News for hackers. Stuff that matters.
Re:Active North Korean campaign targeting security researchers by AndrewKemendo on Thursday September 07, 2023 @12:50PM (#37421831)
Lifetimes ago as an intelligence officer I spent years tracking DPRK activities and developments.

People shouldn’t underestimate their technical capacities or ability to recruit smart hard working people.

Re:Active North Korean campaign targeting security researchers by jstarfish on Thursday September 07, 2023 @01:11PM (#37422177)
> People shouldn’t underestimate their technical capacities or ability to recruit smart hard working people.

People hear about third-world living conditions and deprivation and say "aww, cute" as though it's sticks and rocks they're launching into the sea of Japan. They have money...it's all poured into the military.

I don't understand why the media downplays them so heavily.

Re:Active North Korean campaign targeting security researchers by vkou on Thursday September 07, 2023 @01:27PM (#37422447)
> I don't understand why the media downplays them so heavily.

And I don't understand why the media upplays them so heavily, as some kind of peer threat capable of meaningful force projection.

(Well, I do understand it, someone needs to keep pounding the drum to keep this country on a forever-war footing.)

Re:Active North Korean campaign targeting security researchers by insanitybit on Thursday September 07, 2023 @02:59PM (#37423910)
Feels like a weird post to make in the comments section of an article in which NK performed an active attack campaign...
Re:Active North Korean campaign targeting security researchers by vkou on Thursday September 07, 2023 @04:02PM (#37424808)
Not weird when you consider what is, and what is not a proportionate mitigation of a threat.

When someone gets mugged on your street, you can consider taking precautions. If your response is to roll out half a mile of barbed wire, electric fencing, and landmines all through the perimeter of your property, I would say that is absolutely 'upplaying' the actual level of threat.

Most Americans' understanding of the actual threat posed to the US by NK is ludicrously upplayed. NK is a credible offensive threat to SK, but that's a very limited problem for anyone living in Nashville, Tennessee.

Re:Active North Korean campaign targeting security researchers by insanitybit on Thursday September 07, 2023 @04:06PM (#37424860)
I mean, the response here was a blog post, which doesn't feel particularly upplayed. I also virtually never hear about NK from anyone or fear of NK from anyone day to day, nor do I hear about it particularly often from policy makers. No one is campaigning on fear of NK that I have seen.

Perhaps TN is just a radically different world, I'd frankly believe it, but I haven't seen anything too significant at all. The last time people were really concerned about NK for like... 3 days, I think it was ~2012 or so.

Re:Active North Korean campaign targeting security researchers by vkou on Thursday September 07, 2023 @06:27PM (#37426484)
> I mean, the response here was a blog post, which doesn't feel particularly upplayed.

I wasn't criticizing the blog post, I was responding to a comment in this thread that claimed that for some strange reason the danger of NK is systemically underplayed by the media.

I argue that no, the media more typically overplays it, much like it overplays the threat from other non-peer nations. I'm assuming you don't feel like the news is telling you that Iran is a threat either... Which would put you in an informed minority.

Re:Active North Korean campaign targeting security researchers by jryle70 on Thursday September 07, 2023 @10:33PM (#37428534)
Can you give an example of media overplaying NK?
Re:Active North Korean campaign targeting security researchers by zirgs on Friday September 08, 2023 @06:21PM (#37440062)
NK seems to be getting disproportionate media attention compared to other dirt poor and authoritarian countries.
Re:Active North Korean campaign targeting security researchers by verandaguy on Thursday September 07, 2023 @01:50PM (#37422826)
>I don't understand why the media downplays them so heavily.

Because in the same way as morale can be a force multiplier, an extreme lack of it can be a force divider. Combine that with their (very likely) inability to sustain even a regional war for more than a few weeks, their antiquated equipment, and their largely unsuccessful domestic military developments, and it's not hard to write them off as largely a non-threat, whether or not this is truly the case.

The major downside is that even if they only manage to sustain for a few weeks, that's plenty of time to level Seoul and inflict damage on cities further south should they decide to make a push against the ROK, and this is what shouldn't be downplayed.

