Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

North Korean campaign targeting security researchers

blog.google

Post reply on HN
Print view View original

201–210 of 302 posts

Re: North Korean campaign targeting security researchers

#201

Post by MarkSweep »

uoaei wrote: post #194
eastbound wrote: post #180

Earlier quoted context omitted.

And the GitHub Actions… oh man… Insert some tool in your build that comes from another random repository, that uploads an artifact to S3 or similar… GitHub’s architecture entirely is the iMessage of source code.

Could you please expand on your iMessage comparison? I don't understand what you're referencing.

I don’t know if I 100% follow or agree with the comparison of iMessage and GitHub actions. But iMessage has had a number of interesting security vulnerabilities over the years in image parsing and deserialization. One example:

https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

Or a story from today:

https://news.ycombinator.com/item?id=37425007

So perhaps the similarity between iMessage and GutHub actions is there are a lot of things that could go wrong. In iMessage it’s a pile of memory unsafe code that was not originally designed to withstand attack. In GutHub actions there is a lot of trust in their parties that could potentially be exploited.

Re: North Korean campaign targeting security researchers

#203

Post by throwaway374208 »

AndyMcConachie wrote: post #197

I worry about how nonchalantly researchers attribute these campaigns. They never tell you their methodology for their attribution, but it's always the attribution that non-technical people pay the most attention to. Look at this article for example. The first two words are the attributed actor. Yet there is absolutely no way to prove it. Attribution on the Internet is really, really, really difficult. We don't know h…

Citlab partners with various private data brokers to obtain commercial security intelligence, you'll see them referenced within their reports at times.

Based on this, I generally assume that their attribution is accurate. However, if you take a step back and view it objectively, it appears quite hypocritical, given the privacy-invasive origins of this intelligence.

Re: North Korean campaign targeting security researchers

#204

Post by ARandomerDude »

lucubratory wrote: post #192
jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

"All of our secret agents are loyal patriots, while all of theirs are brainwashed hostages!" The reality is that like every other country's intelligence services, they would obviously recruit for patriotism. This question is like asking why US intelligence agents who have access to information about the DPRK beyond the propaganda don't defect to the DPRK's superior healthcare coverage, zero school shootings, and bett…

Yeah — other than the famines, forced labor, summary executions, and mandatory dictator cult it’s probably a great place.

Re: North Korean campaign targeting security researchers

#205

Post by calgarymicro »

bouncycastle wrote: post #196
jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

Life is probably not bad in North Korea, than the propaganda lead you to believe. Especially if you remain loyal and are a valuable asset.

> Life is probably not bad in North Korea, than the propaganda lead you to believe.

If this were the case then it would not be necessary for them to shoot people trying to leave.

Re: North Korean campaign targeting security researchers

#206

Post by nonethewiser »

CP3f6kMA wrote: post #156
jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

They probably see the crazy shit the western propaganda machine pumps out about them and are reassured. That is not to say NK is absolved of wrongdoing, however.

Honestly true. They are probably patriotic, far from the larger problems, have cognitive dissonance (“im not living in a dystopian shithole because that would be hopeless “, etc. All it takes is one glaring mischaracterization by western media and their beliefs that they are misunderstood by the West are confirmed. They probably even know of many of the bad things that happen but are able to rationalize it.

Re: North Korean campaign targeting security researchers

#207

Post by jncfhnb »

hollerith wrote: post #134
verandaguy wrote: post #27

Earlier quoted context omitted.

>I don't understand why the media downplays them so heavily. Because in the same way as morale can be a force multiplier, an extreme lack of it can be a force divider. Combine that with their (very likely) inability to sustain even a regional war for more than a few weeks, their antiquated equipment, and their largely unsuccessful domestic military developments, and it's not hard to write them off as largely a non-th…

So, you believe their nuclear weapons don't work?

Probably not, with insufficient confidence to assume that is the case

Re: North Korean campaign targeting security researchers

#208

Post by 0xDEF »

jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

North Americans and Western Europeans are incredibly naive about how authoritarian states work.

All authoritarian states will end up having a caste sysem hierarchy. The upper caste have it just as good a people in the West and in modern times they will have unfiltered access to the Internet. They have zero reason to revolt because they have everything then need.

Re: North Korean campaign targeting security researchers

#209

Post by jncfhnb »

jstarfish wrote: post #8
AndrewKemendo wrote: post #3

Lifetimes ago as an intelligence officer I spent years tracking DPRK activities and developments. People shouldn’t underestimate their technical capacities or ability to recruit smart hard working people.

> People shouldn’t underestimate their technical capacities or ability to recruit smart hard working people. People hear about third-world living conditions and deprivation and say "aww, cute" as though it's sticks and rocks they're launching into the sea of Japan. They have money...it's all poured into the military. I don't understand why the media downplays them so heavily.

They absolutely do not “have” money in a meaningful sense. They are very poor and the past few years have been much harder than decades past.

Re: North Korean campaign targeting security researchers

#210

Post by fomine3 »

pirate787 wrote: post #199
bouncycastle wrote: post #196

Earlier quoted context omitted.

Life is probably not bad in North Korea, than the propaganda lead you to believe. Especially if you remain loyal and are a valuable asset.

You're joking right? North Koreans are literally starving to death. https://www.cnn.com/2023/03/03/asia/north-korea-hunger-famin...

That's not applied for such hackers
Post reply on HN