231–240 of 302 posts
What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?
how much of what we think we know about our own governments is verifiably true?
I’m surprised that NK can have such weak computing education at the population level and still find enough high level hackers and cybersecurity people to do these things.
I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it. If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)
Analysis of which accounts starred it prior to publicity is probably a worthwhile endeavor. If there's any commonality with other obscure projects, that may be an indicator those accounts could be puppets.
I wonder how legit are some of the most popular download sites: e.g ffmpeg windows binaries [1] are hosted from some random person’s site. Sure you can check the checksum etc but that still doesn’t guarantee any relationship with a specific git commit. I would just assume that non-gh or official hosted downloads (where reproducible/attested builds are available) are just state actors by default. Am I paranoid? How do…
Earlier quoted context omitted.
The source code itself looks relatively clean; there's autoupdate functionality but it looks like it's gated behind a confirmatory dialog box. It's much more likely that the binary releases and/or autoupdate binaries are backdoored. If someone compiles their own version, and then clicks to accept the autoupdate, they could be infected. The binary is 15+MB in size, which is far more than enough to hide a small backdoo…
It's the auto-update functionality from a now-suspect URL. The repo has since been taken down, but here's the suspect file: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...
What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?
Earlier quoted context omitted.
The source code itself looks relatively clean; there's autoupdate functionality but it looks like it's gated behind a confirmatory dialog box. It's much more likely that the binary releases and/or autoupdate binaries are backdoored. If someone compiles their own version, and then clicks to accept the autoupdate, they could be infected. The binary is 15+MB in size, which is far more than enough to hide a small backdoo…
It's the auto-update functionality from a now-suspect URL. The repo has since been taken down, but here's the suspect file: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...
I’m surprised that NK can have such weak computing education at the population level and still find enough high level hackers and cybersecurity people to do these things.
I’m surprised that NK can have such weak computing education at the population level and still find enough high level hackers and cybersecurity people to do these things.
They are almost certainly pulling on talent pools from one of the neighboring nations.
Earlier quoted context omitted.
And the GitHub Actions… oh man… Insert some tool in your build that comes from another random repository, that uploads an artifact to S3 or similar… GitHub’s architecture entirely is the iMessage of source code.
Could you please expand on your iMessage comparison? I don't understand what you're referencing.
https://arstechnica.com/gadgets/2023/09/apple-patches-clickl...
iMessage itself is a dumpster fire that time and again has been proven to be an attack vector.