16 ms·
Countering threats from North Korea
- boomboomsubban 5y agoOn the financial attacks URL list, what is teenbeanjs trying to emulate? It doesn't seem to fit with the rest that all sound vaguely technical or financial, except that it contains "js."
- daenz 5y ago> Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages. These safeguards included: * Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site. * In some email campaigns the targets received links with unique IDs. This was potentially used to enforcea one-time-click policy for each link and allow the exploit kit to only be served once. * The exploit kit would AES encrypt each stage, including the clients’ responses with a session-specific key. * Additional stages were not served if the previous stage failed. Is this a normal level of sophistication for a CVE?
- mhoad 5y agoI think it’s currently unusual but makes sense as a pretty obvious SOP for an attacker with a specific target set who is sitting on top of a pretty valuable vulnerability (RCE on a fully up to date Chrome in this instance). They are hard to come buy and building tooling is a long and expensive process on top of everything else.
- RL_Quine 5y agoWe see some of this with just normal spear phishing against companies. The "single click" thing is reasonably common, it makes things a bit harder to catch as often the clickthrough will change to whatever is being spoofed in the first place. A homophone ycornbinator.com would serve the malware first time, then next time it would send a permanent redirect. Unique IDs you'll see in things like spam SMS, both to work around automated blacklisting, but also to work out who clicked through and who might be a potential mark the next time even if they didn't completely fall for the scam. Most of what we got was recycled RAT malware with various packers though, it didn't trend towards being particularly interesting because you usually don't need to be to catch people, at least that's my impression. Maybe it's bad toupee fallacy.
- mot0rola 5y agoI am receiving increased SMS spam past week. Is connected to this exploit? Msgs are all different domains with unique ID appended.
- samsonradu 5y agoMe too, receiving spam job offers with bit.ly links.
- xunn0026 5y agoI too saw one of these. Very odd since I was expecting a note about a job.
- TedDoesntTalk 5y agoDon’t reply to those SMS. Your geolocation can be derived from your reply, even a STOP or UNSUBSCRIBE reply.
- akouri 5y agoCan you explain how this works if you don't click any links?
- TedDoesntTalk 5y agoI read about it on HN some months ago. I don’t recall if it was in comments or an article. But I read the info and sources and was convinced enough at the time. I’m sorry I didn’t save the original info. I’ll try some googling “geolocation from SMS” and see what I can find.
- daenz 5y agoPresumably if they have the number to text to, they already roughly know the geolocation for most people, through the area code.
- deleted 5y ago[deleted]
- adolph 5y agoMuch of it seems like normal ad-tech practice to identify individuals and discourage click-farming. Unique keys sent in an email campaign? Oh my scaaary stuff.
- politelemon 5y agoFor targeted ones I think it is. The details that emerged around SolarWinds were quite sophisticated in terms of execution, timing, hiding, and cleanup.
- no-dr-onboard 5y agoFor CVEs? No. CVEs are awarded for things as (relatively) little as static keys being packaged with APKs. What is unusual is that NK used a sophisticated attack chain to successfully pwn a hardened industry (notably, fintech). At this point I think it’s safe to say that NK is a significant competitor to FVEY in terms of cyber warfare capabilities.
- thefunnyman 5y agoI would say this isn’t necessarily unusual for NK. As far as I know, they’re the only nation state actor known to hack for profit and they’ve committed several of the largest cyber bank robberies ever. Nation state actors have an _incredible_ amount of time, resources, and motivation.
- no-dr-onboard 5y agoIndeed. The amount of skill they've demonstrated as Lazarus (Lazarus Leaks (Vault 7), the Bangladesh Bank Heist, and Dark Seoul) is certainly notable and this seems to fit well within their MO.
- vmception 5y agoOperation AppleJeus Ok thats clever, and a nod to Zeus exploit kit, I love hacker group names lol
- buzzert 5y agoWhat evidence do they have that suggests these threats are coming from North Korea?
- trashcan01 5y agoA statement from Google.
- martyvis 5y agoI'm actually surprised Google would say this is from the DPRK government without also saying it had has been verified by US federal government authorities. Usually they leave it for others to deal with statements at that level.
- huntsman 5y agoI think you’ll find TAG regularly gives assessment on attribution at least at the country level. Iran, China, Russia, Belarus and North Korea at least have been named in the last few years. (Disclaimer: I am head of TAG)
- dna_polymerase 5y ago
- thematrixturtle 5y agoHere's the report which associated Clear Sky with NK, and it's not from Google: https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf https://www.clearskysec.com/wp-content/uploads/2020/08/Dream...
- dna_polymerase 5y agoYeah, still waiting for something to substantiate the headline. This report isn't it. A lot of hand-waving about other people's hand-waving.
- olivierduval 5y ago
- deleted 5y ago[deleted]
- yunohn 5y agoI think you misunderstood - they’re saying the links served nothing, presumably because it’s a Chrome-specific exploit.
- joshuamorton 5y agoOr potentially there were exploits but they weren't able to encounter them due to the various protection measures the attackers used.
