21 ms·
North Korea hacked him, so he took down its internet
- throwaway4good 5y agoThis is nothing to celebrate. Would we like random people sitting in say North Korea taking cyber revenge over evil regimes they don't like?
- Calloutman 5y agoI mean, they specifically targeted him first. It's not that he just didn't like Kim and thought he'd take him down a peg.
- Barrin92 5y agoSurprised that I have to scroll that far for this comment. Imagine the US or South Korea is negotiating say, prisoner releases or family reunifications and then some dude causes what looks like an American cyberattack on North Korea. Warfare falls within the domain of the state, that includes cyberspace. Americans love their vigilantes but this has the potential to be incredibly destructive. It's no different from the private Russian attacks on American oil infrastructure. Private actors causing tensions between nuclear powers is a bad idea.
- rapjr9 5y agoCyberattacks are different then sending a warship or dropping a bomb though. They are harder to attribute and anyone knowledgeable and willing to the spend the time can carry them out. There have long been cyberattacks by criminals on companies in other countries, but attacks by individuals on governments are also possible as we now see. It seems likely others will emulate this and there is no obvious way to stop it from happening. It may be illegal but you have to find the person responsible first. Current cyberdefenses obviously are porous. Warfare used to be the domain of the state mainly because only the state had the capabilities (and some corporations have had and used similar capabilites, like oil companies with their own private armies). An individual could travel somewhere and start throwing bombs but the amount of damage they could do was small. Instead of a DDoS attack this guy could have decided to brick all computers in North Korea. I don't see a way these kinds of attacks can be stopped and they seem likely to cause a lot of havoc in the world. Basically, imagine ransomware with a political motive behind it launched by individuals with a goal of destruction rather than Bitcoin. It's actually kind of surprising there haven't already been many instances of it, or maybe there have.
- ballenf 5y agoI would have advised him to stay quiet about this. Not out of fear of the North Koreans, but out of fear of our own security agencies seeing the activity as interfering in international relations. Also the vagueness of our hacking laws probably make what he did a crime. But I also am immensely proud that we have people willing to take things into their own hands when needed. Also, I feel like the 2nd amendment should be interpreted to include the right to bear digital arms (strong encryption for a start). This will probably take another decade to figure out what that would really mean.
- excalibur 5y ago> Also the vagueness of our hacking laws probably make what he did a crime. Yes, it is most definitely and intentionally illegal. Things don't stop being crimes just because the victims are communists.
- ipaddr 5y agoA North Korean law was probably broken. North Korea could ask the US to send him over to stand trial and the US could agree or ignore the request. No legal framework exists between the two countries so the US isn't forced to send them. Things don't start becoming a crime until laws exist.
- wspess 5y agoSorry for being pedantic but the State of North Korea does not claim to be communist but rather "socialist Juche" which is very different from Marxism-Leninism and other "communisms". http://naenara.com.kp/main/index/en/politics?arg_val=leader3 http://naenara.com.kp/main/index/en/politics?arg_val=leader3
- Waterluvian 5y agoThe other day I read a (possibly wrong, fictional, or dramatized) account of some private group hacking Belorussian railways to impede Russian military logistics. I'm sure this is not new, but to me it is a fascinating concept: the modern era equivalent of Partisan soldiers, conducting cyber warfare in their jammies.
- sudobash1 5y ago> So after a year of letting his resentment simmer, P4x has taken matters into his own hands. “It felt like the right thing to do here. If they don’t see we have teeth, it’s just going to keep coming,” says the hacker. Frankly, I feel that international relations are going poorly enough without vigilantes poking the bear. And also, I doubt that bringing down their network infrastructure will have the desired effect of them lessening the cyber-attack capabilities.
- AnimalMuppet 5y agoIn fairness, the bear poked him first...
- TedDoesntTalk 5y agoThe article says he downloaded a hacking tool for a friend into a VM that had a back door. Then goes on to say he was “personally targeted”. This is ridiculous.
- ssklash 5y agoNK was specifically targeting prominent security researchers, with fake accounts and blogs, then trying to get the researchers to open a backdoored Visual Studio project. They were absolutely personally targeting people, and I don't doubt he was one of them.
