On the financial attacks URL list, what is teenbeanjs trying to emulate? It doesn't seem to fit with the rest that all sound vaguely technical or financial, except that it contains "js."
Countering threats from North Korea
81–90 of 172 posts
Re: Countering threats from North Korea
#82Earlier quoted context omitted.
I'm actually surprised Google would say this is from the DPRK government without also saying it had has been verified by US federal government authorities. Usually they leave it for others to deal with statements at that level.
I think you’ll find TAG regularly gives assessment on attribution at least at the country level. Iran, China, Russia, Belarus and North Korea at least have been named in the last few years. (Disclaimer: I am head of TAG)
How do you know what country is actually behind any of this? I’d imagine that would be very difficult given nation states can host content anywhere in the world and will want to make it look like it’s coming from elsewhere.
Re: Countering threats from North Korea
#83Re: Countering threats from North Korea
#84Re: Countering threats from North Korea
#85Earlier quoted context omitted.
Web assembly is extra code and complexity in a web browser compared to one without, so there are more potential vulnerabilities
I don't buy it because you can apply same reasoning to every new / changed line of code, yet it ain't always true The question is, is WASM's security model / sandbox "safer" / "easier to actually execute" than JS'?
WASM _IS_ JS. Some browsers do things to make it run faster. JS runs in its own security sandbox and is already suppose to be safe. Browsers get exploited in all kinds of ways, and IIRC, there have been WASM-specific exploits as well in the past.
Your question is non-sensical as is. I think you need to expand it to have people be less confused as to what you’re asking.
Re: Countering threats from North Korea
#86Re: Countering threats from North Korea
#87No post body was provided.
Re: Countering threats from North Korea
#88What evidence do they have that suggests these threats are coming from North Korea?
> These groups' activity has been publicly tracked as Operation Dream Job and Operation AppleJeus. Following those links yield these two documents, which both have "Attribution" sections. Presumably some of these tell-tale signs were identified in the ongoing exploitation. https://www.clearskysec.com/wp-content/uploads/2020/08/Dream... https://securelist.com/operation-applejeus/87553/#attributio...
I'm very curious how we can attribute a threat to a particular nation state, given pretty much anything in code/IP/modus operandi/etc. can be faked by one party to look like another. I went through both links and all I found was a lot of hand-wavings like
> One of the top identifiers of Lazarus is their dual attack mission – money theft and espionage. This modus operandi is unique to North Korea, as other state actors usually focus on espionage only. North Korean money theft operations are carried out in service of the government, as a way of funding the nuclear program
Like, seriously? "You not only do espionage but also steal money, therefore you're NK"?
Re: Countering threats from North Korea
#89No post body was provided.
Re: Countering threats from North Korea
#90[dead]