- yunohn 5y agoEither way, I find it very hard to believe that they haven’t coordinated with Apple and Mozilla on this CVE.
- joshuamorton 5y agoThere's nothing to coordinate with on this cve. There's almost assuredly coordination happening between the various security orgs, but this cve is about a chrome bug, and the Google teams weren't able to isolate ff or safari zero days to report. "We expect this group has zero days that they're exploiting in your software but we don't know what specifically they are" isn't a cve.
- SheinhardtWigCo 5y ago"We did not recover" is ambiguous.
- Thorrez 5y agoBecause of the various safeguards: > Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site. > In some email campaigns the targets received links with unique IDs. This was potentially used to enforce a one-time-click policy for each link and allow the exploit kit to only be served once. > The exploit kit would AES encrypt each stage, including the clients’ responses with a session-specific key. > Additional stages were not served if the previous stage failed. it was hard to collect the exploits. They only managed to collect the Chrome one. Compare this to Pegasus, malware that attacks both iOS and Android. So far researchers have only been able to collect iOS versions. I think it's a little funny that you're complaining that a Google security group (TAG in this case) is publicly reporting vulnerabilities in a Google product, but not others. With Project Zero (a different Google security group), people usually complain in the opposite way, and say that it's bad for Google to publicly report a lot of vulnerabilities in competitor products, because it makes competitors look bad and is just done for publicity reasons. Disclosure, I work at Google, but not on anything related to this.
- sydthrowaway 5y agoI am so fucking done with the internet turning into a trash pile of scams and exploits.
- ______-_-______ 5y agoCountries have been doing terrible things to people since long before the internet
- user_7832 5y agoTrue but before the internet it was limited to the locality. The internet feels like a public park that gets trashed by folks all across the world and not just by the neighbors. (Just to be clear, I sympathize with your point as well)
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- wolverine876 5y ago> Countries have been doing terrible things to people since long before the internet What do you conclude? We shouldn't care or do anything? The Internet, the medium, seems to greatly increase the volume of scams and from everyone, not just countries.
- stefan_ 5y agoWho is even routing with North Korea? Seeing how the normal populace there literally doesn't have access to the internet, what on earth is there to be gained?
- sydthrowaway 5y agoYou know who.
- blondin 5y agoit is interesting that most of the CVEs are "use after free". instead of being stuck in an endless cycle of detection and patching, maybe, it's time we consider better ways...
- deleted 5y ago[deleted]
- saagarjha 5y agoAh, yes, I’m sure the Chrome team is entirely unfamiliar with ways to improve memory safety. Snark aside, every browser vendor is working on this, it’s just that migrating is nontrivial.
- mcintyre1994 5y agoWhat approaches are being considered here out of interest? I’m only familiar with Firefox’s use of Rust, but haven’t heard anything about other browsers trying to use that particular approach.
- erk__ 5y agoThe edge team have talked about it a bit in the following blog posts: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... https://microsoftedge.github.io/edgevr/posts/Introducing-Enhanced-Security-for-Microsoft-Edge/ https://microsoftedge.github.io/edgevr/posts/Introducing-Enh...
- PoignardAzur 5y agoThat's... wow. This is incredible. What they've found is that JIT can be disabled in most sites with no user-visible impact. This, combined with WebAssembly, is a game-changer in waiting for browser security.
- _0w8t 5y agoThe biggest coming change is raw_ptr wrapper to replace raw pointers stored in structs and classes. Presently in Chromium it is no-op, but soon will be replaced by a non-trivial implementation that will instantly crash on use-after-free.
- tester756 5y agoWill WebAssembly save us from this kind of CVEs? assuming it has capabilities to support "modern" web
- dchest 5y agoNo, on the contrary, it makes the attack surface larger.
- tester756 5y agoHow?
- FastEatSlow 5y agoWeb assembly is extra code and complexity in a web browser compared to one without, so there are more potential vulnerabilities
- tester756 5y agoI don't buy it because you can apply same reasoning to every new / changed line of code, yet it ain't always true The question is, is WASM's security model / sandbox "safer" / "easier to actually execute" than JS'?
- vbezhenar 5y agoIt does not matter because JS is not going anywhere. Whether it’s more secure or not, it’s still additional attack surface.
- tester756 5y agoI believe it does Of course JS ain't gonna go anywhere now, but if popular JS frameworks started emitting WebAssembly behind the scenes, so devs could still write their JS(and C++/C#/etc) code, but it'd use WASM under the hood then that'd start process of the deprecation of JS. Which would mean that after all popular JS frameworks managed to migrate and popular sites adopted to this, then in ideal world you'd be able to turn off javascript and still use those sites/apps via WASM, not by default for everyone, but at least users that care would have an option to do so while still being able to use the web. You gotta start somewhere I'm wrong somewhere? or out of the touch with reality?
- shdshdshd 5y agoCouldn't they just hardware mitm the CPU and Ram, not to be prisoner of AES. This way they can dump stages as well.
