9 ms·
Update on campaign targeting security researchers
- mensetmanusman 6y agoIndividuals can’t compete against nation state level actors. There are US private citizens who are monitored/tracked due to the known national security risk if they are captured to work for other nations. Cybersecurity is huge.
- secfirstmd 6y agoSource?
- meibo 6y agoI wonder what an Internet Explorer 0-day does for these people? Maybe that's all they had? Is it supposed to be a "sign" to us that they are capable of developing exploits? Surely no security researcher would open a link in IE as their "burner browser"?
- koolba 6y agoIsn’t the latest IE just a thin veneer atop Chrome anyway?
- thephyber 6y agoInternet Explorer is an older browser. Edge is the Microsoft browser whose newer versions are based on Chromium.
- gundmc 6y agoEdge is Microsoft's new browser that is based on Chromium. It is distinct from Internet Explorer which is effectively deprecated but still used somewhat widely as many legacy enterprise applications still require it.
- wlesieutre 6y agoThe recent versions of Edge are based on Chromium, but originally it used Spartan (which was the successor to IE’s Trident)
- tape_measure 6y agoIt's basically required in South Korea for online shopping. The link to the IE 0 day is written in Korean. More on IE in South Korea: https://www.nationthailand.com/Startup_and_IT/30321025 https://www.nationthailand.com/Startup_and_IT/30321025
- meibo 6y agoThis is probably it, thank you for clarifying - I've got a few friends in SK and they always complain about this, should have thought of that!
- tape_measure 6y agoDo you know the latest on IE use? The article I posted is from 2017 and promises modernization. I submitted the article here, hopefully we get an on-the-ground update. https://news.ycombinator.com/item?id=26656052 https://news.ycombinator.com/item?id=26656052
- easton 6y agoLooks like it was abolished last year: https://10mag.com/the-end-is-finally-near-for-koreas-infamous-digital-id-certificate/ https://10mag.com/the-end-is-finally-near-for-koreas-infamou...
- thephyber 6y agoI remember IE was required for the South Korean government issued digital certificate (required for all internet-based retail transactions and likely others). I guess I had assumed that the standard was compatible with newer versions of Windows or MS browsers. Really sad if it isn’t.
- freeone3000 6y agoIt's ActiveX-based, which essentially runs nowhere but IE. Edge's support for ActiveX is running it in an IE tab.
- thephyber 6y agoMy understanding (not sure how accurate or up-to-date) is that Windows still opens some file formats using Internet Explorer (possibly depending on other OS/domain settings). The Windows Help File (.chm) or something similar comes to mind. Also worth pointing out that security researchers targeting specific platforms/applications (say a specific version of older Windows where one particular organization has applications which require a specific version of IE) might be a valuable stack for the researcher to spend time on. That said, those stacks/environments should be treated like a meth lab: you want to be very careful what you do with it and it shouldn’t be commingled with where you live and play.
- nostromo 6y agoThere are so many fake LinkedIn accounts out there -- this is a very common attack. People should be careful about who they connect with and what information they share.
- raister 6y agoI don't know if it is relevant, but I receive daily requests on ResearchGate from people with lots of 'following' and zero 'followers', no picture, no papers, no questions, i.e. empty profile. The names are quite 'inventive' such as Alex Brooks, Julie Sanders, Mark Wellington, some chinese-like names posing as students, and so on.
- zelon88 6y agoHow does Google differentiate a malicious offensive security operation from a benign one? Previous websites and social media accounts posted malicious content, but this Google blog post doesn't really do much to connect the between the previous accounts and the new ones.
- someperson 6y agoCompromising the computers of security researchers who find zero day vulnerabilities and develop proof-of-concept exploits. You got to admit that's a pretty clever strategy: cast a wide net and convert your older already patched exploit into a zero day.
- joe_the_user 6y agoAt this point, one should assume that "attack the supplier" is a known, standard strategy for any person or organization that supplies software or expertise to a larger or target organizations.
- godelski 6y agoThis seems to get fuzzy when you consider there are many graduate students doing research who aren't going to have the same funds and likely not be as rigorous.
- gruez 6y ago>You got to admit that's a pretty clever strategy: cast a wide net and convert your older already patched exploit into a zero day. you'd think security researchers would know the importance of keeping their system patched...
- deleted 6y ago[deleted]
- kadoban 6y agoKnowing the importance and actually practicing what you preach aren't always the same thing.
