action, so I started working fast.

One thing that was always on my mind was having the ability to play audio clips during the show. That would open up a lot of possibilities, from letting musicians talk over their own music, to recording pre-made interviews and segments to drop in between the stuff we did live, to running game shows... So many things. So I started researching, and the best thing I came up with was using a second laptop and running its computer audio into a Discord call. Very cool! If you have a second laptop handy all the time. Note to self: if you want the show to be flexible and not rely solely on one person, don’t introduce things into the format that only you can do. I’m learning. Slowly.

I’ve also had a lot of fun being in shows myself lately. None of the post-Grounds Patrol anxiety from earlier. I’m happy to be on, I have a great time with the other hosts, I enjoy interviewing people, I like being able to play audio from my little setup. A personal favorite episode of mine from last year was the NG Audio Deathmatch Finale. Each of the four hosts recorded their own five-minute interview with a finalist, and during the live recording I played them all, as well as their four songs, seamlessly within the show. It felt like real radio.

Of course, when the technology works, it’s awesome, but when you rely on it and it doesn’t work, it’s a nightmare. During the recording of our Friday Night Funkin’ interview (which I was really excited for), our Discord recording bot stopped working. And it wouldn’t start back. It took hours for us to wrangle up a backup recording setup for everyone and finish the episode with what little energy we had left. Then editing that episode became a task. It took me two days just to sync all the audio together, and Xin even had to do more syncing work of his own before he was able to start editing the episode normally. Since then, I’ve never been able to run that bot without feeling wary of things just suddenly imploding. To this day, I still look into more secure ways to record. (I have another bot in the server now that seems to be more reliable -- pressure’s on, Alistair.)

Our most recent addition to the team was pretty recent - @VoicesByCorey joined as the newest host on December 9th. Corey is an experienced podcaster, a great voice(s) on the mic, and has visions for where the show could go. When he asked to be a co-host we all basically jumped over each other in saying yes.

Corey was actually a timely addition, because GoodL was coming to a point where he needed to step down. He covered the reasons why in his own post (basically, life stuff piled up and the balance got overwhelming, understandable), and it made sense, but it was still sad to see him go -- he and I were the ones who put the first building blocks together for all of this. But I’m glad he was able to leave when he needed to, because that’s still something that’s really important to me about the NGP setup -- it’s not tied to any of us, so if anyone needs to leave, the whole thing won’t come crashing down. To be honest, my own future is really unclear right now, and there might be a time where I’m too busy myself and need to do the same thing. I know that I wouldn’t be able to let myself leave unless I knew that it would carry on strong without me.

Where’s the show gonna go from here? Well, there’s a lot of room to grow. Right now, I’m working on getting NGP onto YouTube, the earliest draft of which you can see above. There’s just so many possibilities there -- it’s super convenient to listen to things on YT, there’s a chance for a cool visual component to episodes, and the videos can be linked and embedded into a lot of cool stuff. On the show format side, I think it’s just gonna grow naturally from what we feel like doing, what turns out to be cool, what the community suggests, and so on. We’re putting time into making the shows between interviews as kickass as the interviews themselves, so get ready for some quality time with the four of us and our closest buds on NG. I dunno, man. There’s a lot to try. Just be along for the ride!

That’s gonna do it for my 2020 review. It was... a year. If you read all of these, thank you so much, it really means a lot! Let me know what you liked, because I had fun writing everything, even the tough parts.

Have a great new year! 🎆🙋‍♂️🎆

This is part 4 of a lil blog series I'm writing about my 2020. Here are the previous posts:

• 2020: COVID drain, my NG life after Grounds Patrol
• 2020: The Newgrounds Podcast was born (and looked nothing like it does now)
• 2020: The Summer Block Party changed everything

Courtney and I left LA and drove across the USA (again)

Courtney and I never really loved Los Angeles. We’d packed everything into our cars and moved there two years ago, mostly because we like working in entertainment, we wanted to move somewhere, and we felt like there would be lots of opportunities there. (Not gonna go too deep on the reasons we were in LA, just because this is a 2020 recap, not a my-whole-life recap, lol.) Our time there was cool in some ways and lame in others. I found my cool escape room design job early on and stuck with it, but she had to bounce around a lot, and meanwhile our living situation was stuffy, the part of town we lived in was kinda sad, and we didn’t have many friends.

Would things have gotten better if we’d stayed longer? Probably. They say you have to stay in LA for five years before you’re truly settled and “at home”. We definitely would’ve made more friends, there would have been more jobs, and we would’ve been able to get a bigger apartment eventually. But in 2020, by the time COVID had us both laid off and running out of money, it didn’t take much convincing to get us to leave.

So, as I mentioned before, at the same time the Block Party was happening I was also working on getting basically everything in our apartment either packed, sold, given away or trashed. It helped that our place was super small and furnished with cheap particle-board furniture that was worth approximately $0.00 after being used. We got a uBox to ship a lot of stuff, and we put into our cars everything we’d need for the next few months as we stayed with my parents for a while.

