Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

North Korean campaign targeting security researchers

blog.google

Post reply on HN
Print view View original

261–270 of 302 posts

Re: North Korean campaign targeting security researchers

#261

Post by dewey »

_xivi wrote: post #223
dewey wrote: post #75

Earlier quoted context omitted.

Wouldn't help if the source code already has the backdoor in there though. Most people would just download and build a tool off GitHub if it has 200 stars and does what they need.

>> By building their binaries from source and hosting them on their servers > Wouldn't help if the source code already has the backdoor in there though I'm not sure if you're aware but random tools don't just spawn in official package repositories overnight. There's a vetting process, for both new packages and new maintainers. Also in established distros, packages don't get accepted to official repositories unless it…

Package managers are not the only way to get software. People build software off GitHub all the time.

Re: North Korean campaign targeting security researchers

#262

Post by misja111 »

altacc wrote: post #250
user3939382 wrote: post #222

I’m surprised that NK can have such weak computing education at the population level and still find enough high level hackers and cybersecurity people to do these things.

From what I've read from NK experts: they intentionally and intensively create hackers. If you are a child in NK who shows skills in mathematics then you will be monitored and if you are good enough you will be sent to a special mathematics school, where you learn pretty much nothing else. After that you are sent to the one technical university to study computer programming intensively for years. If you pass muster t…

A bleak life for sure, but probably still many times better than normal life in NK.

Re: North Korean campaign targeting security researchers

#263

Post by PhilipRoman »

eastbound wrote: post #248
uoaei wrote: post #194

Earlier quoted context omitted.

Could you please expand on your iMessage comparison? I don't understand what you're referencing.

A lot of useful features are missing from actions/checkout@v3, so people have to either program actions manually, or use ones made by other GitHub users. Actions are build steps, such as opening a firewall before building, preparing a directory, or caching Maven artifacts. It would be very easy to add a backdoor to one of those build steps. The comparison with iMessage is that it’s unsafe by design, at the architectu…

It strikes me as the classic NPM disease. Do we really need a reusable action for disabling a firewall, uploading files, etc.? I mean if it comes from GitHub that's fine, but for anything else I would rather verify the solution and copy the code. It works like a low-tech lock file, except changes are always visible inline in Git history, so less chance of lazy programmers missing changes.

I almost laughed when GitHub suggested me an Action for Makefile based projects. The entire build process in my case consists of "make package"...

Re: North Korean campaign targeting security researchers

#264

Post by _xivi »

zx14 wrote: post #247
_xivi wrote: post #223

Earlier quoted context omitted.

>> By building their binaries from source and hosting them on their servers > Wouldn't help if the source code already has the backdoor in there though I'm not sure if you're aware but random tools don't just spawn in official package repositories overnight. There's a vetting process, for both new packages and new maintainers. Also in established distros, packages don't get accepted to official repositories unless it…

The maintainers can be compromised though. Is every single version of every single "vetted" package / maintainer also vetted?

> The maintainers can be compromised though. Is every single version of every single "vetted" package / maintainer also vetted?

Pretty much, packaging is not a brainless process. One of the effort that specifically target this is the Reproducible builds project [0], along with many other security measures set by each distro.

There are also usually multiple testing and updates rolling stages.

The best evidence of how effective these measures is its actual reputation and record on the ground.

[0] https://reproducible-builds.org/

Re: North Korean campaign targeting security researchers

#265

Post by _xivi »

dewey wrote: post #261
_xivi wrote: post #223

Earlier quoted context omitted.

>> By building their binaries from source and hosting them on their servers > Wouldn't help if the source code already has the backdoor in there though I'm not sure if you're aware but random tools don't just spawn in official package repositories overnight. There's a vetting process, for both new packages and new maintainers. Also in established distros, packages don't get accepted to official repositories unless it…

Package managers are not the only way to get software. People build software off GitHub all the time.

> Package managers are not the only way to get software. People build software off GitHub all the time.

The question asked by parent comment was:

"How do Linux/Mac package managers solve this?"

Re: North Korean campaign targeting security researchers

#266

Post by madeofpalk »

account42 wrote: post #254
userbinator wrote: post #228

Earlier quoted context omitted.

Unfortunately, looks like it did. ...which while admirable from one perspective, also effectively destroys the evidence. I prefer the warning instead.

It also normalizes removing repositories for other reasons.

Content providers have an obligation and responsibility to remove content for a variety of reasons. It's already normalised, as it should be.

Re: North Korean campaign targeting security researchers

#268

Post by 3np »

zx14 wrote: post #247
_xivi wrote: post #223

Earlier quoted context omitted.

>> By building their binaries from source and hosting them on their servers > Wouldn't help if the source code already has the backdoor in there though I'm not sure if you're aware but random tools don't just spawn in official package repositories overnight. There's a vetting process, for both new packages and new maintainers. Also in established distros, packages don't get accepted to official repositories unless it…

The maintainers can be compromised though. Is every single version of every single "vetted" package / maintainer also vetted?

This is a good thing to consider when picking Linux distros. Who are the maintainers, is maintenance done in the open, do they enforce reproducible builds, how is review process done, what are requirements for mainters/packages/releases?

You also have the option of building from source yourself. Some package managers and distros (Gentoo, NixOS, Guix) do this for you.

This is BTW the main reason I wouldn't use derivate distros for anything serious.

Debian's generally trusted in the community - their slow pace come from risk-aversiveness.

Re: North Korean campaign targeting security researchers

#269

Post by jacquesm »

SigmundA wrote: post #212
MarkSweep wrote: post #201

Earlier quoted context omitted.

I don’t know if I 100% follow or agree with the comparison of iMessage and GitHub actions. But iMessage has had a number of interesting security vulnerabilities over the years in image parsing and deserialization. One example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Or a story from today: https://news.ycombinator.com/item?id=37425007 So perhaps the similarity between iMessage and GutHub action…

And yet Android had multiple high and critical CVE's reported in the last few days with little coverage: https://source.android.com/docs/security/bulletin/2023-09-01

This isn't an Android vs Apple article.

Re: North Korean campaign targeting security researchers

#270

Post by jacquesm »

PhilipRoman wrote: post #263
eastbound wrote: post #248

Earlier quoted context omitted.

A lot of useful features are missing from actions/checkout@v3, so people have to either program actions manually, or use ones made by other GitHub users. Actions are build steps, such as opening a firewall before building, preparing a directory, or caching Maven artifacts. It would be very easy to add a backdoor to one of those build steps. The comparison with iMessage is that it’s unsafe by design, at the architectu…

It strikes me as the classic NPM disease. Do we really need a reusable action for disabling a firewall, uploading files, etc.? I mean if it comes from GitHub that's fine, but for anything else I would rather verify the solution and copy the code. It works like a low-tech lock file, except changes are always visible inline in Git history, so less chance of lazy programmers missing changes. I almost laughed when GitHub…

> if it comes from GitHub that's fine

No it isn't.

It's become normalized but it isn't fine. Whoever thought it was a good idea to download massive amounts of unaudited code at build time to then run it behind your defensive lines should have thought about that a bit longer. CI/CD is great. GitHub/GitLab are great. But combining the two has substantial risks. More so for languages that have broken package management and namespace issues.

Post reply on HN