it is interesting that most of the CVEs are "use after free". instead of being stuck in an endless cycle of detection and patching, maybe, it's time we consider better ways...
[deleted]
Countering threats from North Korea
21–30 of 172 posts
Re: Countering threats from North Korea
#22What evidence do they have that suggests these threats are coming from North Korea?
[deleted]
Re: Countering threats from North Korea
#23Will WebAssembly save us from this kind of CVEs?
assuming it has capabilities to support "modern" web
Re: Countering threats from North Korea
#24What evidence do they have that suggests these threats are coming from North Korea?
A statement from Google.
I'm actually surprised Google would say this is from the DPRK government without also saying it had has been verified by US federal government authorities. Usually they leave it for others to deal with statements at that level.
Re: Countering threats from North Korea
#25> Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages. These safeguards included: * Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site. * In some email campaigns the targets received links with unique IDs. This was potentially used to enforcea one-time-click po…
We see some of this with just normal spear phishing against companies. The "single click" thing is reasonably common, it makes things a bit harder to catch as often the clickthrough will change to whatever is being spoofed in the first place. A homophone ycornbinator.com would serve the malware first time, then next time it would send a permanent redirect. Unique IDs you'll see in things like spam SMS, both to work a…
Thanks for the input. A nit, sorry, but maybe relevant to readers learning a little about anti-phishing: homophones sound the same ('-phone' refers to sound, like telephone) but differ in meaning, such as 'write' and 'right'. I don't know the term for ycombinator.com / ycornbinator.com, which is a real problem, of course.
Re: Countering threats from North Korea
#26Couldn't they just hardware mitm the CPU and Ram, not to be prisoner of AES. This way they can dump stages as well.
Re: Countering threats from North Korea
#27Earlier quoted context omitted.
I am receiving increased SMS spam past week. Is connected to this exploit? Msgs are all different domains with unique ID appended.
Me too, receiving spam job offers with bit.ly links.
I too saw one of these. Very odd since I was expecting a note about a job.
Re: Countering threats from North Korea
#28I am so fucking done with the internet turning into a trash pile of scams and exploits.
Countries have been doing terrible things to people since long before the internet
> Countries have been doing terrible things to people since long before the internet
What do you conclude? We shouldn't care or do anything? The Internet, the medium, seems to greatly increase the volume of scams and from everyone, not just countries.
Re: Countering threats from North Korea
#29Will WebAssembly save us from this kind of CVEs? assuming it has capabilities to support "modern" web
How will WebAssembly save us?
Re: Countering threats from North Korea
#30Couldn't they just hardware mitm the CPU and Ram, not to be prisoner of AES. This way they can dump stages as well.
[deleted]