Ruining Discord Servers with a Bot Exploit!

Imagine me joining your Discord server and using an exploit to give myself Admin. From there I can nuke your Discord server or give everyone staff or promote a scam. The evil is flowing through me.

Well, believe it or not, this is not a power tripping dream that I had. This is a reality. Because the popular Discord alt bot, Double Counter, might have made some seriously amateur mistakes regarding security of their bot and dashboard. The only good news of this is that it didn't fall into the wrong hands. (or maybe it did cause it fell into mine)

LINKS
-----------------------------------------------------------------------------
xyzeva's socials

SOCIALS
-----------------------------------------------------------------------------
Discord Server

Twitter

TIMESTAMPS
-----------------------------------------------------------------------------
00:00 - Double Counter
00:49 - Vulnerability 1: da password in da public code
02:21 - Vulnerability 2: Oppenheimer of Discord
07:31 - Bye Bye Privacy Lens

[NoTextToSpeech]

UPDATE: Double counter did a MASSIVE update that addresses all of the privacy issues.
- They have a way to opt out of the lens feature, both for a whole server and for a user across discord
- AND, if you request to delete your data, you WILL NOT get banned!

Nathan, the owner of double counter, turned this around immaculately. Massive respect and props to him. And thank you all for being constructive with your feedback and coming to this result.

Friendly reminder, these vulnerabilities were disclosed and FIXED before this video. From the Double Counter announcement and from what I saw, this was never exploited in the wild.

[StanleyMOV]

The fact that they ban you from every single server that uses DC just because you don't wanna be tracked is actually insane. Bottom tier company

[donovian]

"Military grade" never means "good" to those with actual military experience

[thephantom]

People seem to forget that "Military grade" just means mass produced by the cheapest bidder

[OoperB]

As an individual with no servers i see this as an absolute win.

[amorfatikhb]

ever since i heard someone say that "military-grade" actually just means serviceable, i haven't been able to take any of those claims seriously anymore

[varram]

As a programmer who works with secrets and api-keys I am amazed at the sheer stupidity of double-counter. Like its honestly impressive that they are making these mistakes 💀💀

Ima nerd out here so you can skip this: sending API requests to private API (discord's API in this case) with your own private API key from the clients side is wild and should never be done (Its commen-sense/cyber-sec 101).

Edit: People (roblox script kiddies) in the comments are waging a war over if I am a "real" programer. I am a programer; I am a full stack dev and code/work with Node.js, Typescript, Next.js, Nest.js, Redis, Mongo DB, SQL, python, etc. And i do in-fact work with secrets and api-keys that need to be kept hidden and protected properly.

Edit 2: I started a war in the comments 💀

[fusedqyou]

Here's the thing: authorization is super easy to implement nowadays. Yet for some reason they thought basic clientsided encryption is the best way to secure their application. NEVER put any sort of security logic on the client, because it will be figured out one way or another. I hope everybody ditches this bot and never uses it again, because this is yet another example of idiots with some programming knowledge putting others at risk.

[notcallmehacker]

I'm absolutely no Lawyer but Double Counter Lens sounds like its gonna violate the GDPR if the user does'nt explicitly agree to have his behavior tracked and data shared

[fxiqval]

as a cybersec guy myself, while i do specialize mostly in maldev, evasion, gamehacking and binary exploitation, i'm really considering finding vulnerabilities in stuff like this cuz of this

[JustTheJames]

That lens thing honestly sounds like it's illegal in Europe. GDPR states users must explicitly consent to all tracking (not just cookies). Not sure if this being a discord bot is some kind of loophole though, I'm no expert.

[JakeIGuess]

The moment I heard "This bot has Administrative privileges" my face almost went through my desk.

STOP GIVING BOTS ADMIN

[pingupongoo]

I want to say that while what you mentioned would be definitely be bad, if you have a bots client secret you can essentially just write your own code and feed it that secret and you control the bot. I'm not sure why this wasn't mentioned, because with a bot's clientid you can just write code to have it loop through every server, ban every player, delete every message... you get the idea. While its certainly more fun and chaotic to give everyone admin if someone actually wanted to do damage they could have wiped every server this bot was in with some very simple code

[cron]

Military grade just means the cheapest that works

[coletomlinson]

Fun fact: Double counter will also ban you from any servers you try to join if you happen to have a sibling or someone else on your wifi network that also uses discord because it thinks you're an alt account

So far, Discord bot developers are the only ones that seem able to take the cake from WordPress plugin developers in terms of outrageously stupid vulnerabilities.

[RoyBlox]

As a person who doesnt use Double counter, I see this as an absolute win.

[DjXavier]

That bot can destroy discord predator server

[ccgm_harpy]

As someone who's made a few Discord bots, this is embarrassing. I have no clue how you write this code and don't expect something terrible. I'm not an expert, I'm not even smart. I'm just in awe. I hesitate to call the second issue a vulnerability, it's more like a backdoor. If you're using this bot, stop using it immediately.

[Prometheus_Alt]

I've never heard of this bot, but I think it's great that I don't use this bot.