Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the “Kim” dump exposed North Korea's credential theft playbook

dti.domaintools.com

Post reply on HN
Print view View original

161–170 of 196 posts

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#161

Post by rikafurude21 »

A4ET8a8uTh0_v2 wrote: post #160
rikafurude21 wrote: post #157

Earlier quoted context omitted.

Youre gonna pretend theres no difference between your entire bloodline (literally) or your salary being on the line? If you work at the Pentagon and see mass murder of civilians you have the option to stop going to work. A north korean hacker does not have that option.

You may be assuming a fair bit. Just because it is evidently true that there is a difference, to the parent, depending on their philosophical bent, it is not impossible that it is the outcome alone that determines level of willingness to accept level of.. dunno what is a good word here.. responsibility. In other words, from where they come from, all other factors are not relevant. I don't subscribe to this particular…

I get that a pure consequentialist can flatten every distinction, but in the real world we still distinguish between (a) ‘I’ll kill your entire bloodline if you stop typing’ and (b) ‘You can resign and face a résumé gap.’ Until we’re ready to treat a bank-teller under duress the same as an armed robber, that difference has to matter.

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#162

Post by codedokode »

alt227 wrote: post #146
codedokode wrote: post #127

Why everyone working with the government doesn't use hardware keys without passwords so that fishing is useless?

Surely people can still phish for the user to insert their hardware key to approve something malicious?

Hardware keys (unlike humans) usually check page URL and do not send the data stored by another domain.

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#163

Post by Ray20 »

JumpCrisscross wrote: post #100
Joel_Mckay wrote: post #86

Earlier quoted context omitted.

State sponsored thieves are not a talent pool that anyone wants in a trusted position. The fact is there were only around 40 unique hacks ever invented, and people simply adapt these into new zero day exploits. Notably, this is now mostly a fully automated process. If people want in, they will get in eventually. =3 x C62=:K6 J@F 2C6 AC66>AE:G6=J 5:D28C66:?8 H:E9 E96 DFCAC:D:?8=J =@H 6DE:>2E6 @7 6IA=@:E E2I@?@>J[ 3FE…

> State sponsored thieves are not a talent pool that anyone wants in a trusted position Why? They’re intelligent, crafty and able to make trade-offs. Empirically, ex-spies have a solid history in reaching commanding positions in politics and business.

> Empirically, ex-spies have a solid history in reaching commanding positions in politics and business.

But it's not because someone wants them there. It's because they can demand the position they want.

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#164

Post by Ray20 »

the_af wrote: post #124
wkat4242 wrote: post #107

Earlier quoted context omitted.

They can always allow more immigration. National populations don't grow only by births.

Apparently, due to cultural, political and economical issues, South Korea cannot/won't do this. I suppose it theoretically could, but in practice it would mean it would cease to exist as it is now. Due to the scale of their population collapse, the influx of immigrants would have to be massive. Which country does that? It would completely overtake its native ethnic population... which unlike a country built on immigr…

> Apparently, due to cultural, political and economical issues, South Korea cannot/won't do this.

Because it's not a problem yet. What's going to stop them from doing it when the birth rate becomes a problem? Almost nothing.

> Due to the scale of their population collapse, the influx of immigrants would have to be massive.

Not really. You are mistakenly extrapolating the situation in the Western world, where purposefully brought in almost only criminals and freeloaders, to Korea. If you organize immigration of labor, then not so many immigrants will be needed

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#165

Post by Ray20 »

forgotoldacc wrote: post #94
moomoo11 wrote: post #71

Earlier quoted context omitted.

How did they manage to brain control millions of people like that? I mean it’s so ludicrous to an outsider.

Nearly every authoritarian country starts with people promising good things. A lot also start with rebels fighting against a group that led a massacre. They're underdog groups with popular support. Then those underdogs take over. They become paranoid about the possibility of being killed themselves, so they repeat the massacres they fought against. A lot of people who supported the new regime think it's just a few re…

It looks like a liberal fantasy. The truth is that along the rivers that run on the border with China there are posts with machine gunners every 100 meters. Brainwashing is obviously nearly zero-effective, since they have to resort to machine guns.

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#166

Post by mr_toad »

JumpCrisscross wrote: post #100
Joel_Mckay wrote: post #86

Earlier quoted context omitted.

State sponsored thieves are not a talent pool that anyone wants in a trusted position. The fact is there were only around 40 unique hacks ever invented, and people simply adapt these into new zero day exploits. Notably, this is now mostly a fully automated process. If people want in, they will get in eventually. =3 x C62=:K6 J@F 2C6 AC66>AE:G6=J 5:D28C66:?8 H:E9 E96 DFCAC:D:?8=J =@H 6DE:>2E6 @7 6IA=@:E E2I@?@>J[ 3FE…

> State sponsored thieves are not a talent pool that anyone wants in a trusted position Why? They’re intelligent, crafty and able to make trade-offs. Empirically, ex-spies have a solid history in reaching commanding positions in politics and business.

