3 ms·

I wonder what the chances are that a security researcher would execute a Windows binary they receive over chat from a rando. This isn't even security 101, just

by imiric 3y ago

I wonder what the chances are that a security researcher would execute a Windows binary they receive over chat from a rando. This isn't even security 101, just common sense at this point. If anything, I'm sure it gave researchers a chance to play around with the binary in a secure environment. They wouldn't even need to reverse engineer it, since the source code was made public by the attackers. Good guy black hats! Speaking of, can someone find the exploit in the linked repository? I'm curious what it does, but can't bother with going through all files. TFA could've linked to it, as well as mention how they determined this project is linked to NK hackers...

jeremyjh 3y ago
That isn't what they said the threat was; they were sent a document that exploited a 0-day in whatever program reads it.
- imiric 3y ago
  Ah, I misunderstood, thanks.
lights0123 3y ago
> the threat actors sent a malicious file that contained at least one 0-day in a popular software package i.e. not executables
- dboreham 3y ago
  It became an executable :)
n0on3 3y ago
> how they determined this project is linked to NK hackers If they have enough confidence to attribute and not disclose how/why, one can fairly guess they don't want to burn sources or indicators which might still be useful moving forward but likely won't be if disclosed...
circuit10 3y ago
I’m not a security researcher but I would definitely do it if they seemed like a decent person who I had totalling to for a while and were running an open source project
no-dr-onboard 3y ago
More often than you'd think. Young infosec practitioners are encouraged to get certifications, OSCP, eJPT, etc. A lot of these cert mills require that you pwn known boxes. This gives rise to discord servers where you can "help eachother". Some of this help is in the form of binaries or obfuscated source code. They run it on their pentest job laptop, you know, the one with the SSH keys to their report writing box. They get pwnd, and now DPRK has access to a bunch of US civilian corporate data and weaknesses. I may have actually witnessed this.
deleted 3y ago
[deleted]
NegativeK 3y ago
Security 101 is that everyone will fuck up at some point. _Everyone_. If the security researcher's environment isn't well designed (which absolutely happens, whether it's via budget or inattentiveness,) then the attacker can get to a delicious creamy filling very fast.

by imiric 3y ago

jeremyjh 3y ago

That isn't what they said the threat was; they were sent a document that exploited a 0-day in whatever program reads it.

imiric 3y ago
Ah, I misunderstood, thanks.

lights0123 3y ago

> the threat actors sent a malicious file that contained at least one 0-day in a popular software package i.e. not executables

dboreham 3y ago
It became an executable :)

n0on3 3y ago

> how they determined this project is linked to NK hackers If they have enough confidence to attribute and not disclose how/why, one can fairly guess they don't want to burn sources or indicators which might still be useful moving forward but likely won't be if disclosed...

circuit10 3y ago

I’m not a security researcher but I would definitely do it if they seemed like a decent person who I had totalling to for a while and were running an open source project

no-dr-onboard 3y ago

More often than you'd think. Young infosec practitioners are encouraged to get certifications, OSCP, eJPT, etc. A lot of these cert mills require that you pwn known boxes. This gives rise to discord servers where you can "help eachother". Some of this help is in the form of binaries or obfuscated source code. They run it on their pentest job laptop, you know, the one with the SSH keys to their report writing box. They get pwnd, and now DPRK has access to a bunch of US civilian corporate data and weaknesses. I may have actually witnessed this.

deleted 3y ago

[deleted]

NegativeK 3y ago

Security 101 is that everyone will fuck up at some point. _Everyone_. If the security researcher's environment isn't well designed (which absolutely happens, whether it's via budget or inattentiveness,) then the attacker can get to a delicious creamy filling very fast.