- ajross 5y agoSure, but that requires having a fully instrumented host get attacked. If all you have is a few reports of compromised machines, it's much harder to work backwards to the exploit. The attacker will switch things around before phishing again, etc... Honeypots are harder than they look, basically.
- deleted 5y ago[deleted]
- napmo 5y agoGoogle itself is gathering people's personal data and uses fingerprinting methods to track them. This is done on billions of people, and not even limited to their actual logged in users! It would be nice if governments put an end to Google's invasion of people's privacy. It is much more important than some failed attacks.
- coder-3 5y agoSnowden has shown us that governments encourage and benefit from this surveillance thus are unlikely to put an end to it
- lizardactivist 5y agoBeen looking in that article to find how they concluded it's from North Korea, but I can't find it. Can anyone point it out for me?
- buzzert 5y agocrickets
- eli 5y agohttps://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf https://www.clearskysec.com/wp-content/uploads/2020/08/Dream...
- dmix 5y ago> Analysis of the files shows, that they cannot run on computers that have the Korean, Japanese, or Chinese language preferences Interesting seeing Japanese here but might just be a language thing. > LinkedIn profile Protection – we believe that LinkedIn has yet to develop sufficient security mechanisms and protect its users against impostor accounts. We find it alarming that a fictitious profile, copycat an existing account, can be open and use without alerting to source profile from which the information was stolen, as well as profiles contacted by the new imposter profile. Sounds like some low hanging fruit
- boomboomsubban 5y agoThat's a report from 2020, how would it show this exploit found in 2022 was from North Korea?
- tptacek 5y agoThey're unlikely to tell you, at least not the level of satisfaction a nerd message board demands, for some of the same reasons we don't know about all the anti-abuse mechanisms on HN; because attribution and obfuscation (like abuse/anti-abuse on HN) is an arms race/cat-and-mouse game.
- iJohnDoe 5y ago
- yoonsanko 5y ago
- steve76 5y ago[dead]
- bamboozled 5y agoNorth Korea is a problem that would be easier to care of now, rather than later it seems.
- stonogo 5y agoThis was the government line in the 1950s. There's no draft now, so we'll need folks like you to enlist.
- dahfizz 5y agoConflict with NK almost certainly means conflict with China.
- saagarjha 5y agoTake care of how?
- bamboozled 5y agoProbably doing similar things to what's been done with Russia, more sanctions, more sanctions against supporting nations etc. They're soon to test a nuclear weapon and already play fun games testing missiles and having them land just off the coast of Japan. Not going to be fun once those things are nuclear missiles and en route to Tokyo.
- kettleballroll 5y agoDon't we have these exact types of sanctions already in place i. NK for exactly the reasons you mention?
- bamboozled 5y agoSure, they're not working well enough by the look of it... The people are severely repressed, it's hard to imagine how much North Koreans suffer, look up Yeonmi Park's story. What we seem to do is ignore these maniacs, until it's too late or it's absolutely critical, then they hold us hostage, like Putin.
- aaron695 5y ago
- mrjangles 5y agoDoes firejail or any of those similar tools offer protection from this sort of thing?
- _0w8t 5y agoMost of the attacks target Windows and Mac, so one is already protected by using Linux. As regarding effectiveness of firejail, then it relies on Linux container protection which is quite good given that many providers use that to run untrusted code. However, the problem with firejail or similar tools is that that try to integrate with GUI and that makes the attack surface vastly bigger. To protect against highly sophisticated attacks something like Qubes OS should be used with explicit whitelisting of domains to connect.
- k_sze 5y agoWhy does Google even need to mention North Korea in the title? A vulnerability is a vulnerability. Why bring politics in, right in the title? It would feel much more OK if simply said in the text, that a NK hacker group is currently known for exploiting it. Imagine it was a vulnerability being exploited by a TLA of the US of A. What would Google say? Or would they have received a gag order to not talk about it at all? But then what happens if some third-party researcher discovers the vulnerability independently and reports it? What would Google say?
- 4gotunameagain 5y agoBecause of the close ties of US tech giants and the US "intelligence" community.
- wanda 5y agoBecause more people will click on it and read it. Call it "Countering CVE-0284-b" and 50 people will read it. Go with a political catalyst title and you get thousands if hits, even if they then close the tab immediately. It means more random user-agent/referrer data for them and I'm guessing more domain authority or whatever that crap is. It's marketing. The article concludes with how the Google Chrome safe browsing list was updated bla bla bla. It's all just marketing. That's how Google operates. Everything is a shop window. Everything you say, do and make. Google is the market research company. Except they've repeatedly created products that no one wanted and killed them. But that's a form of market research when you have a lot of money. I feel like Google collects so much information it probably doesn't get much sense out of it. Who knows
- _8j50 5y agoBecause they believe it is a state sponsored attack. It isn't politics, it is called attribution which is a threat intelligence product. Identifying and tracking specific threat actors is esentially the entire point of the post which is a threat intel post, means little without the threat part (threat actors not tools).
- _8j50 5y agoGotta say, TAG/Project zero make their work look very cool!