Re:Active North Korean campaign targeting security researchers by bennyg on Thursday September 07, 2023 @03:26PM (#37424303)
I’d bet they’re prepared to do a ton of damage to South Korea via cyberarms more than traditional weaponry too. Eg cut power to the country for days on end. They’ve clearly got 0days and aren’t afraid to use them.
Re:Active North Korean campaign targeting security researchers by hollerith on Thursday September 07, 2023 @03:58PM (#37424744)
If 'cyberarms' are as potent as you think they are, then how come Russian cyberarms haven't done much damage to Ukraine?
Re:Active North Korean campaign targeting security researchers by NegativeK on Thursday September 07, 2023 @04:34PM (#37425179)
Since 2014, nations with a strong vested interest in Ukraine not falling threw a lot of resources at strengthening the country's infosec.

Also, during a kinetic conflict where you're invading, it's often more strategically valuable to lie dormant in their networks than it is to scorch them, a la America sitting inside of Iraq's phone networks and just listening.

There's a lot of work being done now to change it [1], but I've heard from multiple cybersecurity grunts in critical infrastructure that they just assume foreign APTs are in their networks. Strategically, why in the world wouldn't they be? There's basically no downside other than burning TTPs. We should damn well expect the NSA to have their fingers in every foreign pot they can reach.

[1] To be fair, there was a lot of work before too. But now people are more scared.

Re:Active North Korean campaign targeting security researchers by hollerith on Thursday September 07, 2023 @03:56PM (#37424715)
So, you believe their nuclear weapons don't work?
Re:Active North Korean campaign targeting security researchers by jncfhnb on Thursday September 07, 2023 @08:26PM (#37427643)
Probably not, with insufficient confidence to assume that is the case
Re:Active North Korean campaign targeting security researchers by waffleiron on Friday September 08, 2023 @09:30AM (#37433245)
That's a strange assumption when many countries were able to independently verify nuclear tests between 2009 and 2017. The largest of which had a bast yield 4 to 12 times the nuke dropped on Nagasaki.
Re:Active North Korean campaign targeting security researchers by jncfhnb on Friday September 08, 2023 @09:54AM (#37433526)
These tests happened. Most experts suspect that their success rates were far below claimed outcomes. But the important question is can you put the bomb on a weapon, launch it, and detonate it at the target. I think probably not very successfully. I also suspect they’re not stockpiling these things as claimed.

I also don’t think it matters because they would be pretty dumb to use them. I’m of the mindset that they will most likely simply collapse at some point and the nukes will become unmaintained and useless.

Re:Active North Korean campaign targeting security researchers by avar on Thursday September 07, 2023 @01:58PM (#37422954)

    > third-world living conditions [...]
I know that the phrase has gained an orthogonal meaning since the cold war, but if we use the original one it's funny to call what's arguably the only remaining second-world country "third-world".
Re:Active North Korean campaign targeting security researchers by snovymgodym on Thursday September 07, 2023 @02:15PM (#37423245)
I mean if we're going by the original definitions, I think Laos, Vietnam, and Cuba are also still second-world though none of them are bizarrely neo-Stalinist the way North Korea is.
Re:Active North Korean campaign targeting security researchers by rightbyte on Thursday September 07, 2023 @03:27PM (#37424327)
Are they really Stalinists? I would have guess Maoists, but then again, I wouldn't know the difference.
Re:Active North Korean campaign targeting security researchers by fein on Thursday September 07, 2023 @05:00PM (#37425510)
North Korea is Juche.
Re:Active North Korean campaign targeting security researchers by BetaDeltaAlpha on Thursday September 07, 2023 @05:00PM (#37425511)
North Korea was generally more aligned with the USSR than the PRC. Kim Il Sung and Mao were on the way up at the same time, and were both students of Lenin and Stalin.
Re:Active North Korean campaign targeting security researchers by _jal on Thursday September 07, 2023 @02:58PM (#37423902)
> I don't understand why the media downplays them so heavily.

There are a few reasons that interlock.