- jallbrit 5y agoI'm not sure that's what the article is saying, and I certainly don't think it's "ridiculous". The relevant part: > In late January of 2021, he opened a file sent to him by a fellow hacker, who had described it as an exploitation tool. Just 24 hours later, he spotted a blog post from Google Threat Analysis Group warning that North Korean hackers were targeting security researchers. Sure enough, when P4x scrutinized the hacking tool he'd received from a stranger, he saw that it contained a backdoor designed to provide a remote foothold on his computer. P4x had opened the file in a virtual machine, digitally quarantining it from the rest of his system. But he was nonetheless shocked and appalled by the realization that he'd been personally targeted by North Korea. The article specifically states he received it "from a stranger", not a friend, which suggests that he was indeed personally targeted. Yes, it does say "fellow hacker", but again this is obviously not someone he knows because it's a "stranger". I guess it comes down to your definition of "personally targeted". Sure, this isn't a spearphishing campaign, but according to Google's blog writeup about these events [1], they basically targeted individual researchers: > The actors have been observed targeting specific security researchers by a novel social engineering method. After establishing initial communications, the actors would ask the targeted researcher if they wanted to collaborate on vulnerability research together... [1] https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ https://blog.google/threat-analysis-group/new-campaign-targe...
- rootsudo 5y agoI wonder if it's the same P4 that I was accustomed too on video game modding forums and similar places. Curious indeed. But even going on wired to brag about it, I wonder.
- jacquesm 5y agoI give that about 0.3846% chance.
- schwanky 5y agoIt's easy to accuse North Korea. They can't practically respond to the accusations because they have no outlet anyone reads, and if anyone did then nobody would care anyway.
- lelandfe 5y agoImplying that the hacking attributed to NK might have been a false flag?
- dash2 5y agoIndeed another person quoted in the article suggests that the hacking might have come from China.
- eclipsenet 5y agoThat's the wrong takeaway from that bit though I think. I believe they are saying that China and other states are the actors on behalf of NK not that they are using NK as patsies ... granted that may also be true. International politics and espionage is a weird domain.
- ummonk 5y agoI think the implication is that these are North Korean hackers stationed in China, not that China is doing it on their behalf.
- ncmncm 5y agoNK trains up and operates hacking groups to generate income, not just to be unpleasant. So, guessing that would mean NK is renting out hacking services to China. Other ways to generate income from hacking is operating a ransomware gang, renting out botnets, and gathering banking passwords to use in draining accounts. We may assume they are involved in all of the above.
- commoner 5y agoNorth Korea has Rodong Sinmun, which has an online edition in English. People interested in North Korean politics do read this newspaper. - Website: http://www.rodong.rep.kp/en/ http://www.rodong.rep.kp/en/ - Wikipedia: https://en.wikipedia.org/wiki/Rodong_Sinmun https://en.wikipedia.org/wiki/Rodong_Sinmun
- curtisblaine 5y agoSo now they're probably patching their vulns, or at least they're aware of them, resulting in an overall better security for NK.
- mrkstu 5y agoI would imagine the intelligence services aren't happy he's providing them free pen-test services. He's taking potential tools out of their toolbox when they may need/want them in a future time of conflict.
- gunfighthacksaw 5y agoSo if the reds start parachuting down over your community you should just sit pretty lest you interfere with your military’s operations? The equivalence is not a false one in my eyes because a cyberattack against a US national’s systems should be seen as an attack on a US national’s property.
- boomboomsubban 5y ago>So if the reds start parachuting down over your community you should just sit pretty lest you interfere with your military’s operations? I imagine you would be told to evacuate if possible but I'm sure the military would prefer you just don't get involved. Civilians should stay out of warfare.
- ummonk 5y agoIf they send a small aircraft onto your territory you shouldn't light it up with all your SAMs and take it down, because that will allow them to locate your SAMs for SEAD.
- throwaway9986 5y ago[dead]
- biermic 5y agoSo that guy downloaded some random "hacking tool" a friend of his found, and no shit it had a backdoor. He was never directly targeted by the North Koreans.
- syntheticcorp 5y agoNK did personally target security researchers for compromise. See the TAG post referenced inTFA.
