28 ms·
So this was deployed in 2014 and we’re just connecting all the dots now? It really makes you wonder what’s being deployed at the moment. The fact that they can
by efnx 5y ago
So this was deployed in 2014 and we’re just connecting all the dots now? It really makes you wonder what’s being deployed at the moment.
The fact that they can determine all this from some binary is amazing. Security researchers really are techno-archaeologists.
- mc32 5y agoI recall how when we had North Korean hacking activities and official attributions people would say, but how do we know it was them and how do we know the government isn’t making things up? But when someone accuses the US we never add any salt. Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting.
- vbezhenar 5y agoOne reason would be the capability. There's no doubt that there are US citizens able to produce complex software including malware. Same could be said about China or Russia. But when it comes to North Korea, I really have doubts about their IT competence. Sure, they probably have some good programmers able to create ordinary IT systems. But working on edge of current technologies - that's what I have my doubts about.
- throwaway210222 5y agoWhy exactly do you think no North Korean can make malware? Hell, I've seen malware from countries in Africa that lack food. These societies have a lot of kurtosis.
- kevin_thibedeau 5y agoTheir biggest trading partner uses them as an attack dog to do the things they don't want to be directly associated with. It isn't unreasonable that it was given to them.
- kube-system 5y agoIf they can get fighter jets, tanks, and missiles from China and Russia, certainly they can get some malware.
- daniel-cussen 5y agoWell, by comparison, Iran is very competent at cyber but they keep getting their uranium centrifuges hacked. North Korea, on the other hand, already didn't get hacked, and built the bomb. They have a lot less money than South Korea, and their political system is...what it is...but I don't see any reason a North Korean can't study just as hard as a South Korean and achieve similar results. I think people confuse North Korea's suffering with weakness. I'll grant that there is a lot of hunger, but the mission from the beginning, of the guerrilla fighters who now run the country, was sovereignty at all costs. And I'd say purely in terms of sovereignty North Korea is doing remarkably well.
- tgragnato 5y agoIranian getting their centrifuges hacked probably has to do more with geography than cyber. Israel is a powerful ally. I would compare South Korea more to a US protected country than to an ally. Given the dynamics with China, the Asian region is "less controllable" than Persia.
- tclancy 5y agoThis may be helpful then: https://www.newyorker.com/magazine/2021/04/26/the-incredible-rise-of-north-koreas-hacking-army https://www.newyorker.com/magazine/2021/04/26/the-incredible...
- pc86 5y agoIt's human nature to give things that fit your preconceived notions and biases the benefit of the doubt over those that don't, even when you're aware of this effect. The best we can do is try to be cognizant of it and be really self-critical about our knee-jerk reactions.
- measuring_tape 5y agoAssuming it was said by someone fin the USA, there's also utility in this framing. Remaining critical of your own government is pretty healthy for a democracy.
- willcipriano 5y agoIf I had to wager I'd always bet on the CIA lying, I don't see how anyone could come to another conclusion given their history.
- Koshkin 5y agoI've come to a conclusion that, from the evolutionary standpoint, lying (and stealing) is one of the most important forms of the intelligent behavior. We see it in the animal world, so this unavoidably should be seen as such in the world of humans...
- andy_ppp 5y agoHumans have the option of trying to be ethical as well and a lot of people would question if the CIA always behaves ethically.
- ectopod 5y agoSurely no-one believes the CIA always behaves ethically. Especially after the post-9/11 kidnap, torture and murder rampage. Perhaps you meant a lot of people question if the CIA ever behaves ethically.
- andy_ppp 5y agoI’m sure the people that work there think they are a thin line against the harm others would like to do to America. “The ends justify the means”.
- mandmandam 5y agoI would hope they're smarter than that, but apparently not many are.
- kungito 5y agoTrying to take the optimal route in prisoners dilemma would make smart animals stop this behaviour
- djbebs 5y agoI mean, given the amount of malware made by the CIA and NSA, is it really a stretch that this is just one more?
- RedComet 5y agoIts probably because the US government is the single greatest force for evil in the world right now.
