Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the “Kim” dump exposed North Korea's credential theft playbook

dti.domaintools.com

Post reply on HN
Print view View original

51–60 of 196 posts

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#51

Post by fragmede »

awesome_dude wrote: post #49
aussieguy1234 wrote: post #21

That's a fairly detailed analysis of an APT workflow. Now, non-APT actors, if they wanted to up their level of sophistication, might replicate some of these workflows for their own nefarious activities.

There's always a risk of openness creating copycats, but there's also the fact that informed decisions can now be made by people who need to mitigate against these malicious actors. There's no way to only give the information to one group without the other group getting their hands on it.

There's levels between not sharing it with anybody, and dumping it up on the public web for everyone to see. There are private disclosure lists they could have used, if they wanted to.

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#52

Post by [deleted] »

sgnelson wrote: post #6

This is interesting due to the tying of DPRK and PRC. It seems hard to say how much coordination there is between the two, but whatever it is, it appears to be greater than zero. While not necessarily surprising, I wonder if this public attribution will make it harder for the PRC to deny involvement with both the DPRK's efforts and their own.

[deleted]

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#53

Post by chasd00 »

wrp wrote: post #37
sgnelson wrote: post #6

This is interesting due to the tying of DPRK and PRC. It seems hard to say how much coordination there is between the two, but whatever it is, it appears to be greater than zero. While not necessarily surprising, I wonder if this public attribution will make it harder for the PRC to deny involvement with both the DPRK's efforts and their own.

Regardless of how unhappy Beijing may be with things Pyongyang does, North Korea is of such obvious strategic importance to China that they are unlikely to ever waver in their support of the regime or even try to hide it.

Anything happens to North Korea and all those starving people flood into China. I think that’s why China supports North Korea.

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#54

Post by to11mtm »

dwattttt wrote: post #34
to11mtm wrote: post #20

Earlier quoted context omitted.

Not really, so long as you don't use it for anything 'bad'. i.e. if you're just running against your local network, who's gonna report it?

Surely then it's the 'use', not the 'possession' that's a criminal offence? Or is it still a criminal offence to possess it, but you're fine as long as no one finds out? Because that doesn't stop it being a criminal offence.

My basic understanding is that a 'dual use' tool is moreso based on intent; using the same analogy as when this came up on HN over a decade ago [0], a good kitchen knife can be at least as dangerous as a lot of explicitly 'banned' knives but because it has a non-illegal use it doesn't fall into the same category as, say, a DDOS tool. And AFAIK there hasn't (yet) been a case where NMAP has gotten someone in Germany in trouble with the law for possessing or using within their local subnet.

[0] - https://news.ycombinator.com/item?id=3797151

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#55

Post by overfeed »

awesome_dude wrote: post #48
tremon wrote: post #3

> The dump also revealed reliance on GitHub repositories known for offensive tooling. TitanLdr, minbeacon, Blacklotus, and CobaltStrike-Auto-Keystore were all cloned or referenced in command logs. What's the rationale for allowing the development of offensive tooling on github? Is this a free-speech thing, or are these repositories relevant for scientific research in some way?

Isn't Github supposed to be blocking sanctioned countries, like Iran, and North Korea? https://docs.github.com/en/site-policy/other-site-policies/g...

Do you have any reason to suspect GitHub isn't blocking those countries? How long do you think an offensive-security sponsor/passport-issuing nation might take to get around GitHub IP-blocks?

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#56

Post by varenc »

randall wrote: post #42
freedomben wrote: post #17

Earlier quoted context omitted.

Agreed. Plus it's not always a clear line between offensive and legitimate usage. For many years nmap was banned on most corporate networks, but it's an invaluable tool for legitimate use too, despite being useful for offensive cases as well

one time i ran nmap against my dev box at facebook. i was definitely worried someone was going to give me a stern talking to.

I ran 'neoprint.php' on myself at Facebook in 2007 and immediately got a stern email about it... It was some script that collected info for responding to law enforcement requests. But after chastising me, the email said "I was gratified that you ran it on yourself". (as opposed to snooping on someone else!)

It was just a summer internship and FB was like 'only' 80 engineers back then. But they still took it seriously.

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#57

Post by dmoy »

overfeed wrote: post #55
awesome_dude wrote: post #48

Earlier quoted context omitted.

Isn't Github supposed to be blocking sanctioned countries, like Iran, and North Korea? https://docs.github.com/en/site-policy/other-site-policies/g...

Do you have any reason to suspect GitHub isn't blocking those countries? How long do you think an offensive-security sponsor/passport-issuing nation might take to get around GitHub IP-blocks?

Right exactly. The only way IP blocks work is if there's no vulnerable machines to take over anywhere. That is - it basically doesn't work for any motivated attacker.

You could hypothetically make it work, but it would mean an extremely different Internet and device landscape than exists today. (And even then I doubt it stops a nation-state level attacker, they can always use old fashioned espionage to get someone in meat space and get around any technical barrier)

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#58

Post by hsbauauvhabzb »

freedomben wrote: post #17
StrauXX wrote: post #4

Earlier quoted context omitted.

They are heavily used in penetrationtests and red teaming engagements. Banning such tools from the public just mystifies attackers ways to defenders, while not in any way hindering serious malicious actors. We had that discussion back in the 90s and early 2000s.

Agreed. Plus it's not always a clear line between offensive and legitimate usage. For many years nmap was banned on most corporate networks, but it's an invaluable tool for legitimate use too, despite being useful for offensive cases as well

While that may be true, it’s less true for things like cobalt strike. I’m not saying that banning tooling would be a good thing, but it’s a bad argument to compare Nmap to remote access tools.

Re: How the “Kim” dump exposed North Korea's credential theft playbook

#59

Post by SoftTalker »

randall wrote: post #42
freedomben wrote: post #17

Earlier quoted context omitted.

Agreed. Plus it's not always a clear line between offensive and legitimate usage. For many years nmap was banned on most corporate networks, but it's an invaluable tool for legitimate use too, despite being useful for offensive cases as well

one time i ran nmap against my dev box at facebook. i was definitely worried someone was going to give me a stern talking to.

I use nmap routinely at work to see what’s on a subnet, has anything new appeared, or where it should not be.
Post reply on HN