On August 31, we said our final goodbye to our landlord, emptied out the last few bits of our apartment, and started driving!

We got lucky that our cat wasn’t one of those cats that freaks out and throws up whenever they’re in a car. I heard so many stories leading up to the trip from people who tried to drive with their cat once and the cat either a) screamed the whole way, b) had diarrhea the whole way, or c) died. What the fuck, cats??

Gimme did just fine though. We drugged her with vet-approved kitty Dramamine at first, but it turned out she didn’t need it. She would sit in her carrier for a little bit but spent most of the ride under the front passenger seat. We leashed her to the back so she couldn’t get up front and walk between the driver’s legs. (Luckily she only did that once, and I was driving slowly on a little private road at the time, so we were able to learn the lesson the easy way.)

Hotels were tricky. We had to take her up to the room while also carrying our suitcases, sometimes pushing her carrier around on a luggage cart. Then we had to ease her out so she didn’t freak out at the new location too hard, then we had to convince her somehow to eat and drink and use her little portable litter box. I don’t think she did much of any of that, but we did our best.

We wanted to stop at the Grand Canyon on our way, since we didn’t know the next time we’d be able to drive over and see it. It was beautiful. Guess what? We couldn’t leave Gimme in the car the whole time, so Courtney wore the carrier on her back and we straight up took our cat to see the Grand Canyon.

Overall, we did the trip in five days. From Los Angeles to Flagstaff, Phoenix, El Paso, San Antonio, New Orleans, and finally to my parents in Florida. We could’ve done it much faster, but there were a few things we wanted to see, and we also didn’t want to put too many hours between stops with Gimme in the car. It was a good ride.

Random other stuff:

• The book American Gods by Neil Gaiman is great, but listened to as an audiobook during a road trip through America makes it double great. Which makes sense, since it’s a book about a supernatural road trip through America.
• While having our cat in the car turned out to be fine, it doesn’t make for a super relaxing trip. The whole thing, from planning stops to driving to finding hotels to checking into the hotels, becomes focused on making sure the cat is okay. Sorry Gimme, you’re a high-maintenance road trip buddy.
• Arby’s is the best road trip fast food, and Sonic is the worst. Fight me.
• There’s a Southwestern gas station chain called Buc-ees that is THE HOLY GRAIL, WILLY WONKA WONDERLAND of gas stations. Each one is like 100 pumps and has a store the size of a Wal-Mart, I’m not exaggerating. They have everything from fresh food and homemade candy to furniture, local art, and an entire branded clothing line. Courtney and I walked out of there with barbecue sandwiches, saltwater taffy, a bag of Beaver Nuggets, two bathing suits and a fanny pack.

The rest of my IRL 2020 was okay. Stayed with my parents, looked for jobs remotely, did my best to stay safe from COVID in Florida where nobody really cares. I feel like we've all had some version of that. But yeah, I’m glad we got to break up the year with a big ol road trip.

Read next: The present and future of NGP

This is part 3 of a lil blog series I'm writing about my 2020. Here are the previous posts:

• 2020: COVID drain, my NG life after Grounds Patrol
• 2020: The Newgrounds Podcast was born (and looked nothing like it does now)

The 2020 Summer Block Party changes everything

The Block Party started as me basically saying this: “Hey, we should do an event type thing. I did an event type thing last year and got some art and music made for it and it was fun. We should do something like that.”

The thing I’d done last year was called “Operation 2009”, and it was kind of a proto-NGP episode of Grounds Patrol where I roped @GoodL, @littlbox and @PsychoGoldfish into exploring a WaybackMachine archive of Newgrounds from ten years earlier. Just for fun, I put some extra time into the “fiction” of the episode, trying to sell the radio-drama aspect of the four of us meeting each other and going back in time, and I also drafted @Snackers and @dogl to do custom art and music. The experiment was a success; the extra level of production enabled us to present the episode as a Big Deal when it otherwise would’ve been just “I record myself looking at a website archive with some guests”.

So when I said we should do an event, that’s what I meant at first. Just a special episode we could do to have some fun and get some attention. When I started the conversation with the crew, though, they started talking about the “event” as an actual live thing we could do with the community. (A much better idea.)

I do know that I eventually threw out the concept of the “summer block party”, which I imagined as kind of an online representation of a little parking lot carnival. You know, a party your town or church throws where there’s a giant slide, and a DJ, and artists setting up stands to make balloon animals and draw your picture and all that. I pictured setting up a bunch of voice channels in our server at once, each one basically having a remote streaming version of one of those stands. There’s an art channel, a live DJ music channel, a Jackbox games channel, a raffle. Oh, and of course a live recording of NGP, because if we don’t get a solid episode out of the whole thing, what was it all for? People’s enjoyment? Please.

Once we decided on that idea, the next thing I wanted to do was make sure the whole thing wouldn’t fall solely on GoodL/PsychoGoldfish/myself to organize solo. So I started an effort to find someone, preferably in the NGP crew, to oversee each category. GoodL took the live recording, PsychoGoldfish took the game streaming, I took the raffle.