- dcsommer 5y agoThis kind of hyperbole is neither instructive nor accurate. What is the intended purpose of this comment?
- RedComet 5y agoIt is accurate and not hyperbole. But the point is to help that poster understand why someone would not question the claim.
- seppin 5y ago"I am the greatest cook in the world" is hyperbole, even if you believe it to be true. Please google the basic definitions of words before you use them.
- reedjosh 5y agoI'm sure the intended purpose is to vent frustrations, but maybe also to make aware those who've turned their eye from the US's terrible tyrannical and oppressive nature at home and abroad in favor of tribal political trivialities. It's not an incorrect statement either. I'd put the US up there with China, Russia, Big Tech, and the UN for forces of evil in the world right now.
- kube-system 5y agoWhat does "force of evil" mean anyway? It seems like a subjective measurement based entirely on tribalism as a foundation.
- reedjosh 5y ago> What does "force of evil" mean anyway? Yes, subjective. But here's my belief and how I believe it applies. I believe evil is the abandonment of reason in any way. Instigation of force or coercion is an un-reason-able act no matter whether done by an individual or group of people. Currently the US is engaged in numerous instigative forceful and coercive acts. Further, much of what the US does would not be possible without people abandoning their own reasoning for the fallacy of authority. Here I do not mean appealing to authority, but instead `following orders` without consideration to one's own responsibility to also not instigate force/violence/coercion. We could go down the path listing instigative acts of the US, but I believe most reasonable people know that the US is engaged in a number of these acts and would prefer it wasn't.
- aero-glide2 5y agoYeah, and CNN saying Chinese or Russian hackers always
- cyberlurker 5y agoEven if you think CNN is bad it still might be true.
- deleted 5y ago[deleted]
- jessaustin 5y agoTruly, a level of excellence to which all "news" organizations should aspire. "CNN" is a recursive acronym, modeled after "GNU".
- Banana699 5y agowhat a galaxy brain joke
- wait_a_minute 5y agoBecause the entire goal is to promote skepticism about the USA while remaining as mum as possible on Russia and China. In the case of Russia, it’s not a secret that they try to disrupt and divide the states via internal conflicts so they can take over if we decline because of it. Here is just one example: https://www.wsj.com/articles/russian-backed-facebook-accounts-organized-events-on-all-sides-of-polarizing-issues-1509355801 https://www.wsj.com/articles/russian-backed-facebook-account... We also know that hundreds of thousands of foreign-sponsored accounts on Twitter, Reddit, Facebook, etc, have been banned over the years. (Please fact check by googling!)
- ClumsyPilot 5y agoEh, we are at a apoint where every self respecting political party has thousands of fake twitter accounts.
- Lammy 5y agoMeanwhile all you people stoking nationalist fervor keep the global population of generally-well-meaning humans divided and hating each other instead of uniting into a whole that demands a better life for everyone. Please stop.
- freeflight 5y ago> Here is just one example: Here's an example that in major parts contributed to a civil war going on to this day: The existence of a US military operation that manipulates social media trough sock-puppet accounts [0] was revealed around the same time Syrians were riled up to regime change trough.. social media [1]. Said social media presence kept announcing "Days of Rage" protests in Syria which initially no Syrian even showed up to. These operations predate anything noteworthy Russia did on the same front, as most of that only started in the wake of the Ukraine revolution, which also saw plenty of blatant US interference [2]. Back then Russia was diplomatically very vocal about how unprecedented the foreign interference in Ukraine was. What followed was St. Petersburg troll farms heavily targeting the US. > We also know that hundreds of thousands of foreign-sponsored accounts on Twitter, Reddit, Facebook, etc, have been banned over the years. (Please fact check by googling!) How many domestic sponsored accounts have been banned? Zero, which means that on US based social media these kind of outfits are fighting with a heavy home game advantage [3], yet in most of these places that never comes up, it's always "Look out for the Russian/Chinese propagandist!", just like you are doing here. Which usually ends up targeting skeptical people not wholeheartedly endorsing the "Good vs Evil" narrative and not any actual propagandists. [0] http://www.theguardian.com/technology/2011/mar/17/us-spy-operation-social-networks http://www.theguardian.com/technology/2011/mar/17/us-spy-ope... [1] https://www.france24.com/en/20110203-syria-democracy-protests-facebook-twitter-friday-prayers-egypt https://www.france24.com/en/20110203-syria-democracy-protest... [2] https://www.theguardian.com/world/2013/dec/15/john-mccain-ukraine-protests-support-just-cause https://www.theguardian.com/world/2013/dec/15/john-mccain-uk... [3] https://www.reddit.com/r/Blackout2015/comments/4ylml3/reddit_has_removed_their_blog_post_identifying/ https://www.reddit.com/r/Blackout2015/comments/4ylml3/reddit...
