Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

North Korean campaign targeting security researchers

blog.google

Post reply on HN
Print view View original

251–260 of 302 posts

Re: North Korean campaign targeting security researchers

#251

Post by altacc »

jszymborski wrote: post #161
jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

I don't think there are many options here: - They can't get to X freer country as that's just difficult for all North Koreans - They likely can't just stop hacking for carrot and/or stick reasons. They are likely closely monitored. - Maybe some people drink the kool-aid. I'm sure these people are very well compensated.

I think it's mostly the control from the first 2 points you mention. They are often working from China, where the authorities will not help them. "Well compensated" in North Korea terms means not starving and your family has not yet been sent to a forced labor camp. Escaping means your family suffers terribly.

Re: North Korean campaign targeting security researchers

#252

Post by altacc »

varjag wrote: post #246
0xDEF wrote: post #208

Earlier quoted context omitted.

North Americans and Western Europeans are incredibly naive about how authoritarian states work. All authoritarian states will end up having a caste sysem hierarchy. The upper caste have it just as good a people in the West and in modern times they will have unfiltered access to the Internet. They have zero reason to revolt because they have everything then need.

They rarely have it just as good as in the West. But being on the top in your society can make you gloss over a lot.

Yep, even a lot of Western political demagoguery is telling people they have it good compared to some unfortunate others, so that the politicians can avoid having to actually make things better.

Re: North Korean campaign targeting security researchers

#253

Post by account42 »

gregsadetsky wrote: post #200
gregsadetsky wrote: post #172

Earlier quoted context omitted.

Found these two forks which are still accessible (and are supposedly up to date with the upstream repo (linked in the comment above) which is not accessible anymore): https://github.com/bb33bb/getsymbol https://github.com/clayne/win-getsymbol here is the same link as in the comment above from one of the forks: https://github.com/bb33bb/getsymbol/blob/main/GetSymbol/CMai... the code fetches from `UPDATE_CHECK_URL`, wh…

wow! all mirror repos (I found 5) have since been disabled :-) you can still see cached bits of the code via github search -> https://github.com/search?q=path%3AGetSymbol%2FCMainDlg.cpp+... and a tiny bit of the repo's main page in google's cache: http://webcache.googleusercontent.com/search?q=cache%3Ahttps... and the user's github profile, again from google's cache: https://webcache.googleusercontent.com/search?q=ca…

Github just erasing a repo and forks from existence is scarier than any potential malware that could have been included there. Not the first time they have done this - usually based on copyright accusations, but the reason does not matter - if you must use ShitHub, at least mirror your projects elsewhere folks.

Re: North Korean campaign targeting security researchers

#254

Post by account42 »

userbinator wrote: post #228
madeofpalk wrote: post #185

Earlier quoted context omitted.

What's the point of the warning? Wouldn't Github just removing the offending repo?

Unfortunately, looks like it did. ...which while admirable from one perspective, also effectively destroys the evidence. I prefer the warning instead.

It also normalizes removing repositories for other reasons.

Re: North Korean campaign targeting security researchers

#255

Post by account42 »

pciexpgpu wrote: post #21

I wonder how legit are some of the most popular download sites: e.g ffmpeg windows binaries [1] are hosted from some random person’s site. Sure you can check the checksum etc but that still doesn’t guarantee any relationship with a specific git commit. I would just assume that non-gh or official hosted downloads (where reproducible/attested builds are available) are just state actors by default. Am I paranoid? How do…

I trust random developers more to host software that does not go against my interests than big tech corporations.

Re: North Korean campaign targeting security researchers

#256

Post by teddyh »

SigmundA wrote: post #212
MarkSweep wrote: post #201

Earlier quoted context omitted.

I don’t know if I 100% follow or agree with the comparison of iMessage and GitHub actions. But iMessage has had a number of interesting security vulnerabilities over the years in image parsing and deserialization. One example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Or a story from today: https://news.ycombinator.com/item?id=37425007 So perhaps the similarity between iMessage and GutHub action…

And yet Android had multiple high and critical CVE's reported in the last few days with little coverage: https://source.android.com/docs/security/bulletin/2023-09-01

«А у вас негров линчуют»

Re: North Korean campaign targeting security researchers

#257

Post by bombolo »

NelsonMinar wrote: post #179
jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

The excellent BBC podcast The Lazarus Heist talks some about the lives of North Korean hackers: https://www.bbc.co.uk/programmes/w13xtvg9/episodes/downloads They're closely monitored where they work and often have threats against their family.

[dead]

Re: North Korean campaign targeting security researchers

#258

Post by account42 »

diego_sandoval wrote: post #116
pciexpgpu wrote: post #21

I wonder how legit are some of the most popular download sites: e.g ffmpeg windows binaries [1] are hosted from some random person’s site. Sure you can check the checksum etc but that still doesn’t guarantee any relationship with a specific git commit. I would just assume that non-gh or official hosted downloads (where reproducible/attested builds are available) are just state actors by default. Am I paranoid? How do…

> ffmpeg windows binaries [1] are hosted from some random person’s site The same thing happens with mpv: https://mpv.io/installation/ The Windows download is provided by "shinchiro" on SourceForge. The MacOS download is provided by "stolendata", on stolendata.net

Wait until you find out that useful programs like MPV are not developed by giant corporations but by individuals or small teams. Trust something hosted on mpv.io made by the MPV maintainer but freak out when that maintainer delegates release builds for some platforms to someone else he is comfortable linking to. MPV probably also uses many libraries developed by other individuals. A society build on trust is a GOOD thing.

Re: North Korean campaign targeting security researchers

#259

Post by account42 »

userbinator wrote: post #230
tough wrote: post #190

Earlier quoted context omitted.

That's on their own fault, and on the alternative closed source scenario nobody would be able to read the source without reverse engineering it first

I did, and on the rare occasion that I need to use a downloaded binary today, still open it in a text editor and scroll through it for a cursory look. Packed -> reject. Bigger than expected -> reject. URLs or other strings, especially obfuscated, not related to expected functionality -> reject. Online AV multiscanners offer a reasonable alternative for those who aren't familiar with this sort of quick-glance RE, alth…

> Online AV multiscanners offer a reasonable alternative

You're right, (not just) online AV multiscanners are also FUD machines that will happily accept malicious programs but reject anything well crafted and optimized because it doesn't like exactly like the shit MSVC craps out with default settings.

Re: North Korean campaign targeting security researchers

#260

Post by mpalfrey »

NelsonMinar wrote: post #179
jedberg wrote: post #154

What I wonder is this: these North Koreans clearly have unrestricted internet access (sort of have to to find 0-days) and they also clearly at least understand English. How have they not accidentally stumbled across media that shows them all the things their state media doesn't?

The excellent BBC podcast The Lazarus Heist talks some about the lives of North Korean hackers: https://www.bbc.co.uk/programmes/w13xtvg9/episodes/downloads They're closely monitored where they work and often have threats against their family.

This is well worth listening to. Great podcast.
Post reply on HN