Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

North Korean campaign targeting security researchers

blog.google

Post reply on HN
Print view View original

191–200 of 302 posts

Re: North Korean campaign targeting security researchers

#191

Post by tough »

throwawayapples wrote: post #151
andreygrehov wrote: post #142

Earlier quoted context omitted.

Got it. Missed that part. Thank you. Looks like a pure assumption. According to CyberProof [1] and CloudFlare [2], the majority of attacks originate from China and the United States. North Korea is not even making it to Top 10. That's why I asked. [1] https://blog.cyberproof.com/blog/which-countries-are-most-da... [2] https://blog.cloudflare.com/ddos-attack-trends-for-2021-q4/

North Korea is a nice foil, because then you don't have to cast aspersions onto trading partners. "Look, see? NK. We even copied some Korean words into the comments."

Isn't NK a small china protectorate anyways?

Re: North Korean campaign targeting security researchers

#192

Post by lucubratory »

jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

"All of our secret agents are loyal patriots, while all of theirs are brainwashed hostages!"

The reality is that like every other country's intelligence services, they would obviously recruit for patriotism. This question is like asking why US intelligence agents who have access to information about the DPRK beyond the propaganda don't defect to the DPRK's superior healthcare coverage, zero school shootings, and better litter management. They don't value those aspects of DPRK society which seem better, and probably don't necessarily trust that they actually are better in X specific circumstance (pretty valid!). I don't see why it would be any different for DPRK intelligence.

Re: North Korean campaign targeting security researchers

#193

Post by EMCymatics »

klausa wrote: post #109

Complete conjecture, but new macOS security update just went up, which includes this tidbit: > Impact: Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. https://support.apple.com/en-us/HT213906 Not a betting man, but I'd guess that's the vulnerability being discussed.

Crazy ty

Re: North Korean campaign targeting security researchers

#194

Post by uoaei »

eastbound wrote: post #180
dkjaudyeqooe wrote: post #130

Earlier quoted context omitted.

That's true, but in this case the code might be fine and the executables they provide on GitHub bogus. It's tricky to keep in mind that GitHub is not a trusted build source.

And the GitHub Actions… oh man… Insert some tool in your build that comes from another random repository, that uploads an artifact to S3 or similar… GitHub’s architecture entirely is the iMessage of source code.

Could you please expand on your iMessage comparison? I don't understand what you're referencing.

Re: North Korean campaign targeting security researchers

#195

Post by vkou »

insanitybit wrote: post #148
vkou wrote: post #145

Earlier quoted context omitted.

Not weird when you consider what is, and what is not a proportionate mitigation of a threat. When someone gets mugged on your street, you can consider taking precautions. If your response is to roll out half a mile of barbed wire, electric fencing, and landmines all through the perimeter of your property, I would say that is absolutely 'upplaying' the actual level of threat. Most Americans' understanding of the actua…

I mean, the response here was a blog post, which doesn't feel particularly upplayed. I also virtually never hear about NK from anyone or fear of NK from anyone day to day, nor do I hear about it particularly often from policy makers. No one is campaigning on fear of NK that I have seen. Perhaps TN is just a radically different world, I'd frankly believe it, but I haven't seen anything too significant at all. The last…

> I mean, the response here was a blog post, which doesn't feel particularly upplayed.

I wasn't criticizing the blog post, I was responding to a comment in this thread that claimed that for some strange reason the danger of NK is systemically underplayed by the media.

I argue that no, the media more typically overplays it, much like it overplays the threat from other non-peer nations. I'm assuming you don't feel like the news is telling you that Iran is a threat either... Which would put you in an informed minority.

Re: North Korean campaign targeting security researchers

#196

Post by bouncycastle »

jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

Life is probably not bad in North Korea, than the propaganda lead you to believe. Especially if you remain loyal and are a valuable asset.

Re: North Korean campaign targeting security researchers

#197

Post by AndyMcConachie »

I worry about how nonchalantly researchers attribute these campaigns. They never tell you their methodology for their attribution, but it's always the attribution that non-technical people pay the most attention to.

Look at this article for example. The first two words are the attributed actor. Yet there is absolutely no way to prove it. Attribution on the Internet is really, really, really difficult. We don't know how difficult it is because we have no independent method to determine when we're right or wrong. And we would be foolish to think that attribution is never politically motivated.

Re: North Korean campaign targeting security researchers

#198

Post by retrac »

jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

They do. But what would they do with that information?

People in the late USSR were in a similar situation. Even without necessarily knowing all the details, the average person, and certainly the intelligentsia and people working in the intelligence services, had a growing awareness of the absurdity of it all, how different the rest of the non-Communist world was, and so on. Something similar is true in China, today. A person in China who wishes to inform themselves about China's history or recent offences against human rights, can at this point, do so, and fairly easily.

But... then what? Can't talk about it. With whom would it be safe? Can't tell others what you've learned. Can't discuss your perspective.

In my view it was not the truth that destroyed e.g. the USSR. It was allowing people to organize independently of state control. That, plus truth, was fatal. Both the Chinese and North Korean ruling parties have learned that lesson. It doesn't actually matter if a significant proportion of the public knows the truth. They can know the truth, alone, in isolation, unable to act on it.

Re: North Korean campaign targeting security researchers

#199

Post by pirate787 »

bouncycastle wrote: post #196
jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

Life is probably not bad in North Korea, than the propaganda lead you to believe. Especially if you remain loyal and are a valuable asset.

You're joking right? North Koreans are literally starving to death.

https://www.cnn.com/2023/03/03/asia/north-korea-hunger-famin...

Re: North Korean campaign targeting security researchers

#200

Post by gregsadetsky »

gregsadetsky wrote: post #172
bowmessage wrote: post #132

Earlier quoted context omitted.

It's the auto-update functionality from a now-suspect URL. The repo has since been taken down, but here's the suspect file: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...

Found these two forks which are still accessible (and are supposedly up to date with the upstream repo (linked in the comment above) which is not accessible anymore): https://github.com/bb33bb/getsymbol https://github.com/clayne/win-getsymbol here is the same link as in the comment above from one of the forks: https://github.com/bb33bb/getsymbol/blob/main/GetSymbol/CMai... the code fetches from `UPDATE_CHECK_URL`, wh…

wow! all mirror repos (I found 5) have since been disabled :-)

you can still see cached bits of the code via github search -> https://github.com/search?q=path%3AGetSymbol%2FCMainDlg.cpp+...

and a tiny bit of the repo's main page in google's cache: http://webcache.googleusercontent.com/search?q=cache%3Ahttps...

and the user's github profile, again from google's cache: https://webcache.googleusercontent.com/search?q=cache:JXXyoV...

the dbgsymbol.com links above still work, obviously.

Post reply on HN