- tck42 5y agoThe Broadcom link in the posted tweet records [some of?] their reasoning. Things like very North America specific strings, activity happening M-F for certain things (compilation, etc), capability (access to zero days implying deep pockets to buy said zero days), and breadth of target, etc. That said - it ABSOLUTELY BOGGLES MY MIND that, if these are not leaked, but rather recovered from attempted attacks, how are _any_ valid timestamps and strings not randomized as part of the build process!? I'm not saying it refutes or confirms, I'm just wondering - how difficult is it to read an ELF | PE and remove / change those things, and if it's as easy as I'm thinking, why would you not do so? Or replace with preprocessor directives that you could setup to random values for production builds to use strings and timestamps that indicate some other entity? All of this seems straightforward to me, like, could do via shell scripting or python. Is there a valid reason to leave this stuff in? Are we seeing some low priority work that the TLA wants to leak to show that they're out there and capable?
- cronix 5y ago> Or replace with preprocessor directives that you could setup to random values for production builds to use strings and timestamps that indicate some other entity? They do, except they're not random. Check out the CIA Vault 7 leaks from a few years ago. They purposefully leave trails that point to other countries including using foreign languages for variable names/comments. > “[D]esigned to allow for flexible and easy-to-use obfuscation” as “string obfuscation algorithms (especially those that are unique) are often used to link malware to a specific developer or development shop.” > The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion, — but there are other possibilities, such as hiding fake error messages. https://www.mintpressnews.com/wikileaks-reveals-marble-proof-cia-disguises-hacks-russian-chinese-arabic/226475/ https://www.mintpressnews.com/wikileaks-reveals-marble-proof...
- tck42 5y ago
- boomboomsubban 5y ago>But when someone accuses the US we never add any salt. Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting. This thread also isn't full of calls for sanctions against the US or talk of overthrowing the government. I don't actually doubt many of the reports claiming North Korea or whoever were behind some attack, I know they are likely engaging in such activities. I just don't think the evidence is convincing enough to use as a casus belli or similar reason to take our own malicious actions. I would take a similar stance with this CIA malware, but nobody here is calling for punishment based on it.
- cyberlurker 5y agoYea, I cautiously share this viewpoint. I don’t want a cyber "Remember the Maine! To hell with Spain!" event. https://en.m.wikipedia.org/wiki/USS_Maine_(1889) https://en.m.wikipedia.org/wiki/USS_Maine_(1889)
- Jenk 5y agoGiven the public image of North Korea is one of a time capsule from the 60s I think it's more a case that the North Korean effort is considered inadequate or incapable, whilst the US TLAs have virtually limitless resources.
- at-fates-hands 5y agoLikewise, Kaspersky always seems to ferret out CIA activities quite frequently; but never seems to get the same kind of discoveries on his own countries hacking exploits and activities.
- kirill5pol 5y agoI mean is this unexpected or even being argued here? This is the same case regardless of home country. Of course they would focus on CIA or NSA exploits
- Groxx 5y agoSeems reasonable to assume that a government saying "it wasn't us" or "it was them" is a heavily politically-motivated statement, not a strictly technical one. Regardless of it being accurate or not - there are reasons to keep quiet even if there's conclusive proof. This is a case of a third party saying "we think it was probably X". You can't rule out other motivations here either, but there's a fair bit more room for it to be less politically motivated.
