Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

North Korean campaign targeting security researchers

blog.google

Post reply on HN
Print view View original

291–300 of 302 posts

Re: North Korean campaign targeting security researchers

#291

Post by beardedwizard »

operator-name wrote: post #47
beardedwizard wrote: post #33

Earlier quoted context omitted.

It states clearly in the article the goal was to acquire debug symbols for Ms, Citrix, and others with the goal of reverse engineering. If you have been following Citrix, their Netscaler product has been the subject of multiple high severity vulnerabilities, and they sit in mission critical networks. From here the most likely move is their most common, ransomware, the proceeds from which they use to fund parts of the…

That was the decoy behind the secondary infection vector, not the motivation.

I'm skeptical given the ms attack involved stealing keys from core dumps

Re: North Korean campaign targeting security researchers

#292

Post by nottheengineer »

ChrisRR wrote: post #274
nottheengineer wrote: post #242

Earlier quoted context omitted.

Unfortunately that opens up a whole new can of worms. There are already sites that guess how fake amazon reviews are, maybe we need something similar for github. I hope an analysis like you proposed could yield some insights to patterns or maybe even enough data to do some machine learning on.

But how do I trust the tool that guesses how compromised a repo is?

You post it to HN and claim that it's safe. If you aren't proven wrong in the next 2 hours, it probably is.

Re: North Korean campaign targeting security researchers

#293

Post by lucubratory »

JuanPosadas wrote: post #288
lucubratory wrote: post #192

Earlier quoted context omitted.

"All of our secret agents are loyal patriots, while all of theirs are brainwashed hostages!" The reality is that like every other country's intelligence services, they would obviously recruit for patriotism. This question is like asking why US intelligence agents who have access to information about the DPRK beyond the propaganda don't defect to the DPRK's superior healthcare coverage, zero school shootings, and bett…

> defect to the DPRK's superior healthcare coverage, zero school shootings, and better litter management. I can't believe you're glorifying the DPRK without mentioning that they celebrate Tax Abolition Day since eliminating it in 1974.

Is that true? That is pretty funny if so. The DPRK should start running tourism ads in libertarian newspapers.

Re: North Korean campaign targeting security researchers

#294

Post by zirgs »

jryle70 wrote: post #220
vkou wrote: post #195

Earlier quoted context omitted.

> I mean, the response here was a blog post, which doesn't feel particularly upplayed. I wasn't criticizing the blog post, I was responding to a comment in this thread that claimed that for some strange reason the danger of NK is systemically underplayed by the media. I argue that no, the media more typically overplays it, much like it overplays the threat from other non-peer nations. I'm assuming you don't feel like…

Can you give an example of media overplaying NK?

NK seems to be getting disproportionate media attention compared to other dirt poor and authoritarian countries.

Re: North Korean campaign targeting security researchers

#295

Post by [deleted] »

saagarjha wrote: post #290
g___ wrote: post #285

Earlier quoted context omitted.

"In addition to targeting researchers with 0-day exploits, the threat actors also developed a standalone Windows tool that has the stated goal of 'download debugging symbols from Microsoft, Google, Mozilla and Citrix symbol servers for reverse engineers.' The attackers used a 0-day but getsymbol is not one.

Yep, that’s what I said.

[deleted]

Re: North Korean campaign targeting security researchers

#296

Post by mattigames »

pxeger1 wrote: post #249
mattigames wrote: post #239

Earlier quoted context omitted.

You can say China, they cannot kill you over the internet... yet.

They probably said "neighbouring nations" because they're also including Russia. (Russia has a few miles of border with North Korea)

I would bet money that near all of all the imported hackers come from China and not Russia.

Re: North Korean campaign targeting security researchers

#297

Post by archargelod »

diego_sandoval wrote: post #126
0xDEAFBEAD wrote: post #39

Earlier quoted context omitted.

Why trust Github? The GetSymbol tool has 215 stars there. Looks perfectly legit unless you check the issues. https://github.com/dbgsymbol/getsymbol

You don't trust Github to not host any malware, and you don't trust Github to not have malicious users. You trust Github to have reasonably good security, and to not maliciously meddle with user content, so that if you see a repository under github.com/neovim, and you additionally trust the user called neovim, then you can reasonably trust that any repositories under github.com/neovim don't contain malware.

Even when you trust the repo owner, you can't trust their projects. Bad actor could still sibmit a PR with malicious code and it could be merged just by negligence.

Re: North Korean campaign targeting security researchers

#298

Post by eastbound »

jacquesm wrote: post #279
PhilipRoman wrote: post #275

Earlier quoted context omitted.

You are of course right. I was thinking more in terms of "how do we save clueless developers (and their users) from themselves". They will probably find more ways to shoot themselves in the foot, but any percentage of prevented vulnerabilities is a positive result. Kind of like people trust Google/Apple with their phones.

I think it's safe to say that you can just about give up on that. The IT landscape is a horrific mess and it doesn't look like there is any change in direction on the horizon that will help to rectify that. If you trust Google or Apple with your phone then I'm fine with that, it's your phone, your life. But I've found that trusting companies to have their incentives aligned with your own or with what's good for the w…

As a startup delivering executables to customers, I decently trust most programs running in the company: Gimp, Libreoffice, Docker, IntelliJ… There are only 4 major things that download unchecked stuff and run them:

- IntelliJ plugins,

- Maven,

- NPM,

- GitHub Actions.

Jetbrains says it carefully reviews the source code of all versions of all plugins, and Maven has a somewhat decent dependency tree that you can restrict to major actors (Spring-Apache-Google).

Maybe the key to trust would be to have larger pieces of code (such as Spring) with quite a lot of process to check-in code, rather than a thousand NPM packages. The parcellization of OSS didn’t do good for trust.

Re: North Korean campaign targeting security researchers

#299

Post by edgyquant »

saagarjha wrote: post #290
g___ wrote: post #285

Earlier quoted context omitted.

"In addition to targeting researchers with 0-day exploits, the threat actors also developed a standalone Windows tool that has the stated goal of 'download debugging symbols from Microsoft, Google, Mozilla and Citrix symbol servers for reverse engineers.' The attackers used a 0-day but getsymbol is not one.

Yep, that’s what I said.

No it isn’t what you said at all. You said Google was calling malware a zero day and you believe them, but they aren’t doing this.

Re: North Korean campaign targeting security researchers

#300

Post by saagarjha »

edgyquant wrote: post #299
saagarjha wrote: post #290

Earlier quoted context omitted.

Yep, that’s what I said.

No it isn’t what you said at all. You said Google was calling malware a zero day and you believe them, but they aren’t doing this.

This is what I said:

> The 0-day is in a popular software package.

(I have no idea what this is.)

> The GitHub repo apparently contains a backdoor ability to execute code from the attacker.

(This is what Google says and I think it’s the autoupdater.)

Is this different than what you feel?

Post reply on HN