Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

North Korean campaign targeting security researchers

blog.google

Post reply on HN
Print view View original

241–250 of 302 posts

Re: North Korean campaign targeting security researchers

#241

Post by raincole »

momothereal wrote: post #122
0xDEAFBEAD wrote: post #37

I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it. If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)

It looks like it just got taken offline

I think it's better to give an obvious warning and archive it. As a reminder to people.

Re: North Korean campaign targeting security researchers

#242

Post by nottheengineer »

rl3 wrote: post #233
0xDEAFBEAD wrote: post #37

I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it. If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)

> I notice that the getsymbol tool on Github has 214 stars ... Analysis of which accounts starred it prior to publicity is probably a worthwhile endeavor. If there's any commonality with other obscure projects, that may be an indicator those accounts could be puppets.

Unfortunately that opens up a whole new can of worms. There are already sites that guess how fake amazon reviews are, maybe we need something similar for github.

I hope an analysis like you proposed could yield some insights to patterns or maybe even enough data to do some machine learning on.

Re: North Korean campaign targeting security researchers

#243

Post by gnyman »

mackey wrote: post #19
jjkeddo199 wrote: post #2

This is doubly concerning: Not only for researchers, but also for the public. I always imagined the North Koreans to be at a technical level where they would be the ones consuming published exploits more so than imagining their own. This article means that they are advanced enough to focus on suppressing knowledge rather than consuming what is publicly available.

There is an interesting podcast called Lazarus Heist that covers this stuff.

Second this, produced by BBC https://www.bbc.co.uk/programmes/w13xtvg9

Gave a lot of insight and background into North Korean hackers, how they operate, how they live and so on. I was familiar with their operations from before, like the SWIFT hack from being in the infosec field. But I still learned a lot.

Re: North Korean campaign targeting security researchers

#244

Post by kuchenbecker »

rvba wrote: post #189
throwawayapples wrote: post #144

> Upon discovery, all identified websites and domains are added to Safe Browsing to protect users from further exploitation. dbgsymbol.com is NOT showing up with warning in Safe Browsing on my Brave browser. (warning, unknown vector)

Safe browsing is there for Google to spy on you easily, not to detect hacks.

Safebrowsing uses a privacy preserving hash prefix algorithm to match against urls.[1]

1 - The first 4 bytes of all url hashes in the blocklist are cached in the browser.

2 - When there is a match, you request of Google the actual urls on the blocklist.

3 - Client side your browser blocks loading the url.

Google only knows that the site had a hash collision with the first 4 bytes of something in the blocklist.

I, personally, think that's a fair price for otherwise free malware protection. It's also built into Firefox and on by default. [2]

[1] https://developers.google.com/safe-browsing/v4#update-api-v4

[2] https://wiki.mozilla.org/Security/Safe_Browsing

Re: North Korean campaign targeting security researchers

#245

Post by daliusd »

plaguuuuuu wrote: post #216
ARandomerDude wrote: post #204

Earlier quoted context omitted.

Yeah — other than the famines, forced labor, summary executions, and mandatory dictator cult it’s probably a great place.

If you're a member of an elite cyber-intelligence military branch who knows, it might not be as bad. The USA is also great if you earn 200k/y as a software developer. If you're a teacher, not so much.

Yeah, teachers in USA are forced to be teachers and don't have food on regular basis /s

Re: North Korean campaign targeting security researchers

#246

Post by varjag »

0xDEF wrote: post #208
jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

North Americans and Western Europeans are incredibly naive about how authoritarian states work. All authoritarian states will end up having a caste sysem hierarchy. The upper caste have it just as good a people in the West and in modern times they will have unfiltered access to the Internet. They have zero reason to revolt because they have everything then need.

They rarely have it just as good as in the West. But being on the top in your society can make you gloss over a lot.

Re: North Korean campaign targeting security researchers

#247

Post by zx14 »

_xivi wrote: post #223
dewey wrote: post #75

Earlier quoted context omitted.

Wouldn't help if the source code already has the backdoor in there though. Most people would just download and build a tool off GitHub if it has 200 stars and does what they need.

>> By building their binaries from source and hosting them on their servers > Wouldn't help if the source code already has the backdoor in there though I'm not sure if you're aware but random tools don't just spawn in official package repositories overnight. There's a vetting process, for both new packages and new maintainers. Also in established distros, packages don't get accepted to official repositories unless it…

The maintainers can be compromised though. Is every single version of every single "vetted" package / maintainer also vetted?

Re: North Korean campaign targeting security researchers

#248

Post by eastbound »

uoaei wrote: post #194
eastbound wrote: post #180

Earlier quoted context omitted.

And the GitHub Actions… oh man… Insert some tool in your build that comes from another random repository, that uploads an artifact to S3 or similar… GitHub’s architecture entirely is the iMessage of source code.

Could you please expand on your iMessage comparison? I don't understand what you're referencing.

A lot of useful features are missing from actions/checkout@v3, so people have to either program actions manually, or use ones made by other GitHub users. Actions are build steps, such as opening a firewall before building, preparing a directory, or caching Maven artifacts.

It would be very easy to add a backdoor to one of those build steps.

The comparison with iMessage is that it’s unsafe by design, at the architecture level, because you’re relying on live code made by anonymous people. One day, attack vectors will be found every second day.

Re: North Korean campaign targeting security researchers

#249

Post by pxeger1 »

mattigames wrote: post #239
noitpmeder wrote: post #238

Earlier quoted context omitted.

They are almost certainly pulling on talent pools from one of the neighboring nations.

You can say China, they cannot kill you over the internet... yet.

They probably said "neighbouring nations" because they're also including Russia. (Russia has a few miles of border with North Korea)

Re: North Korean campaign targeting security researchers

#250

Post by altacc »

user3939382 wrote: post #222

I’m surprised that NK can have such weak computing education at the population level and still find enough high level hackers and cybersecurity people to do these things.

From what I've read from NK experts: they intentionally and intensively create hackers. If you are a child in NK who shows skills in mathematics then you will be monitored and if you are good enough you will be sent to a special mathematics school, where you learn pretty much nothing else. After that you are sent to the one technical university to study computer programming intensively for years. If you pass muster then you will be shipped to China, from where you'll use the better internet access to do anything from steal MMORPG gold, phishing attacks or find zero days. It sounds like a bleak life of 12 hours, constant pressure to deliver and living in cramped dorms. So, a bit like Silicon Valley ;)
Post reply on HN