- __jf__ 6y agoThere was also an interesting virtual round table discussion about this subject in january. Recording here: https://www.youtube.com/watch?v=IOFcJ0-nG10 https://www.youtube.com/watch?v=IOFcJ0-nG10
- walrus01 6y agosounds like some people have executed a textbook 'watering hole' attack.
- jokoon 6y agoThat's a good reason to not work in computer security in my opinion. I equate security devs to arms dealers. It sounds like a cool job, but it seems like it's not.
- giantandroids 6y agoYou could easily argue they are doing the opposite, in that they close down potential weapons and responsibly disclose them so that they are fixed and patched. Add to that, a majority of computer security work is revolved around improving infosec. A further point, I doubt infosec researchers are the types that run a deprecated microsoft web browser.
- PurpleFoxy 6y agoThe main argument I have heard is it’s less finding exploits and doing real security and more mind numbing auditing and checking boxes not to prevent attacks but to cover your ass when they happen.
- meowface 6y agoOnly a subset of security professionals are researchers, and only a subset of those are vulnerability researchers / exploit developers, and only a subset of those have arms dealer-like roles where they hoard and/or sell and/or privately deploy zero-days they discover. I think it's totally fair to critique the arms dealers (and that's indeed undeniably exactly what they are), but only a small percentage fall into that bucket.
- croh 6y agoSecurity researchers should read 'Stealing the network: Complete series'. Book has covered very practical crazy hacking scenarios. In one story, hacker keeps monitoring researchers' system for the latest zero day. In another interesting story, hacker targets dev server instead prod assuming security is less tightened there.
- sneak 6y ago> At this time, we have not observed the new attacker website serve malicious content, but we have added it to Google Safebrowsing as a precaution. Translation: we here at Google can censor any site we want, at any time, in all major browsers, without any shred of due process or even a requirement for our internal processes that it be hosting malware. It's entirely arbitrary who we kick off of the web. Don't cross us, and don't cross the government who we cozy up to.
- Jonnax 6y agoAre you a malware author that has been victimised by the Safebrowsing list or know of a legitimate site that has been affected? Or have you made up a hypothetical and decided to get angry about that?
- dividuum 6y agoNot op, but just recently: https://news.ycombinator.com/item?id=25802366 https://news.ycombinator.com/item?id=25802366
- jart 6y agoSafeBrowsing blocked redbean downloads for a day (https://justine.lol/redbean/index.html https://justine.lol/redbean/index.html) and it was the #3 top Show HN story of all time. Google put a real chill down my spine when they did that to me, not being able to download files from my own website.
- meibo 6y agoIn my experience, this has become increasingly common when distributing software that isn't signed. I don't sign my software due to privacy concerns, and it regularly gets bogus detections on VirusTotal and Google's similar systems that flow into Safe Browsing. Mostly from Norton and BitDefender, who are notorious for not replying to any inquiries/submissions. AV is a complete ripoff nowadays and downright malware (coming from someone that had to cancel an accidental Norton subscription for his usually technically sufficient parents, it's a maze of broken support pages and infinite redirects between different language versions).
- hoppla 6y agoSebastian Lazarescue, Security Researcher @ SecuriElite - Last name sounds like he is affiliated with Lazarus?
- darawk 6y agoI think a lot of these names are designed to be confused with real security firms, e.g. "Trend Macro".
- Loic 6y agoNorth Korean government-backed entity: This reminds me that one of the approach of the "western" agencies was to hide themselves as coming from North Korea to run their operations. I would just write it as: "an entity" is trying to target security researchers. But it has less marketing power.
- shermheadryder 6y agoI’m not saying you’re wrong, but do you have a source on that? That feels like a bold claim to make without any references.
- Craighead 6y agoFeels, and reads, like obfuscation and redirection. HN is part of the battlefield.
- gorhill 6y ago> That feels like a bold claim to make without any references "Marble Framework"[1], Wikileaks' Vault 7: > Marble is used to hamper forensic investigators and anti-virus companies from attributing viruses, trojans and hacking attacks to the CIA. [...] The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion * * * [1] https://wikileaks.org/vault7/#Marble%20Framework https://wikileaks.org/vault7/#Marble%20Framework
- gruez 6y agoThat's the description, but looking over the technical documents doesn't really correspond to what is claimed. From my reading it looks like it a tool that replaces some of the strings at runtime? Why is this even needed? Wouldn't it be more straightforward to not use natural language strings at all, or swap it out at the preprocessor level?