Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anatomy of a Failed (Nation-State?) Attack

grack.com

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Anatomy of a Failed (Nation-State?) Attack

#21

Post by microgpt »

xrd wrote: post #20

Crime surged during COVID. But, what type of crime? https://www.tandfonline.com/doi/full/10.1080/2330443X.2022.2... Hint: homicides and car theft. Burglary and larceny actually went down. But, homicides surged prior to the start of the pandemic. If there is no correlation between the economic shutdown and homicides, then the crime surge was basically just car theft. Car theft does not come from random homeless people…

We aren't in a recession while the stock market is up, even though that has nothing do with the state of the economy

Re: Anatomy of a Failed (Nation-State?) Attack

#22

Post by microgpt »

OsrsNeedsf2P wrote: post #8
nesarkvechnep wrote: post #2

[flagged]

I found them refreshing and hacker vibes. I understand that's not welcome on HN though

AFAIK it's an autistic person thing (correlating with hackers (for obvious reasons)) to go on little thought tangents (like this one) all the time and parentheses are how you express that in text (much easier than writing prose (effectively delineates the tangent and allows the reader to skip over it)) (yes I'm autistic myself) (yes I'm deliberately exaggerating the effect)

Re: Anatomy of a Failed (Nation-State?) Attack

#23

Post by microgpt »

mmastrac wrote: post #17

Author here - if anyone has any contacts at Cloudflare to get the proxied domains (at least roadpay[.]cc) taken down, that would be great. I wasn't able to get an abuse report to stick. Ditto for the related LinkedIn profile and Twitter accounts. The C2 IP (89.124.107.161) and malware-serving git repo (144.124.244.92) are both hosted on VDSINA in Russia, so not sure if there's anything to do there.

If you're hosting malware today of course you want to host in Russia. Those are the only hosts that won't kick you off the internet or get kicked off the internet themselves for hosting malware. Check what happened to Tony Stark Solutions (or what was it called). Since they didn't police their customers harshly enough, the owners are in prison for aiding and abetting varied cyber-crimes.

Re: Anatomy of a Failed (Nation-State?) Attack

#24

Post by xrd »

microgpt wrote: post #21
xrd wrote: post #20

Crime surged during COVID. But, what type of crime? https://www.tandfonline.com/doi/full/10.1080/2330443X.2022.2... Hint: homicides and car theft. Burglary and larceny actually went down. But, homicides surged prior to the start of the pandemic. If there is no correlation between the economic shutdown and homicides, then the crime surge was basically just car theft. Car theft does not come from random homeless people…

We aren't in a recession while the stock market is up, even though that has nothing do with the state of the economy

No disagreement there, good point.

Re: Anatomy of a Failed (Nation-State?) Attack

#25

Post by rcxdude »

microgpt wrote: post #22
OsrsNeedsf2P wrote: post #8

Earlier quoted context omitted.

I found them refreshing and hacker vibes. I understand that's not welcome on HN though

AFAIK it's an autistic person thing (correlating with hackers (for obvious reasons)) to go on little thought tangents (like this one) all the time and parentheses are how you express that in text (much easier than writing prose (effectively delineates the tangent and allows the reader to skip over it)) (yes I'm autistic myself) (yes I'm deliberately exaggerating the effect)

I'm quite guilty of it and often find myself pushing parenthetical parts into the main text to avoid things getting too badly nested.

Re: Anatomy of a Failed (Nation-State?) Attack

#27

Post by nullbio »

sneakerblack wrote: post #12

This all stinks of Lazarus: https://en.wikipedia.org/wiki/Lazarus_Group I've done incident responses for this exact type of attack multiple times. They've gotten much better organized lately and will often contact developers directly (over LinkedIn or WhatsApp) to run this type of attack. (Although, usually pretending to run a test for a job interview -- which is maybe why the author was confused about the code)

Why assume it is Lazarus?

This sort of an attack is comically simple to pull off with a 12b obliterated LLM model and some basic scripts and proxies.

Security has to evolve, or the world will be cooked by script kiddies running email loops.

There's really nothing sophisticated about this these days, and it's only a short matter of time before it becomes commonplace.

Re: Anatomy of a Failed (Nation-State?) Attack

#29

Post by crossroadsguy »

mmastrac wrote: post #17

Author here - if anyone has any contacts at Cloudflare to get the proxied domains (at least roadpay[.]cc) taken down, that would be great. I wasn't able to get an abuse report to stick. Ditto for the related LinkedIn profile and Twitter accounts. The C2 IP (89.124.107.161) and malware-serving git repo (144.124.244.92) are both hosted on VDSINA in Russia, so not sure if there's anything to do there.

Business establishments don't like to ban troublemakers. Bad for business. (Unless it gets enough bad press, then it becomes good for business).

Re: Anatomy of a Failed (Nation-State?) Attack

#30

Post by robotnikman »

xrd wrote: post #20

Crime surged during COVID. But, what type of crime? https://www.tandfonline.com/doi/full/10.1080/2330443X.2022.2... Hint: homicides and car theft. Burglary and larceny actually went down. But, homicides surged prior to the start of the pandemic. If there is no correlation between the economic shutdown and homicides, then the crime surge was basically just car theft. Car theft does not come from random homeless people…

You definitely make a good point there. The job market is becoming impossible to navigate, and people will become desperate. Bills need to be paid and families need to be fed, if someone loses a job in tech, they could be easily tempted to 'hacking' others nowadays. Its becoming trivially easy to do so thanks the things you mentioned, and if you target others in other countries not allied with the US you could even possibly get away with never getting punished even if caught.
Post reply on HN