- The DPRK government is a mob family with sovereign status and nukes. Most folks in western countries don't have a strong sense of what that means - looking through the lens of mostly free nations, it is hard to imagine the realities on the ground, and they fill in the blanks with what they know about bureaucratic states.

- Lots of western folks, but USians in particular, are extremely ignorant and incurious about Asia and asian cultures. This amplifies the above problems and tends to lead to ridiculous ideas being believable.

- DPRK's propaganda encourages some of this. Their interests are served when people in the west are thinking about their nukes and ignoring the hacking that pays for them. A side order of "we're so mean and crazy we starve our people" helps stoke the mad-man authoritarian archetype.

Re:Active North Korean campaign targeting security researchers by omoikane on Thursday September 07, 2023 @04:36PM (#37425203)
> why the media downplays them

Perhaps you meant the media for some specific country, but news media in Japan do seem to take North Korea quite seriously, and missile launches frequently ends up being the first headline on NHK world news.

Re:Active North Korean campaign targeting security researchers by jncfhnb on Thursday September 07, 2023 @08:32PM (#37427697)
They absolutely do not “have” money in a meaningful sense. They are very poor and the past few years have been much harder than decades past.
Re:Active North Korean campaign targeting security researchers by throwaway290 on Friday September 08, 2023 @12:04PM (#37435418)
> They have money

And much more of it after crypto gained popularity. Darknet Diaries went through investigating some of their hacks. Amounts from one can be more than entire GDP of a small country. Some crypto is washed through Macanese etc banks but most is just used to pay for weapons and stuff directly.

Re:Active North Korean campaign targeting security researchers by micromacrofoot on Thursday September 07, 2023 @01:41PM (#37422674)
Put a gun to someone's head and you'll find that they're capable of just about anything.
Re:Active North Korean campaign targeting security researchers by saiya-jin on Thursday September 07, 2023 @01:52PM (#37422849)
Even better, do it to their children, and literally everybody else who is important in their lives.
Re:Active North Korean campaign targeting security researchers by rm_-rf_slash on Thursday September 07, 2023 @01:55PM (#37422900)
Probably more carrot than stick. NK hackers who can bring in millions to the state from crypto hacking, ransom etc likely live more comfortably than manual laborers.
Re:Active North Korean campaign targeting security researchers by spencerflem on Thursday September 07, 2023 @02:09PM (#37423140)
Yeah, just look at what engineers here in the States are willing to do for money they don't really need
Re:Active North Korean campaign targeting security researchers by micromacrofoot on Thursday September 07, 2023 @02:16PM (#37423251)
Both really. In NK the stick awaits all who stop chasing the carrot.
Re:Active North Korean campaign targeting security researchers by Georgelemental on Thursday September 07, 2023 @03:31PM (#37424371)
Probably way less comfortably than if they could move to a civilized country though.
Re:Active North Korean campaign targeting security researchers by dralley on Thursday September 07, 2023 @03:49PM (#37424625)
But they can't, so it's a moot point.
Re:Active North Korean campaign targeting security researchers by jltsiren on Thursday September 07, 2023 @03:01PM (#37423936)
Put a gun to someone's head, and they suddenly become less capable. A small amount of stress is good for productivity, but excessive stress destroys cognitive abilities.
Re:Active North Korean campaign targeting security researchers by BearhatBeer on Thursday September 07, 2023 @02:02PM (#37423033)
Tell the State Department to fix the propaganda we Americans are fed about the DPRK. It’s impossible for any American to believe they’re a threat, propaganda says they’re a clown country that’s starving which presents zero nuclear threat because of fizzles, and no conventional threat because, again, they’re all starving.

It’s the pap we’re fed upon and everybody WILL underestimate them because of it.

Re:Active North Korean campaign targeting security researchers by Barrin92 on Thursday September 07, 2023 @02:27PM (#37423425)
those things aren't mutually exclusive. North Korea is a malnourished country, evidenced by the pretty stark fact that South Koreans are now so much taller that South Korean women are approaching the height of North Korean men.

It's just that if you pump a quarter of your entire GDP into nukes and hackers you can still be decent at it even if your people are starving.

