4 ms·

Evidence for attribution to North Korea?

operator-name 3y ago
> The shellcode used in this exploit is constructed in a similar manner to shellcode observed in previous North Korean exploits. At minimum the payload.
- pphysch 3y ago
  1. DPRK does an actual cybercrime, shellcode/payload eventually gets discovered and disseminated among researchers 2. Script kid acquires said code, makes slight modifications 3. Script kid deploys the malware 4. Cybersec person @ Google is promoted for uncovering major APT operation, big news story How do you prove that this is sufficiently implausible?
  - philosopher1234 3y ago
    i dont think proof is on the table here. you just have to speculate, and make an educated guess.
    - pphysch 3y ago
      I agree, but all the incentives are aligned with making sensational attributions: - Attackers don't want to get identified, so they won't help - Defenders, or their bosses, don't want to admit they got owned by a "skid" - Researchers want to pad their resumes with Serious work, not random skid nonsense - Media wants sensational stories
  - willcipriano 3y ago
    As shown in the Snowden leaks, The United States was in development of exactly this capacity and its essentially impossible to attribute attacks to nations like this. Anyone who claims to be able to is either ignorant or lying.
    - postsantum 3y ago
      Marble Framework, if anyone is interested
w0z_ 3y ago
"SoUrCe?" This is clearly comment bait. If you've done any type of opsec before you know the legal hurdles. This is coming from someone (me) who personally saw North Korean IP blocks visit malware research articles via combing the server IP logs and verifying the block.
- whimsicalism 3y ago
  This seems like a disproportionately mocking tone for the original comment made.
- pphysch 3y ago
  Attributing cybercrime is never a slam dunk unless you have physical evidence: devices, people, etc. /var/log/*/access.conf is not that. Virtually everything on the wire can be spoofed. Someone in Kansas could own an elaborate network that includes DPRK IPs. And that would be a desirable red herring for any independent criminal. WikiLeaks taught us that the CIA has tools for spoofing their payloads as Russian, Chinese, Iranian, etc. It very well could be a DPRK actor, but let's please not kill perfectly valid discussion around attribution.
  - deleted 3y ago
    [deleted]
  - paganel 3y ago
    > It very well could be a DPRK actor, but let's please not kill perfectly valid discussion around attribution. I'm starting to believe that "killing perfectly valid discussion around attribution" is part of the game itself, after all we have at least two persons in this HN comments thread (the OP, and some other guy above who explicitly said that he worked for intelligence) who have worked directly for or adjacent to (I guess that's how the OP got to see those NK-related IP blocks) Western government agencies that handle this sort of stuff.
    - w0z_ 3y ago
      Given it's an official Google blog post related to a nation-state threat actor, somebody asking for valid attribution could be a way attackers try to: 1) Derail the conversation 2) Find out ways to further cloak their footprint IMO if you've worked in the field, you know it's a dumb question meant to invoke something. "Look! We've succeeded! We've dragged out 'w0z_' and have identified him as a possible (x)!" Sadly, I am a nobody who happened to see DPRK not tunnel to a VPN.

> The shellcode used in this exploit is constructed in a similar manner to shellcode observed in previous North Korean exploits. At minimum the payload.

pphysch 3y ago
1. DPRK does an actual cybercrime, shellcode/payload eventually gets discovered and disseminated among researchers 2. Script kid acquires said code, makes slight modifications 3. Script kid deploys the malware 4. Cybersec person @ Google is promoted for uncovering major APT operation, big news story How do you prove that this is sufficiently implausible?
- philosopher1234 3y ago
  i dont think proof is on the table here. you just have to speculate, and make an educated guess.
  - pphysch 3y ago
    I agree, but all the incentives are aligned with making sensational attributions: - Attackers don't want to get identified, so they won't help - Defenders, or their bosses, don't want to admit they got owned by a "skid" - Researchers want to pad their resumes with Serious work, not random skid nonsense - Media wants sensational stories
- willcipriano 3y ago
  As shown in the Snowden leaks, The United States was in development of exactly this capacity and its essentially impossible to attribute attacks to nations like this. Anyone who claims to be able to is either ignorant or lying.
  - postsantum 3y ago
    Marble Framework, if anyone is interested

w0z_ 3y ago

"SoUrCe?" This is clearly comment bait. If you've done any type of opsec before you know the legal hurdles. This is coming from someone (me) who personally saw North Korean IP blocks visit malware research articles via combing the server IP logs and verifying the block.

whimsicalism 3y ago
This seems like a disproportionately mocking tone for the original comment made.
pphysch 3y ago
Attributing cybercrime is never a slam dunk unless you have physical evidence: devices, people, etc. /var/log/*/access.conf is not that. Virtually everything on the wire can be spoofed. Someone in Kansas could own an elaborate network that includes DPRK IPs. And that would be a desirable red herring for any independent criminal. WikiLeaks taught us that the CIA has tools for spoofing their payloads as Russian, Chinese, Iranian, etc. It very well could be a DPRK actor, but let's please not kill perfectly valid discussion around attribution.
- deleted 3y ago
  [deleted]
- paganel 3y ago
  > It very well could be a DPRK actor, but let's please not kill perfectly valid discussion around attribution. I'm starting to believe that "killing perfectly valid discussion around attribution" is part of the game itself, after all we have at least two persons in this HN comments thread (the OP, and some other guy above who explicitly said that he worked for intelligence) who have worked directly for or adjacent to (I guess that's how the OP got to see those NK-related IP blocks) Western government agencies that handle this sort of stuff.
  - w0z_ 3y ago
    Given it's an official Google blog post related to a nation-state threat actor, somebody asking for valid attribution could be a way attackers try to: 1) Derail the conversation 2) Find out ways to further cloak their footprint IMO if you've worked in the field, you know it's a dumb question meant to invoke something. "Look! We've succeeded! We've dragged out 'w0z_' and have identified him as a possible (x)!" Sadly, I am a nobody who happened to see DPRK not tunnel to a VPN.