Your Discord Messages Are For Sale (4 Billion of Them)
TLDRA website named spy.pet claims to be selling 4 billion Discord messages for as little as 10 cents, raising privacy and legal concerns. The site, which scraped thousands of Discord servers, offers a searchable database of messages, but only to paying customers. Discord is investigating the site for violating its policies against data scraping. Meanwhile, Telegram faced rumors of a zero-day vulnerability in its desktop app for Windows, which was later confirmed to be a typo in its source code. Telegram quickly fixed the issue. Lastly, 'Trust Wallet' tweeted about a high-risk zero-day exploit targeting iMessage, which was traced back to a dubious dark web site, 'CodeBreach Lab,' suspected to be a scam.
Takeaways
- 🚨 A website named spy.pet claims to be selling 4 billion Discord messages for as little as 10 cents, raising privacy and legal concerns.
- 🔍 The site has scraped thousands of Discord servers and made the data searchable, but it's likely not legal and Discord is investigating.
- 💬 Spy.pet emphasizes user privacy, which is ironic considering it exposes messages, and only paying customers have enhanced privacy.
- 🛍️ The website accepts only cryptocurrency as payment, and a user spent $5 worth of Monero for research purposes to test the service.
- 🤖 Spy.pet uses bots disguised as real users to join servers and collect messages, but private messages are unaffected.
- 🔑 The site provides basic user profiles, including logs of messages sent on tracked servers and voice chat activity.
- 📈 Messages on larger servers are more likely to be exposed, while smaller, private servers are less at risk.
- 📚 Traditional forums have searchable archives, but Discord messages are often treated as ephemeral, leading to more sensitive conversations.
- 🚫 Spy.pet offers a link to request data removal, but it's a joke redirect to a Spiderman clip, indicating no real option to remove data.
- 🤔 The legality of the site is questionable, especially considering GDPR and the fact many Discord users are underage.
- 🛡️ DeleteMe, a service that helps remove personal data from various brokers, is offering a 20% discount with the code Seytonic.
Q & A
What is the claim made by the website spy.pet regarding Discord messages?
-The website spy.pet claims to be selling 4 billion Discord messages, which they have allegedly scraped from thousands of Discord servers and millions of users.
How does spy.pet make the data searchable to users?
-Spy.pet has made the data searchable by allowing users to access it upon payment. However, the legality of this practice is questionable, and Discord is not pleased with it.
What is peculiar about spy.pet's emphasis on user privacy?
-It is peculiar because spy.pet emphasizes user privacy while simultaneously exposing Discord messages, which is the opposite of privacy. The promise of enhanced user privacy seems to apply only to paying customers.
How does spy.pet accept payment for its services?
-Spy.pet accepts payment exclusively in cryptocurrency, specifically Monero, which adds an element of anonymity to the transactions.
How does spy.pet gather data from Discord servers?
-Spy.pet uses an army of bots disguised as real users that join servers and monitor messages sent within those servers. This method does not exploit any vulnerability but relies on the bots' presence in the servers.
What kind of information does spy.pet provide about a user?
-Spy.pet provides a basic profile of users, including the servers they are active on, connected accounts, and a log of all messages sent on servers where spy.pet has bots. It even includes logs of voice chat activity.
How does the size of a Discord server affect the likelihood of its messages being on spy.pet?
-Messages from small servers with a few friends are unlikely to be on spy.pet, but messages from mid-size and larger servers are more likely to be monitored and logged by spy.pet's bots.
What is the significance of the data on spy.pet in terms of privacy?
-The data on spy.pet is significant because many people do not treat Discord messages as permanent, leading to private or sensitive conversations being logged. This could lead to public exposure of information individuals would prefer to remain private.
What action can users take to request the removal of their data from spy.pet?
-Users can attempt to request the removal of their data from spy.pet through a provided link. However, it is noted that this link redirects to a humorous video, indicating that the process may not be effective or sincere.
How has Discord responded to the activities of spy.pet?
-Discord has stated that they are investigating spy.pet and will take steps to enforce their policies, which clearly prohibit data scraping.
What is the potential legal issue with spy.pet's operation?
-The potential legal issues include violating Discord's terms of service, non-compliance with GDPR regarding data removal and processing, and the fact that many Discord users are underage, which complicates data processing permissions.
How does the DeleteMe service help users with data privacy?
