221–230 of 302 posts
But the tool also has the ability to download and execute arbitrary code from an attacker-controlled domain. Also known as "automatic updates". Thank you, Big Tech, for indoctrinating the mainstream population into accepting this subservience (or forcing this non-choice on them) --- and now that that subservient and trusting attitude includes security researchers too, it's ironic to see it coming back to bite you. So…
Earlier quoted context omitted.
"How do Linux/Mac package managers solve this?" By building their binaries from source and hosting them on their servers?
Wouldn't help if the source code already has the backdoor in there though. Most people would just download and build a tool off GitHub if it has 200 stars and does what they need.
> Wouldn't help if the source code already has the backdoor in there though
I'm not sure if you're aware but random tools don't just spawn in official package repositories overnight.
There's a vetting process, for both new packages and new maintainers. Also in established distros, packages don't get accepted to official repositories unless it's a critical and highly demanded one.
So yeah, any software can have vulnerabilities, regardless of OS. But stray tools and dubious actors, are pretty much a solved problem in linux distros. The situation on Windows is laughable in comparsion. No need to spread FUD.
Earlier quoted context omitted.
"SoUrCe?" This is clearly comment bait. If you've done any type of opsec before you know the legal hurdles. This is coming from someone (me) who personally saw North Korean IP blocks visit malware research articles via combing the server IP logs and verifying the block.
Attributing cybercrime is never a slam dunk unless you have physical evidence: devices, people, etc. /var/log/*/access.conf is not that. Virtually everything on the wire can be spoofed. Someone in Kansas could own an elaborate network that includes DPRK IPs. And that would be a desirable red herring for any independent criminal. WikiLeaks taught us that the CIA has tools for spoofing their payloads as Russian, Chines…
It's particularly ironic because in this case social media was used to gain access to the researcher's computer:
In one case, they carried on a months-long conversation [on X], attempting to collaborate with a security researcher on topics of mutual interest
HN is another perfect place for that to happen. How do we know that pphysch (or me jryle70) isn't a NK's agent trying to get more information about the technique employed in this case?
Earlier quoted context omitted.
From the article: "The shellcode used in this exploit is constructed in a similar manner to shellcode observed in previous North Korean exploits."
Got it. Missed that part. Thank you. Looks like a pure assumption. According to CyberProof [1] and CloudFlare [2], the majority of attacks originate from China and the United States. North Korea is not even making it to Top 10. That's why I asked. [1] https://blog.cyberproof.com/blog/which-countries-are-most-da... [2] https://blog.cloudflare.com/ddos-attack-trends-for-2021-q4/
Earlier quoted context omitted.
They probably see the crazy shit the western propaganda machine pumps out about them and are reassured. That is not to say NK is absolved of wrongdoing, however.
Honestly true. They are probably patriotic, far from the larger problems, have cognitive dissonance (“im not living in a dystopian shithole because that would be hopeless “, etc. All it takes is one glaring mischaracterization by western media and their beliefs that they are misunderstood by the West are confirmed. They probably even know of many of the bad things that happen but are able to rationalize it.
The simplest explanation here is also the most cruel:
https://news.ycombinator.com/item?id=37425542
Earlier quoted context omitted.
And the GitHub Actions… oh man… Insert some tool in your build that comes from another random repository, that uploads an artifact to S3 or similar… GitHub’s architecture entirely is the iMessage of source code.
Could you please expand on your iMessage comparison? I don't understand what you're referencing.
For certain parts of integration and testing jobs that are operating on untrusted code, it'd therefore be desired to not allow incoming PRs to change certain parts of the CI configuration (not only including .github/workflows, which can be protected using branch protection rules, but the testing framework).
It's possible to achieve this by splitting up your workflows and using workflow_run but it's non-obvious and finicky enough that I very rarely see it done.
GitHub could make this easier and propose better patterns than they do in their attempt to address the problem[0], which I think could use a 2023 follow-up.
[0]: https://securitylab.github.com/research/github-actions-preve...
---
In this context, an iMessage message a GitHub PR, I guess.
I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it. If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)
What's the point of the warning? Wouldn't Github just removing the offending repo?
...which while admirable from one perspective, also effectively destroys the evidence.
I prefer the warning instead.
Earlier quoted context omitted.
Wouldn't help if the source code already has the backdoor in there though. Most people would just download and build a tool off GitHub if it has 200 stars and does what they need.
It's extremely hard to sneak backdoors in open-source code. Which is one of the reasons why a lot of people promote that openness.
Earlier quoted context omitted.
In an ideal world that would be the case, but people barely read the README or documentation.
That's on their own fault, and on the alternative closed source scenario nobody would be able to read the source without reverse engineering it first