- DietaryNonsense 5y agoI see comments saying that he may be interfering with actual operations against NK or that now that he has done this they are more likely to patch their systems and be more secure, contradicting his own intentions. It's also entirely possible that this action, including the WIRED article and it's high visibility, is part of a broader effort and strategy. In reality we just won't know in this type of situation. Any casual judgement that talks about how obviously naive this is may be a little too shallow.
- pessimizer 5y agoTrue. He may not even exist.
- biermic 5y agoYou might be onto something.
- kspacewalk2 5y agoHowever, that something may also not exist.
- DietaryNonsense 5y agoA colleague asked me what I meant by this - what use would a WIRED article have? etc. Targets (individuals, interior or gapped networks, etc) can be difficult to identify or locate and are even more difficult to get access to. Consider that it may be easier to run an operation where you intentionally pseudo-identify a security researcher engaging in his own attack to draw attention. Better yet, this researcher is known to be in possession of valuable tools, after all, the article says so. Maybe P4x exists or is a fiction, but either way there's a difficult yet traversable route of information that leads to "his" network. Somewhere there's an encrypted volume that presumably holds his cherished tools and information. But P4x knows that the encryption he's using suffers from undisclosed 0day. In fact, the 0day was developed by P4x et al and released into the wild to be found and used in just this kind of situation. The tools that appear to be protected by researcher P4x are actually compromised themselves, meant to be taken. He schedules an interview with WIRED, he talks shit and trashes NK operations, and plays the cocky and justice hungry hacker trope. He chums the water. There are countless ways that misdirection and narrative can be layered to draw your adversary into a worldview that is the creation of your own. It's not _just_ floors of camo-clad cyberoperaters phishing management types and looking for document dumps.
- anonAndOn 5y agoPSA: Whether bare knuckle boxing or global hacking, always remember the first rule of Fight Club.
- lowbloodsugar 5y agoWhat are you talking about?
- egberts1 5y agoWhat fight club?
- errcorrectcode 5y agoEither way, I don't know what you mean. What is this "Fight Club" of which you speak? Is it an agro baseball bat? It's probably some Hard Rock Cafe memorabilia Brad Pitt signed, right? --- looselipsinkships loose lip sink ships loose lip sinks hips loose lips ink ships loose lips inks hips
- jelling 5y ago> “I want them to understand that if you come at us, it means some of your infrastructure is going down for a while.” Doing that is one thing, and certainly won't increase your personal safety. Doing that and telling the western press to embarrass them is insanely stupid. Kim Jong-un is widely believed to have ordered the assassination of his half-brother. And you want to threaten the infrastructure of his country? Talk about a keyboard warrior. PBS Frontline's special on the assassination: https://www.pbs.org/video/north-koreas-deadly-dictator-2pobwh/ https://www.pbs.org/video/north-koreas-deadly-dictator-2pobw...
- not2b 5y agoIt's not infrastructure. He attacked a few propaganda sites aimed at outside audiences. He didn't get into their internal network, which is sealed off from the Internet.
- MichaelZuo 5y agoIt’s make one wonder if most of the other posters even bothered to read the details.
- deleted 5y ago[deleted]
- dsl 5y agoActual North Korean state sponsored hackers operate from embassies abroad, not from domestic locations. They also hire "security companies" in places like India and China to do a lot of the dirty work.
- tehjoker 5y agoSo your tools get stolen and you take down possibly critical infrastructure for huge numbers of people? Terrorism. Imagine someone did that to America in response to the NSA hacking them (read, most of the world's population all the time since the Bush administration). We celebrate that when it's done to official enemies.
- pessimizer 5y agoThe North Korean regime just needs to come in from the cold, like Gaddafi did, which certainly worked out well for him and the Libyan people.
- tehjoker 5y agoJust to add context for others that aren't familiar, NK definitely learned from the Libyan experience. It was after Gaddafi got filmed getting bayoneted in the ass for giving up the Libyan nuclear program, North Korea learned to never give up nuclear weapons and accelerated their program.
