Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

North Korean campaign targeting security researchers

blog.google

Post reply on HN
Print view View original

271–280 of 302 posts

Re: North Korean campaign targeting security researchers

#271

Post by jacquesm »

tpmx wrote: post #139
zb3 wrote: post #90

Earlier quoted context omitted.

This also serves as a reminder that code hosted on github might be malicious and we shouldn't blindly trust those just because the author seems to have similar interests.. I've done that multiple times :(

Yes. Remember that not only security researchers but also developers in general are extra juicy targets because of e.g. their AWS credentials that sometimes aren't kept as secure as they need to be. Heck, even if you're doing proper SSO with 2FA the tokens can be stolen and data proxied/exfiltrated. At best they can be used for coin mining (running up a huge bill), at worst for stealing private customer data (and the…

> e.g. their AWS credentials that sometimes aren't kept as secure as they need to be

There is some irony in there.

Re: North Korean campaign targeting security researchers

#272

Post by midoridensha »

pirate787 wrote: post #199
bouncycastle wrote: post #196

Earlier quoted context omitted.

Life is probably not bad in North Korea, than the propaganda lead you to believe. Especially if you remain loyal and are a valuable asset.

You're joking right? North Koreans are literally starving to death. https://www.cnn.com/2023/03/03/asia/north-korea-hunger-famin...

Those people probably aren't "valuable assets".

Re: North Korean campaign targeting security researchers

#273

Post by ChrisRR »

zb3 wrote: post #90
0xDEAFBEAD wrote: post #37

I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it. If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)

This also serves as a reminder that code hosted on github might be malicious and we shouldn't blindly trust those just because the author seems to have similar interests.. I've done that multiple times :(

And that includes libraries that you blindly pull down from package managers

Re: North Korean campaign targeting security researchers

#274

Post by ChrisRR »

nottheengineer wrote: post #242
rl3 wrote: post #233

Earlier quoted context omitted.

> I notice that the getsymbol tool on Github has 214 stars ... Analysis of which accounts starred it prior to publicity is probably a worthwhile endeavor. If there's any commonality with other obscure projects, that may be an indicator those accounts could be puppets.

Unfortunately that opens up a whole new can of worms. There are already sites that guess how fake amazon reviews are, maybe we need something similar for github. I hope an analysis like you proposed could yield some insights to patterns or maybe even enough data to do some machine learning on.

But how do I trust the tool that guesses how compromised a repo is?

Re: North Korean campaign targeting security researchers

#275

Post by PhilipRoman »

jacquesm wrote: post #270
PhilipRoman wrote: post #263

Earlier quoted context omitted.

It strikes me as the classic NPM disease. Do we really need a reusable action for disabling a firewall, uploading files, etc.? I mean if it comes from GitHub that's fine, but for anything else I would rather verify the solution and copy the code. It works like a low-tech lock file, except changes are always visible inline in Git history, so less chance of lazy programmers missing changes. I almost laughed when GitHub…

> if it comes from GitHub that's fine No it isn't. It's become normalized but it isn't fine. Whoever thought it was a good idea to download massive amounts of unaudited code at build time to then run it behind your defensive lines should have thought about that a bit longer. CI/CD is great. GitHub/GitLab are great. But combining the two has substantial risks. More so for languages that have broken package management…

You are of course right. I was thinking more in terms of "how do we save clueless developers (and their users) from themselves". They will probably find more ways to shoot themselves in the foot, but any percentage of prevented vulnerabilities is a positive result. Kind of like people trust Google/Apple with their phones.

Re: North Korean campaign targeting security researchers

#276

Post by bdangubic »

SigmundA wrote: post #212
MarkSweep wrote: post #201

Earlier quoted context omitted.

I don’t know if I 100% follow or agree with the comparison of iMessage and GitHub actions. But iMessage has had a number of interesting security vulnerabilities over the years in image parsing and deserialization. One example: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... Or a story from today: https://news.ycombinator.com/item?id=37425007 So perhaps the similarity between iMessage and GutHub action…

And yet Android had multiple high and critical CVE's reported in the last few days with little coverage: https://source.android.com/docs/security/bulletin/2023-09-01

Coverage is proportional to the number of users :)

Re: North Korean campaign targeting security researchers

#277

Post by SigmundA »

jacquesm wrote: post #269
SigmundA wrote: post #212

Earlier quoted context omitted.

And yet Android had multiple high and critical CVE's reported in the last few days with little coverage: https://source.android.com/docs/security/bulletin/2023-09-01

This isn't an Android vs Apple article.

Its not an iOS / iMessage article either but it was brought up here and is the point if this current thread.

Re: North Korean campaign targeting security researchers

#278

Post by amelius »

0xDEAFBEAD wrote: post #37

I notice that the getsymbol tool on Github has 214 stars, and no banner to indicate that the tool is malicious. There is a recently filed issue with a link to the Google blog post, but that's it. If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)

> If anyone from Github is reading this -- I strongly suggest adding a banner or modal dialogue to warn users about the backdoor in this tool, and any other software with a known backdoor (e.g. forks of the project)

I'd also strongly suggest they add a way to flag projects in a way that is appropriate.

Re: North Korean campaign targeting security researchers

#279

Post by jacquesm »

PhilipRoman wrote: post #275
jacquesm wrote: post #270

Earlier quoted context omitted.

> if it comes from GitHub that's fine No it isn't. It's become normalized but it isn't fine. Whoever thought it was a good idea to download massive amounts of unaudited code at build time to then run it behind your defensive lines should have thought about that a bit longer. CI/CD is great. GitHub/GitLab are great. But combining the two has substantial risks. More so for languages that have broken package management…

You are of course right. I was thinking more in terms of "how do we save clueless developers (and their users) from themselves". They will probably find more ways to shoot themselves in the foot, but any percentage of prevented vulnerabilities is a positive result. Kind of like people trust Google/Apple with their phones.

I think it's safe to say that you can just about give up on that. The IT landscape is a horrific mess and it doesn't look like there is any change in direction on the horizon that will help to rectify that.

If you trust Google or Apple with your phone then I'm fine with that, it's your phone, your life. But I've found that trusting companies to have their incentives aligned with your own or with what's good for the world in general is a structural mistake that will find you disappointed each and every time given a long enough engagement. You can't trust that which you don't own and can't verify.

Re: North Korean campaign targeting security researchers

#280

Post by r1ch »

saagarjha wrote: post #97
idkyall wrote: post #86

Earlier quoted context omitted.

I'm really curious where the 0-day is in the code of the project honestly

The 0-day is in a popular software package. The GitHub repo apparently contains a backdoor ability to execute code from the attacker. If I had to guess, this would be the software update functionality here: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...

That's just malware. There's no 0-day here.
Post reply on HN