Re:Active North Korean campaign targeting security researchers by BearhatBeer on Thursday September 07, 2023 @02:36PM (#37423551)
Are they starving though? It's a question that seems impossible for anybody to verify independently. I'm not saying they aren't, but it's impossible to know that they are for sure, too. And we're not to worry about their nukes either, after all according to the official sources they've all merely fizzled.

I'm just not going to worry about North Korea either way. If they want to own suckers running Windows, well, I'm not impressed by that either. People do it all the time.

Re:Active North Korean campaign targeting security researchers by surge on Thursday September 07, 2023 @02:57PM (#37423884)
Video evidence snuck out of the country frequently shows obviously malnourished people, even military soldiers, who are supposed to get special privileges and access to food look pale and show obvious signs of malnourishment. That said, they're a model for carbon footprint reduction.
Re:Active North Korean campaign targeting security researchers by rurp on Thursday September 07, 2023 @03:00PM (#37423922)
It's not that hard to verify given the people who have risked their life to escape the country and spoken openly about the conditions there.
Re:Active North Korean campaign targeting security researchers by mach5 on Thursday September 07, 2023 @02:37PM (#37423578)
maybe the US should end the korean war so the DPRK no longer has to defend as hard, would be a good start
Re:Active North Korean campaign targeting security researchers by dragonwriter on Thursday September 07, 2023 @02:43PM (#37423640)
> maybe the US should end the korean war

Takes two, not just the UN side, to end the war.

Re:Active North Korean campaign targeting security researchers by dralley on Thursday September 07, 2023 @02:46PM (#37423691)
You can't be serious.
Re:Active North Korean campaign targeting security researchers by surge on Thursday September 07, 2023 @02:51PM (#37423775)
"Ending the war" requires handing South Korea over to DPRK based on their conditions and they still claim their government has rightful jurisdiction over it.

I mean the war is effectively over. It's been a cold war since the "cease fire" has been adhered to. It's not like they're going to stop trying if we agreed to take down the DMZ. Their entire culture is based around reunification and defeating the evil Americans.

Re:Active North Korean campaign targeting security researchers by yongjik on Thursday September 07, 2023 @03:01PM (#37423935)
You could equally say ending the war means handing NK over to SK because that's what South Korea's constitution says.

Less flippantly, "ending the war" means reaching a mutual agreement that preserves the two Korea's current territories: nobody sane is using the term to mean anything else.

(BTW, South Korea did push for officially ending the war multiple times, IIRC. It's just that North Korea remains uninterested. Same for the US - probably because they don't see the deal happening realistically.)

Re:Active North Korean campaign targeting security researchers by surge on Thursday September 07, 2023 @03:16PM (#37424150)
Right, which is why I said its effectively what we have now (a situation that preserves their current territories), AFAIK, the situation barely effect SK life. It's just neither side believes the minute they stop pointing weapons at each other's borders the other side won't take advantage, and as far as I know, prior attempts to sit down and end the war officially require the other side basically give a full surrender. There's also a Chinese interest in keeping DPRK (it was Chinese MiGs American fighter pilots engaged in the actual war and I assume currently supplies DPRK with arms in a similar role to the US and SK) as a buffer zone, and a source of cheap labor and source for human trafficking in some cases. So both countries have a larger country/acting ally disrupting the politics.
Re:Active North Korean campaign targeting security researchers by simpleuser27 on Thursday September 07, 2023 @02:51PM (#37423779)
This is such a strange take it borders on satire.

Could you elaborate on if you genuinely think this would resolve the issues the DPRK experiences?

Re:Active North Korean campaign targeting security researchers by nanidin on Thursday September 07, 2023 @02:55PM (#37423843)
This would cause immediate conflict with China. Imagine China showing up to liberate Mexico from the drug cartels.
Re:Active North Korean campaign targeting security researchers by gardenhedge on Thursday September 07, 2023 @04:05PM (#37424846)
How does anyone know the average heights in NK?
Re:Active North Korean campaign targeting security researchers by rurp on Thursday September 07, 2023 @02:54PM (#37423833)
I can't speak for the general public but my own impression of the country is that its nuclear weapons and isolation make it incredibly dangerous, and the problem is only getting worse as their arsenal increases.