- pessimizer 5y agoThat was one short bayonet for a man, and open air slave markets for the Libyan people: https://www.usatoday.com/story/opinion/2017/11/27/clinton-ponders-2020-run-lets-not-forget-her-real-libya-scandal-glenn-reynolds-column/895853001/ https://www.usatoday.com/story/opinion/2017/11/27/clinton-po... > 'We came, we saw, he died,' she joked. But overthrowing Gadhafi was a humanitarian and strategic debacle that now limits our options on North Korea.
- emkoemko 5y agoand asking Iran to give up having missiles etc after seeing what they did to Libya?
- kingkawn 5y agoDid you read the article?
- ummonk 5y agoIt's good that he went public about it, as this is the sort of thing that can cause international tensions when the target assumes it's a state-sponsored attack. So many cyberattacks by individuals or small crime outfits get misinterpreted as state-sponsored because they're "sophisticated". Things are really easy to misinterpret, like when Ukraine's undercover attempt to capture Russian PMC soldiers resulted in Belarus thinking Russia was attempting a coup in Belarus.
- deleted 5y ago[deleted]
- neonate 5y agohttps://archive.is/QP2q2 https://archive.is/QP2q2 http://web.archive.org/web/20220202184549/https://www.wired.com/story/north-korea-hacker-internet-outage/ http://web.archive.org/web/20220202184549/https://www.wired....
- genera1 5y agoI have a gut feeling, that person responsible for those hacks might be working for or at least informing US gov about his actions in advance. Him talking so openly to a major news outlet and warm response of us gov officials point towards that
- deleted 5y ago[deleted]
- causi 5y agoan attempt to draw attention to what he sees as a lack of government response to North Korean targeting of US individuals. “If no one ’s going to help me, I’m going to help myself,” he says. Good. I'm sick of foreign policy being determined by spreadsheets that say whether defending ourselves or others will be profitable.
- jokoon 5y agoWhat do they mean "north korea hacked him" ? Does NK hire hackers? How is it possible for NK to have competent hackers?
- foepys 5y agohttps://en.wikipedia.org/wiki/Bureau_121 https://en.wikipedia.org/wiki/Bureau_121 North Korea successfully stole tens of millions by hacking banks via SWIFT between 2015 and 20216 and probably several hundreds of millions in crypto currency in 2021 alone. https://www.bbc.co.uk/news/business-59990477 https://www.bbc.co.uk/news/business-59990477 NK apparently has a very capable cyber warfare unit and hacking crypto currency wallets/exchanges is a major income for them.
- malermeister 5y agoWhy wouldn't it be possible for a country of almost 26M people to have competent hackers? Just cause they live in a dictatorship doesn't mean they're all stupid.
- doublerabbit 5y ago> he opened a file sent to him by a fellow hacker, who had described it as an exploitation tool. Is it not potentially their mistake in the first place? They opened themselves to becoming exploited via social engineering. And if that is the real reason why, they were not really hacked. So can we stop using the term "hacked" so ambiguously?
- chc4 5y agoRespectfully, you have no clue what you are talking about and should read https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ https://blog.google/threat-analysis-group/new-campaign-targe...
- doublerabbit 5y agoHe was socially engineered in-by trusting who was thought a buddy to open a file; who which was maliciously a actor for the N.Korea. I've been a SysAdmin for god-long time, so thank you for respectfully telling me that I am not, when I am full well aware of what I am talking about. He was socially engineered to open a file. It wasn't Abbacada 123, poof your hacked. It was his fault, he opened the file and that makes him foolish of him to "trust" and open a file. End result, he got himself infected with an exploit.
- nr2x 5y agoWhere's the GoFundMe link?
- darkhorn 5y agoThis is a self defence. If police cannot protect you from bad people then you protect yourself from bad people.
- californiasurf 5y agoI think he should crowd source this so we can all work to disrupt North Korea.
- Kalanos 5y agoreckless. could have caused missiles accidents or god knows what. now those vulnerabilities will be patched. it would have been better to report those vulnerabilities to the military so they could be used when needed.
