Earlier quoted context omitted.
This is absolutely because NK doesn't want to pay market rate for 0days.
What is market rate for a 0-day?
Protection against going to jail is generally part of such a package.
North Korean campaign targeting security researchers
121–130 of 302 posts
Re: North Korean campaign targeting security researchers
#122I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it. If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)
It looks like it just got taken offline
Re: North Korean campaign targeting security researchers
#123I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it. If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)
The source code itself looks relatively clean; there's autoupdate functionality but it looks like it's gated behind a confirmatory dialog box.
It's much more likely that the binary releases and/or autoupdate binaries are backdoored. If someone compiles their own version, and then clicks to accept the autoupdate, they could be infected. The binary is 15+MB in size, which is far more than enough to hide a small backdoor.
Re: North Korean campaign targeting security researchers
#124How did they determine the threat is coming from North Korea?
Someone of you may enjoy this[0] podcast on the North Korean Lazarus Group.
[0] https://www.bbc.co.uk/programmes/w13xtvg9/episodes/downloads
Re: North Korean campaign targeting security researchers
#125How did they determine the threat is coming from North Korea?
From the article: "The shellcode used in this exploit is constructed in a similar manner to shellcode observed in previous North Korean exploits."
Re: North Korean campaign targeting security researchers
#126I wonder how legit are some of the most popular download sites: e.g ffmpeg windows binaries [1] are hosted from some random person’s site. Sure you can check the checksum etc but that still doesn’t guarantee any relationship with a specific git commit. I would just assume that non-gh or official hosted downloads (where reproducible/attested builds are available) are just state actors by default. Am I paranoid? How do…
Why trust Github? The GetSymbol tool has 215 stars there. Looks perfectly legit unless you check the issues. https://github.com/dbgsymbol/getsymbol
You don't trust Github to not host any malware, and you don't trust Github to not have malicious users.
You trust Github to have reasonably good security, and to not maliciously meddle with user content, so that if you see a repository under github.com/neovim, and you additionally trust the user called neovim, then you can reasonably trust that any repositories under github.com/neovim don't contain malware.
Re: North Korean campaign targeting security researchers
#127Earlier quoted context omitted.
> The shellcode used in this exploit is constructed in a similar manner to shellcode observed in previous North Korean exploits. At minimum the payload.
1. DPRK does an actual cybercrime, shellcode/payload eventually gets discovered and disseminated among researchers 2. Script kid acquires said code, makes slight modifications 3. Script kid deploys the malware 4. Cybersec person @ Google is promoted for uncovering major APT operation, big news story How do you prove that this is sufficiently implausible?
i dont think proof is on the table here. you just have to speculate, and make an educated guess.
Re: North Korean campaign targeting security researchers
#128Earlier quoted context omitted.
> The shellcode used in this exploit is constructed in a similar manner to shellcode observed in previous North Korean exploits. At minimum the payload.
1. DPRK does an actual cybercrime, shellcode/payload eventually gets discovered and disseminated among researchers 2. Script kid acquires said code, makes slight modifications 3. Script kid deploys the malware 4. Cybersec person @ Google is promoted for uncovering major APT operation, big news story How do you prove that this is sufficiently implausible?
As shown in the Snowden leaks, The United States was in development of exactly this capacity and its essentially impossible to attribute attacks to nations like this. Anyone who claims to be able to is either ignorant or lying.
Re: North Korean campaign targeting security researchers
#129Earlier quoted context omitted.
Probably more carrot than stick. NK hackers who can bring in millions to the state from crypto hacking, ransom etc likely live more comfortably than manual laborers.
Probably way less comfortably than if they could move to a civilized country though.
But they can't, so it's a moot point.
Re: North Korean campaign targeting security researchers
#130I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it. If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)
This also serves as a reminder that code hosted on github might be malicious and we shouldn't blindly trust those just because the author seems to have similar interests.. I've done that multiple times :(
That's true, but in this case the code might be fine and the executables they provide on GitHub bogus. It's tricky to keep in mind that GitHub is not a trusted build source.