Plus they have pulled off a number of hacks that became mainstream news so I would expect plenty of people to think that North Korea has competent software developers.

Re:Active North Korean campaign targeting security researchers by CamperBob2 on Thursday September 07, 2023 @03:14PM (#37424121)
What really makes me nervous about the DPRK is just how successful they have been at getting the rest of the world to prop them up. Successful models get imitated.

Intuitively, we'd expect Kim to envy Putin, but at some point it occurred to me that the opposite notion seems to be better at explaining the behavior we've seen lately from Russia. If Putin's agenda were to turn Russia into a nuclear-armed failed state that the rest of the world has no choice but to prop up with aid in perpetuity, it's hard to see what he would be doing differently.

Re:Active North Korean campaign targeting security researchers by kevmo on Thursday September 07, 2023 @03:06PM (#37424011)
A few years ago during the 2016 Democratic primaries, Bernie Sanders was roundly mocked by mainstream media for saying NK was a top threat due to their disengagement from the international processes.

https://www.youtube.com/watch?v=8M4CoEodUTI

Re:Active North Korean campaign targeting security researchers by dang on Thursday September 07, 2023 @03:11PM (#37424069)
We detached this subthread from https://news.ycombinator.com/item?id=37421831.
Re:Active North Korean campaign targeting security researchers by phatfish on Thursday September 07, 2023 @03:29PM (#37424354)
So what IS the threat from North Korea to Americans or anyone not sharing a border with them exactly? They won't launch nukes at anything outside their own borders unless Kim wants his country turned into a smoldering crater. The only real threat anyone should worry about is cyber attacks, which could be an issue if targeted at infrastructure, but not something i stay awake at night worrying about.

I find it interesting that 2 years ago people like you would be moaning about how COVID-19 is being used to "scare" people, and we should ignore US "propaganda" about death rates in the US and worldwide. But now apparently North Korea IS a threat and we should all be scared of Kim starting a nuclear war.

The last couple of years drove a lot of people to conspiracy theory channels, and it's affects are starting to show.

Re:Active North Korean campaign targeting security researchers by snthd on Thursday September 07, 2023 @02:40PM (#37423608)
>ability to recruit smart hard working people

including non-nationals?

Re:Active North Korean campaign targeting security researchers by chronogram on Thursday September 07, 2023 @05:23PM (#37425795)
Of course. There are a lot more capable fish in the pond than the ones with the connections to a Western company, plus the capable fish in a Western pond but nobody talking to them because the onus is on the fish. You probably know people who are better programmers than people you work with who don't earn as much as people more socially savvy or placed, and who might want to also pay off a mortgage after 30 years.
Re:Active North Korean campaign targeting security researchers by nonrandomstring on Thursday September 07, 2023 @03:05PM (#37423993)
> technical capacities or ability to recruit smart hard working people

Of course, there are different senses of "recruitment". The best recruits don't know they even have been..

The take-away here is that it's 99% social engineering and 1% a script-kiddy payload drop. Their SE play is based on our innate ability to be recruited, because we want to be. Because we spend our school and college days being conditioned to want to be valued, to feel needed, to look for validation and reward, to make beneficial connections and sell ourselves. Self commodification/reification is the beating heart of capitalism.

They're smart to use that against us, by reaching out to security researchers, who (from personal experience) often feel isolated and/or undervalued.

After all it's just "international collaboration" , right?

Without due diligence in checking out new contacts (especially if they contact you to discuss things that they know interest you and then stroke the ego of your specialism) recruitment is easy.

In the end you can't easily know whether that charismatic voice on the phone is really from your government, from Google, from a fellow researcher who wants to "share and collaborate"... and you probably wouldn't know what would constitute a credible proof of identity.

Intelligence agencies could do well to spend a little money on benevolently watching out for commercial, civic, academic or hobbyist researchers who are valuable targets and sending a polite heads-up when the packets start arriving from N Korea.