-DeleteMe helps users by searching hundreds of data brokers for their personal data, compiling a personalized report, and sending data removal requests on their behalf, alleviating the burden on the user.
Outlines
🔍 Discord Messages for Sale on Spy.pet
A website named spy.pet claims to have scraped and is selling 4 billion Discord messages, with the data searchable for a fee. The site, which emphasizes user privacy while paradoxically exposing messages, accepts only cryptocurrency payments. It operates by using bots to infiltrate Discord servers and collect messages. While private messages remain unaffected, public messages on larger servers are at risk. Spy.pet's legality is questionable, and Discord is investigating the situation. The site also offers 'Enterprise' services for AI training or intelligence gathering. Despite a lack of a legitimate way for users to remove their data, the site has faced increased scrutiny and DDoS attacks. It's likened to a data broker, with the potential for serious legal issues, especially considering GDPR and the involvement of underage users.
🛑 Telegram and iMessage Security Concerns
Telegram faced rumors of a zero-day vulnerability in its desktop app for Windows, which could potentially allow hackers to execute arbitrary code by tricking users into clicking on seemingly harmless images. However, the claims were initially disputed by Telegram, and no technical details were provided. Later, it was revealed that a typo in the list of dangerous file extensions allowed '.pyzw' files to be treated as safe, leading to the confirmed vulnerability. Telegram quickly fixed the typo and implemented a server-side patch. Meanwhile, iMessage was the subject of a high-risk zero-day exploit claim by 'Trust Wallet', suggesting that infected text messages could compromise phones. The source of this claim, 'CodeBreach Lab', was found to be a scam site, with no credible evidence supporting the exploit's existence. The warning was widely discredited, and no instances of the exploit being used were known.
🚫 Scam Alert: CodeBreach Lab's Fake iMessage Exploit
A supposed high-risk zero-day exploit targeting iMessage was reported by 'Trust Wallet', causing significant concern due to the potential for hackers to infiltrate phones via infected text messages. However, the source of the exploit, 'CodeBreach Lab', was identified as a scam site with no credible background. The site claimed to be selling the iOS exploit for $2 million, but its legitimacy was questioned, and it was found to be poorly designed, with non-functional order buttons. No actual sales of the exploit were made, and the entire episode was deemed a scam, with 'Trust Wallet' being the only entity seemingly deceived by it.
Mindmap
Keywords
💡Discord
💡Spy.pet
💡Data scraping
💡Cryptocurrency
💡Bots
💡Zero-day vulnerability
💡iMessage
💡GDPR
💡Data broker
💡DeleteMe
💡DDoS attack
Highlights
A website named spy.pet claims to be selling 4 billion Discord messages for as little as 10 cents each.
The website has scraped thousands of Discord servers and made the data searchable for a fee.
Discord itself is not pleased with spy.pet and is investigating the situation to enforce their policies against data scraping.
Spy.pet emphasizes user privacy despite selling access to Discord messages, which is contradictory.
The website only accepts cryptocurrency as a form of payment, similar to privacy-focused VPN provider Mullvad.
Spy.pet uses bots disguised as real users to join servers and collect messages, ensuring no vulnerabilities are exploited.
Private messages on Discord are unaffected by spy.pet's data collection methods.
Messages sent on larger servers are more likely to be captured by spy.pet's bots compared to smaller, private servers.
Discord messages are not typically treated as permanent, leading to many private conversations being unintentionally archived.
Spy.pet offers a link to request data removal, but it is a joke redirect to a Spiderman clip, indicating no real removal process.
The site has been under the radar until an investigation by 404media brought attention to it.
Spy.pet is open to 'Enterprise' customers, including those interested in AI training or federal intelligence gathering.
The legality of spy.pet's operations is questionable, especially concerning GDPR and the data of underage users.
The site is already facing DDoS attacks and potential legal challenges due to its controversial nature.
Data brokers like spy.pet legally or illegally scrape and sell personal data, with DeleteMe offering a service to help individuals remove their data.
Telegram faced rumors of a zero-day vulnerability but disputed the claims, suggesting the video demonstrating the exploit was a hoax.
A typo in Telegram's source code regarding dangerous file extensions led to a confirmed vulnerability that was quickly patched.
iMessage was falsely reported to have a high-risk zero-day exploit targeting it, originating from a scam site attempting to sell exploits.