Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

North Korean campaign targeting security researchers

blog.google

Post reply on HN
Print view View original

131–140 of 302 posts

Re: North Korean campaign targeting security researchers

#131

Post by rightbyte »

bdowling wrote: post #113
dantillberg wrote: post #102

Earlier quoted context omitted.

This "UpdateCheckThread" code looks pretty funky, [0]. It downloads some stuff from a URL, writes a file to disk, and creates a process to run it. 0: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...

If the code is wrapped in if (updateDlg.DoModal() == IDOK) { … } then doesn’t that mean it only runs that code if the user clicks “OK” on the update dialog? (Edit: I think I understand now. It’s not the code, it’s the update URL that’s the problem, because it’s controlled by NK. So if you run this and blindly click “OK”, then it will download an executable that will infect your PC.) (Edit 2: Or the issue is not in th…

It could be that the code is fine but the URL is compromised?

Re: North Korean campaign targeting security researchers

#132

Post by bowmessage »

nneonneo wrote: post #123
0xDEAFBEAD wrote: post #37

I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it. If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)

The source code itself looks relatively clean; there's autoupdate functionality but it looks like it's gated behind a confirmatory dialog box. It's much more likely that the binary releases and/or autoupdate binaries are backdoored. If someone compiles their own version, and then clicks to accept the autoupdate, they could be infected. The binary is 15+MB in size, which is far more than enough to hide a small backdoo…

It's the auto-update functionality from a now-suspect URL. The repo has since been taken down, but here's the suspect file:

https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...

Re: North Korean campaign targeting security researchers

#133

Post by pixl97 »

saagarjha wrote: post #82
kriro wrote: post #25

Not really shocking or new but kind of interesting. Why would they use 0days on security researchers. My guess is it's a test with upside. On the one hand if it works on a security researcher, you can go "live" because you got a good one and on the other hand you estimate that in the long run you'll get 1+x 0days out of the deal from said researcher. As a security researcher it also presents an interesting situation.…

Security researchers generally have more 0 days.

Also being a security researcher doesn't necessarily mean you're any good at securing your own systems. If you can breakout of the quarantine area of the things the researchers know not to trust, you'll commonly find their own systems are insecure as hell.

Re: North Korean campaign targeting security researchers

#134

Post by hollerith »

verandaguy wrote: post #27
jstarfish wrote: post #8

Earlier quoted context omitted.

> People shouldn’t underestimate their technical capacities or ability to recruit smart hard working people. People hear about third-world living conditions and deprivation and say "aww, cute" as though it's sticks and rocks they're launching into the sea of Japan. They have money...it's all poured into the military. I don't understand why the media downplays them so heavily.

>I don't understand why the media downplays them so heavily. Because in the same way as morale can be a force multiplier, an extreme lack of it can be a force divider. Combine that with their (very likely) inability to sustain even a regional war for more than a few weeks, their antiquated equipment, and their largely unsuccessful domestic military developments, and it's not hard to write them off as largely a non-th…

So, you believe their nuclear weapons don't work?

Re: North Korean campaign targeting security researchers

#135

Post by thecatspaw »

Pathogen-David wrote: post #120
gsuuon wrote: post #77

Earlier quoted context omitted.

If I don't see a github action I'll usually pass on downloading. But what do you mean by "random person's site"? It's ffmpeg.org - is that not a reliable source?

> But what do you mean by "random person's site"? It's ffmpeg.org - is that not a reliable source? The concern is that FFmpeg does not provide Windows binaries for themselves, they link to someone else who does. You could argue that those providers are fine since they're implicitly being endorsed by FFmpeg, but it's not super clear whether they're trustworthy people involved in FFmpeg or randos that opened a GitHub i…

they also link to this repository: https://github.com/BtbN/FFmpeg-Builds

Re: North Korean campaign targeting security researchers

#136

Post by pphysch »

philosopher1234 wrote: post #127
pphysch wrote: post #103

Earlier quoted context omitted.

1. DPRK does an actual cybercrime, shellcode/payload eventually gets discovered and disseminated among researchers 2. Script kid acquires said code, makes slight modifications 3. Script kid deploys the malware 4. Cybersec person @ Google is promoted for uncovering major APT operation, big news story How do you prove that this is sufficiently implausible?

i dont think proof is on the table here. you just have to speculate, and make an educated guess.

I agree, but all the incentives are aligned with making sensational attributions:

- Attackers don't want to get identified, so they won't help

- Defenders, or their bosses, don't want to admit they got owned by a "skid"

- Researchers want to pad their resumes with Serious work, not random skid nonsense

- Media wants sensational stories

Re: North Korean campaign targeting security researchers

#137

Post by hollerith »

bennyg wrote: post #104
verandaguy wrote: post #27

Earlier quoted context omitted.

>I don't understand why the media downplays them so heavily. Because in the same way as morale can be a force multiplier, an extreme lack of it can be a force divider. Combine that with their (very likely) inability to sustain even a regional war for more than a few weeks, their antiquated equipment, and their largely unsuccessful domestic military developments, and it's not hard to write them off as largely a non-th…

I’d bet they’re prepared to do a ton of damage to South Korea via cyberarms more than traditional weaponry too. Eg cut power to the country for days on end. They’ve clearly got 0days and aren’t afraid to use them.

If 'cyberarms' are as potent as you think they are, then how come Russian cyberarms haven't done much damage to Ukraine?

Re: North Korean campaign targeting security researchers

#138

Post by pixl97 »

dewey wrote: post #75
wheelerof4te wrote: post #42

Earlier quoted context omitted.

"How do Linux/Mac package managers solve this?" By building their binaries from source and hosting them on their servers?

Wouldn't help if the source code already has the backdoor in there though. Most people would just download and build a tool off GitHub if it has 200 stars and does what they need.

Github stars are also complete bullshit that can be gamed itself.

Re: North Korean campaign targeting security researchers

#139

Post by tpmx »

zb3 wrote: post #90
0xDEAFBEAD wrote: post #37

I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it. If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)

This also serves as a reminder that code hosted on github might be malicious and we shouldn't blindly trust those just because the author seems to have similar interests.. I've done that multiple times :(

Yes. Remember that not only security researchers but also developers in general are extra juicy targets because of e.g. their AWS credentials that sometimes aren't kept as secure as they need to be. Heck, even if you're doing proper SSO with 2FA the tokens can be stolen and data proxied/exfiltrated.

At best they can be used for coin mining (running up a huge bill), at worst for stealing private customer data (and then selling/ransomwaring it).

Re: North Korean campaign targeting security researchers

#140

Post by gsuuon »

Pathogen-David wrote: post #120
gsuuon wrote: post #77

Earlier quoted context omitted.

If I don't see a github action I'll usually pass on downloading. But what do you mean by "random person's site"? It's ffmpeg.org - is that not a reliable source?

> But what do you mean by "random person's site"? It's ffmpeg.org - is that not a reliable source? The concern is that FFmpeg does not provide Windows binaries for themselves, they link to someone else who does. You could argue that those providers are fine since they're implicitly being endorsed by FFmpeg, but it's not super clear whether they're trustworthy people involved in FFmpeg or randos that opened a GitHub i…

Oh I see I didn't notice the additional links popping up on hover. Oof, that's not great.
Post reply on HN