Re:Active North Korean campaign targeting security researchers
by nonrandomstring on Thursday September 07, 2023 @03:05PM
(#37423993)
> technical capacities or ability to recruit smart hard working people
Of course, there are different senses of "recruitment". The best
recruits don't know they even have been..
The take-away here is that it's 99% social engineering and 1% a
script-kiddy payload drop. Their SE play is based on our innate
ability to be recruited, because we want to be. Because we spend our
school and college days being conditioned to want to be valued, to
feel needed, to look for validation and reward, to make beneficial
connections and sell ourselves. Self commodification/reification is
the beating heart of capitalism.
They're smart to use that against us, by reaching out to security
researchers, who (from personal experience) often feel isolated and/or
undervalued.
After all it's just "international collaboration" , right?
Without due diligence in checking out new contacts (especially if
they contact you to discuss things that they know interest you and
then stroke the ego of your specialism) recruitment is easy.
In the end you can't easily know whether that charismatic voice on the
phone is really from your government, from Google, from a fellow
researcher who wants to "share and collaborate"... and you probably
wouldn't know what would constitute a credible proof of identity.
Intelligence agencies could do well to spend a little money on
benevolently watching out for commercial, civic, academic or hobbyist
researchers who are valuable targets and sending a polite heads-up
when the packets start arriving from N Korea.
Of course, there are different senses of "recruitment". The best recruits don't know they even have been..
The take-away here is that it's 99% social engineering and 1% a script-kiddy payload drop. Their SE play is based on our innate ability to be recruited, because we want to be. Because we spend our school and college days being conditioned to want to be valued, to feel needed, to look for validation and reward, to make beneficial connections and sell ourselves. Self commodification/reification is the beating heart of capitalism.
They're smart to use that against us, by reaching out to security researchers, who (from personal experience) often feel isolated and/or undervalued.
After all it's just "international collaboration" , right?
Without due diligence in checking out new contacts (especially if they contact you to discuss things that they know interest you and then stroke the ego of your specialism) recruitment is easy.
In the end you can't easily know whether that charismatic voice on the phone is really from your government, from Google, from a fellow researcher who wants to "share and collaborate"... and you probably wouldn't know what would constitute a credible proof of identity.
Intelligence agencies could do well to spend a little money on benevolently watching out for commercial, civic, academic or hobbyist researchers who are valuable targets and sending a polite heads-up when the packets start arriving from N Korea.