All fairness, others on the NGP crew didn’t really bite on this. Some couldn’t commit, some didn’t feel up to the task of organizing, some preferred to enjoy the event rather than work it, some didn’t really understand what the event was, some I just didn’t hear from. (Props, though, to @Staggernight who at one point offered to take the live recording responsibilities when GoodL had a scare with his work schedule.) I ended up pulling double-duty on raffle and music, which left only the art streams to cover, and for that we decided to reach outside our circle.

I didn’t know too much about @Xinxinix at that point, except that he ran a show of his own called @GRNDSbreaking and that he loved art. I also knew from that show that I liked his voice and personality, and I believe GoodL and I did talk at one early point about inviting him on the show as a co-host, but we felt like that would undermine the show he already had.

We reached out to Xin to help run our art streams, and suddenly it was like we’d lit a firecracker. Not only did he love the idea and agree immediately to help, he quickly put together an art streaming event on such a huge scale that the rest of our event was dwarfed hilariously in comparison. We soon had three DJs lined up, two or three game streams, and (I always forget this number exactly) like 24 artist streams. Lesson learned: Xin doesn’t do small.

Here’s a fun detail in all of this: as all of this is going on, my partner/best friend/roomie/NGP announceress Courtney and I were working on moving out of town. I’ll talk more about why later, but it matters here because our moving date was slated for two days after the Block Party, which meant I was preparing my end of the event while packing up our apartment and figuring out logistics for a whole cross-country road trip we were about to do. Fun!

LOL, so I have to talk about the raffle. So it started with us wanting to give away one big showstopper item, something fun and big enough to draw people’s attention. We decided on a Nintendo Switch because it was the proper price, could be delivered straight from Amazon, and was something we figured mostly everybody on NG would be interested in. We threw some Steam keys in there too since you don’t have to ship those. As we organized, people started volunteering their own items to throw into the pot, and pretty soon we were listing a whole suite of cool stuff from @AntonioMabs, @wavetro, @BrandyBuizel, @Luis, @WonderSchwifty, @ninjamuffin99, @TheDyingSun…

Of course, we needed to cover the cost of the Switch and all the shipping, so we needed to sell raffle tickets. PsychoGoldfish stepped up to the plate and programmed an entire Paypal-based point of sale system for us to run. It was my job to field ticket purchases, log people’s info, note any exceptional shipping details, etc. That became a lot of work! I can’t complain too much though, because GoodL was largely stuck with shipping the large amounts of items. I was a bit of an idiot in how blindsided I was by the amount of work the raffle became. On top of that, we realized late in the game that a ticket-sale raffle like this isn’t really technically legal without some kind of permit. Hey, don’t be a narc, alright?

When the day came, surprisingly enough, we were just about ready to go. We’d built the channel structure into our own server, so at the flick of a switch the generic text-and-voice-chat setup we had would transform into colorful Block Party land. I was still a little worried nobody would show up, but thanks to a big push from word-of-mouth and the NG front page banner (amazing), they did. We did the opening show. It was exciting. I flipped the switch for the channels. Nothing really worked. I scrambled to fix everything as the now-huge crowd struggled to find channels that wouldn’t appear. But it was okay -- within a few minutes everything was fine and the party started proper.

Guess what? IT WENT GREAT. Everything was so enjoyable. Huge crowd, lots to do. Xin’s art section was the showstopper event of the whole thing, as he led like five straight hours of dialogue between dozens of artists all streaming together. Real talk, though, for me the Block Party was like six straight hours of steady panic. I was fielding last-minute ticket sales all day as we painfully inched our way to covering all the costs. Between all that, I was darting between channels, making sure everything was working, and handling communication with DJs. Hey, look, the host of the party is never gonna relax. It’s alright, that’s part of the fun.

Are we gonna do a Block Party this year? Maybe. If we do, it’ll be a bit different. One thing I wasn’t happy with, which ironically is something I was really excited about in the beginning, was the concept of all these artists doing their things simultaneously. Like I said, I pictured it as the parking-lot carnival where everything happens at once and you can go do whatever strikes your fancy, but in our case that format meant the channels were always stealing each other’s audiences. I felt particularly bad for the DJs that had to compete with the art streams; nobody likes performing for an empty room. We did our best to cooperate and push people to channels in equal measure, but next time I think everything would be better as a single lane, everything happening one at a time. Also, no friggin ticket sales. Maybe we just get one thing to give away through Patreon funds(!!!) and help artists raffle their own goods on the side. We’ll see!

Lastly, and we’ve covered this extensively over the last few months, but I have to say one more time how timely and wonderful the Block Party ended up being during a very depressing COVID summer. I am so endlessly glad we were able to give people a kickass party like that when we were all feeling so disconnected. We watched The Room together that night, laughed a ton, and that was it. I ate dinner, went to sleep, woke up and packed for a day straight.

Read next: Courtney and I left LA and drove across the USA (again)