- okkdev 5y agoI don't like this
- deleted 5y ago[deleted]
- mrtweetyhack 5y ago
- wolverine876 5y ago> he nonetheless felt deeply unnerved by state-sponsored hackers targeting him personally—and by the lack of any visible response from the US government. > Aitel agrees, though, that the government response to North Korea's campaign has been lacking. From a certain perspective I'm not surprised: We're accustomed to the US government being hands-off the Internet, going back to the Internet's early idealistic libertarian days, and in the past lacked the technical abilities. But we need to be surprised: Fraud, scams, theft, damage, hacking, ransoms, etc., etc. are commonplace. The Internet is highly insecure, yet the US government hasn't yet taken responsibility for enforcing the law and protecting the innocent there. It's just crime; it's not a special situation anymore.
- threshold 5y agoThis idiot. Took down a countries internet and bragged to the press. I wonder how many doctors in NK couldn't serve their patients without network access? But why stop there? Take out the power as well. Contaminate the water. We'll all have a good laugh. No wonder they're building missiles to shoot at us. This hacker franchise has run its course. Ok it was a fun movie in 1995. But in our modern world what this guy has done is plainly terrorism, probably with a real body count. Not a prank, not hip and not cool. And if it was done to us it would be a clear act of war.
- Stevvo 5y agoHe only target external facing sites, so no doctors were affected.
- wchar_t 5y agoCalm down, he took down a few websites. He didn't take down their entire internet, as the article notes a few times: > As rare as it may be for a single pseudonymous hacker to cause an internet blackout on that scale, it's far from clear what real effects the attacks have had on the North Korean government. Only a tiny fraction of North Koreans have access to internet-connected systems to begin with, says Martyn Williams, a researcher for the Stimson Center think tank's North Korea-focused 38 North Project. The vast majority of residents are confined to the country's disconnected intranet. Williams says the dozens of sites P4x has repeatedly taken down are largely used for propaganda and other functions aimed at an international audience. > While knocking out those sites no doubt presents a nuisance to some regime officials, Williams points out that the hackers who targeted P4x last year—like almost all the country's hackers—are almost certainly based in other countries, such as China. “I would say, if he's going after those people, he's probably directing his attentions to the wrong place,” says Williams. “But if he just wants to annoy North Korea, then he is probably being annoying.” > For his part, P4x says he would count annoying the regime as a success, and that the vast majority of the country's population that lacks internet access was never his target. “I definitely wanted to affect the people as little as possible and the government as much as possible,” P4x says.
- threshold 5y ago
- sudoaza 5y agoLOL
- shireboy 5y agoThen again, if a secret state org hacked the sites, part of the plan would probably be to place stories crediting a rouge individual and discrediting the idea it was a government org. Obviously not proof the story is false either, but like so many of these things, conclusive proof or even evidence of attribution is not given.
- lonloon 5y agodoes anyone know where to find that website they mentioned??
- dbgev 5y ago
- steve76 5y ago[dead]
- gggg1234567 5y agoWell, if someone from North Korea did this to some other country, what would be the reaction? Why is this dubious criminal activity being endorsed as being positive? Is it wise to endorse criminal activity as positive - depending on what our relation with the victim is? Can North Korea ask for him to be found and delivered to stand trial there? Would it be ok for North Korea to find and steal him from his home at night and bring him to trial? Can North Korea expect that politicians from US to denounce this act as unacceptable? What does USA intend to do, to stop such acts which are mostly originating from their country?
- parts 5y ago> “The United States is good at protecting the government, OK at protecting corporations, but does not protect individuals.” > [Dave Aitel] points out that many of the targeted security researchers likely had significant access to software vulnerabilities, enterprise networks, and the code of widely used tools. That could result, he says, in “the next SolarWinds.” Yikes.
- Communitivity 5y agoYou can admire his spirit, but not his judgement or actions. Attacking a foreign power, or serving a foreign power's military, are both crimes from what I know (am not a lawyer, but cybersecurity tangential). Specifically, taking out the power affects everyone who lost power, and could be construed as an attack that causes harm to foreign officials. As a result I'd think https://www.law.cornell.edu/uscode/text/18/112 https://www.law.cornell.edu/uscode/text/18/112 applies. Again, not a lawyer, but the days of hacktivist actions without major retributions have been gone since the early 90s (hackers often get worse sentences than rapists or murderers). It's a different world now, more's the pity. For some background I recommend The Hacker Crackdown (https://www.mit.edu/hacker/hacker.html https://www.mit.edu/hacker/hacker.html)