> Empirically, ex-spies have a solid history in reaching commanding positions in politics and business.

The only examples I can think of are Putin and George HW Bush.

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#167

Post by mr_toad »

codedokode wrote: post #127

Why everyone working with the government doesn't use hardware keys without passwords so that fishing is useless?

A lot of legacy tech doesn’t support hardware keys. Last government job I had still ran an old SVN server with unencrypted username/password auth (relying on the VPN for security).

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#168

Post by rtpg »

brabel wrote: post #92
rtpg wrote: post #76

Earlier quoted context omitted.

In the initial era of the split between North and South Korea, South Korea both was run by a bunch of people who had a history of outright killing leftists, and the United States was involved in similar actions. The lack of serious offramps to reunification, along with not as huge a delta in quality of life between north and south for a long time (aid from other countries sure helps!), allowed the DPRK to establish i…

> see the painful experience of Germany's unification I had thought that Germans from both sides were overwhelmingly supportive of re-unification, even if it would cause short-term pain??

I don't think that people are like... against unification in principle, but if you are looking at it from the perspective of the State.... lots of pain and money, and at least in the German experience there was plenty of decent state enterprises for West Germany to (glibly) pillage from. People will handwave about North Korean resources, but even those are more or less accessible via China.

And on top of that at the end of the day Germany now has this bloc that votes "the wrong way" in all of its elections. Glib analysis though.

The German split was resolved 35 years ago and is still visible. How much time would a reunified Korea take to equalize itself? If you're a person who cares only about the economics of it all, how long do you think it would take for the payoff of unification to occur? Just seems quite long.

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#169

Post by varenc »

Thorrez wrote: post #115
varenc wrote: post #56

Earlier quoted context omitted.

I ran 'neoprint.php' on myself at Facebook in 2007 and immediately got a stern email about it... It was some script that collected info for responding to law enforcement requests. But after chastising me, the email said "I was gratified that you ran it on yourself". (as opposed to snooping on someone else!) It was just a summer internship and FB was like 'only' 80 engineers back then. But they still took it seriously…

I think that's a little different. It sounds like neoprint.php is an internal Facebook tool for looking up data on Facebook users. So improper usage of it is a privacy problem for users. It's something misbehaving employees might run against celbrities, exes, etc. (e.g. https://www.gawkerarchives.com/5637234/gcreep-google-enginee... ) Otoh nmap isn't a privacy problem for users of Facebook (or any other tech company)…

Yea totally agree. Mainly just wanted to shoehorn in my own story about stern emails at FB! Also I think running nmap on your own development machine is totally legitimate. Lots of reasons you might want to do it.

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#170

Post by the_af »

Ray20 wrote: post #164
the_af wrote: post #124

Earlier quoted context omitted.

Apparently, due to cultural, political and economical issues, South Korea cannot/won't do this. I suppose it theoretically could, but in practice it would mean it would cease to exist as it is now. Due to the scale of their population collapse, the influx of immigrants would have to be massive. Which country does that? It would completely overtake its native ethnic population... which unlike a country built on immigr…

> Apparently, due to cultural, political and economical issues, South Korea cannot/won't do this. Because it's not a problem yet. What's going to stop them from doing it when the birth rate becomes a problem? Almost nothing. > Due to the scale of their population collapse, the influx of immigrants would have to be massive. Not really. You are mistakenly extrapolating the situation in the Western world, where purposef…

I'm not "mistakenly extrapolating" anything, I'm describing the current consensus by population experts. No need to debate me, I'm no expert, I'm just paraphrasing what experts believe. I'm as surprised as you are, I only recently learned of this.

> What's going to stop them from doing it when the birth rate becomes a problem? Almost nothing

Their birth rate is already a massive problem. The South Korean government already acknowledges this is a crisis, it's just that the measures that are politically/socially viable just don't cut it, and Koreans seem unwilling to consider more drastic measures. But the problem is already here, and acknowledged, and already impacting the population of South Korea (there's apparently a "loneliness epidemic" going on already).

Because of the shape the population pyramid takes (more old people than young people) once it reaches the tipping point, which in South Korea it already has, there's no going back. No matter how they try, they simply don't have enough young people to revert it anymore.

> If you organize immigration of labor, then not so many immigrants will be needed

This is not (just) about labor, it's about population decline. Even if Koreans dedicated themselves to having more children, it wouldn't be enough anymore. They are beyond the tipping point. They would need massive immigration to live there and have children there and effectively become "the new Koreans"... and this is obviously unpalatable to many.

I encourage you to read on this. Do not debate me: I'm not the expert here!

Post reply on HN