- tehjoker 5y agoThe existence of their insane levels of funding and well known history of coups, lies, dirty tricks, and mass murder makes it extremely easy to believe US intelligence is capable of deploying computer bullshit lol. Of course, if there is credible evidence exhonorating them we can look at that.
- tsimionescu 5y agoThere's a difference between Microsoft or Google or Symantec coming out and saying 'this was NK malware' and the CIA or NSA or FBI saying 'this was NK malware' - people would be more inclined to believe the former rather then the later, even though we would still have to imagine that it's possible they are saying this because of CIA/FBI/NSA influence. Likewise, Kaspersky is more believable than if the FSB came out with this story, even if we must be cautious that it could be an FSB story.
- deleted 5y ago[deleted]
- acruns 5y agowe should consider the source and timing for sure.
- throwawayfff 5y agoThe last round of skeptics were skeptical of Russian hacking, and were shouted down for asking for more evidence then "experts agreed". They're either still around lurking or have just moved on. No one wants to post just to get down voted or shadow banned.
- cowmoo728 5y agoUntil a few years ago, I was skeptical that North Korea had the technical expertise to pull off some of the hacking that was being attributed to them. In the past 5+ years, however, it's become increasingly clear that they have a well funded and dedicated team of competent hackers. The NSA and CIA, on the hand, are always assumed to have some of the best hackers in the world. So when I read that some huge exploit with multiple complex 0-days chained together has been discovered, and it's being attributed to the USA and/or Israel, I usually assume that's true because very few other countries have the ability to pull it off.
- mike_d 5y agoNorth Korean cyber capabilities were likely heavily thwarted for a long time by the fact that the United States could observe all the traffic entering and exiting the country. As a result they operate units completely overseas. North Korean students launch attacks from Indian Universities. They have networks of individuals that spend all day cashing out ATMs in Malta. The Chilbosan Hotel in Shenyang, China is a front used by the RGB as a forward base for cyber operations.
- coliveira 5y agoThe CIA was caught lying and cheating several times in official investigations. Can you imagine what they have done when nobody else is looking?
- da_chicken 5y ago> Not that I don’t think it’s false, it’s just that the lack of consistent skepticism is interesting. It's not genuine skepticism. It's people on social media wanting Internet points for pointing something out. It's devil's advocates and "well akshully..." people just saying something to make a point. People don't do it on CIA stories because it's not honest skepticism in the first place. It's not fun when the sarcastic and cynical responses make you even more jaded about your own country. <--- Now, kindly do the needful, dear reader.
- deleted 5y ago[deleted]
- germinalphrase 5y agoHopefully - we never find out the extent of our (and their) capabilities.
- Dolores12 5y agoNow compare it to how fast US intelligence analysts are. They may conclude who is behind attack in a matter of days. (For example, recent solarwinds attack)
- deleted 5y ago[deleted]
- sitzkrieg 5y agoand to think thats because they seemingly randomly decided to go back and re analyze this older stuff
- bredren 5y ago>seemingly randomly decided
- dilyevsky 5y agoI’d say it’s likely they were instructed to sit on it until the time is right
- sturza 5y agoDid you take occam’s razor into account? Why is this likely?
- dilyevsky 5y agoThe timing is very sus given recent and ongoing spy mania in eastern europe (if you’ve been following)
- ddalex 5y agoThe thing in EastEurope is not intelligence-based, its' political.
- smolder 5y agoOccam's razor hardly ever applies to stuff like this (news in the intelligence space) because deception is the whole game. A tendency to believe simpler explanations is something they exploit. I think Occam's razor is often misapplied in this way. It's for explaining natural phenomena, not for surmising the intent of an intelligent entity with an incentive to deceive.
- canada_dry 5y ago> determine all this from some binary Reminiscent of how cipher decoders knew their German operators well enough that it assisted in the decipher process.
- craig131 5y agoUsing inductive reasoning, they're probably still deploying first-stage malware en mass that activates under certain network conditions. Truly scary stuff.