Active North Korean campaign targeting security researchers

Re:Active North Korean campaign targeting security researchers by wheelerof4te on Thursday September 07, 2023 @04:44PM (#37425309)

Small tool = less code to read through.

If you want to use that suspicious tool, you should at least take a glance at the source code.

[ Parent | on HN ]

Re:Active North Korean campaign targeting security researchers by dewey on Thursday September 07, 2023 @04:58PM (#37425479)

In an ideal world that would be the case, but people barely read the README or documentation.

[ Parent | on HN ]

Re:Active North Korean campaign targeting security researchers by tough on Thursday September 07, 2023 @05:54PM (#37426125)

That's on their own fault, and on the alternative closed source scenario nobody would be able to read the source without reverse engineering it first

[ Parent | on HN ]

Re:Active North Korean campaign targeting security researchers by userbinator on Thursday September 07, 2023 @11:11PM (#37428767)

I did, and on the rare occasion that I need to use a downloaded binary today, still open it in a text editor and scroll through it for a cursory look. Packed -> reject. Bigger than expected -> reject. URLs or other strings, especially obfuscated, not related to expected functionality -> reject. Online AV multiscanners offer a reasonable alternative for those who aren't familiar with this sort of quick-glance RE, although they do have false positives too.

[ Parent | on HN ]

Re:Active North Korean campaign targeting security researchers by account42 on Friday September 08, 2023 @04:17AM (#37430956)

> Online AV multiscanners offer a reasonable alternative

You're right, (not just) online AV multiscanners are also FUD machines that will happily accept malicious programs but reject anything well crafted and optimized because it doesn't like exactly like the shit MSVC craps out with default settings.

[ Parent | on HN ]