How the “Kim” dump exposed North Korea's credential theft playbook
dti.domaintools.com
dti.domaintools.com
Classic elitist take ignoring that this this space where "all are alike" can only work for certain kinds of people.
its always just some cheesy hacker words put to seem mysterious or whatever -_-.
we are legion, we are one etc. anything like that fall apart quickly if you attach identity to something doesnt it.
i guess by being anonymous online some forget they are not anonymous irl. a lot of being alone with the terminal ^^>
gotta read between all the fluff tho.
<< Kimsuky, you are not a hacker. You are driven by financial greed, to enrich
your leaders, and to fulfill their political agenda. You steal from others
and favour your own. You value yourself above the others: You are morally
perverted. >>
Are they off the hook because they "choose" to participate in mass murder?
"Cool? It's not cool. It's commie bullshit!"
Tangentially, my problem with this phrase post is that I am struggling to get past all the obvious falsehoods when it comes to the non technical part of the writing.
It starts off the bat with using terminology like “Advanced Persistent Threat” and conflates what it already identified as a North Korean group as Chinese in this sentence
> It shows a glimpse how openly "Kimsuky" cooperates with other Chinese APTs and shares their tools and techniques.
And then gives some flowery speech about how the Koreans are bad and political but this author who opposes them is good and not political.
This reads to me like the ravings of some crazy person with advanced skills who thinks everyone else is the crazy one while wearing a tinfoil hat, or a federal group leaking a no longer useful technical hack surrounded in language pushing propaganda
I was with you right up until this bit
The agencies concerned tend to recruit people that have demonstrated ability in that field, and they've usually got it with "self-directed" training :)
The fact is there were only around 40 unique hacks ever invented, and people simply adapt these into new zero day exploits. Notably, this is now mostly a fully automated process.
If people want in, they will get in eventually. =3
x C62=:K6 J@F 2C6 AC66>AE:G6=J 5:D28C66:?8 H:E9 E96 DFCAC:D:?8=J =@H 6DE:>2E6 @7 6IA=@:E E2I@?@>J[ 3FE 9F>2? DE2E:DE:42= 3692G:@C :D 2=D@ ?@E 2D 4@>A=6I 2D >2?J 36=:6G6]
If robots want in, they will get in eventually too, apparently.
If you are ever unsure of someones motives, than politely ask for context. Have a wonderful day =3
https://en.wikipedia.org/wiki/List_of_cognitive_biases#Causa...
> If you are ever unsure of someones motives, than politely ask for context.
Asking for context.
Exploits are boring, and thus have questionable utility in a proper business context. Don't worry about it... =3
If you don't see repeating symbols, it could be a running key, like a Vigenèr cipher.
CyberChef did it fully locally with a ready-made recipe :D
Why? They’re intelligent, crafty and able to make trade-offs.
Empirically, ex-spies have a solid history in reaching commanding positions in politics and business.
Have a great day. =3
https://en.wikipedia.org/wiki/Lawrence_Kohlberg's_stages_of_...
But also gives hope. I mean, it’s rare that adults fail to advance from pre-conventional phases, so it must be super rare to have such a confluence of factors that puts someone like that in the given job.
They’re starting from a position of duty. Given the stakes the questions they’re tasked with operate at, I’d guess they tend to be in the postconventional regime more than most people.
But it's not because someone wants them there. It's because they can demand the position they want.
Zero evidence of this. And if they can demand that position from one, they can demand favors from others. I would count a background in espionage to be a net positive in a hiring process, provided dismissal was on good terms.
The only examples I can think of are Putin and George HW Bush.
The one hacker I met in my life went to West Point and had no experience they didn't gain from being placed in their program after graduating with decent test scores.
The brightest students of most nations are often sent abroad to enrich their countries with knowledge from the great universities. NK is almost unique in its inability to do this at non-Chinese great universities, so that is the only viable route.
"North Korean hackers are sent vocationally to Shenyang, China for special training. They are trained to deploy malware of all types onto computers, computer networks, and servers."[3][4]
1: https://en.wikipedia.org/wiki/Koreans_in_China#North_Koreans...
2: https://web.archive.org/web/20090114201016/http://news.xinhu...
3: https://en.wikipedia.org/wiki/Lazarus_Group#Education
4: https://web.archive.org/web/20180621134306/https://www.scmp....
Why does this surprise you? As you said, selecting capable people is not a problem. And then these capable people get the best possible motivation. I would say it is expected to get qualified hackers in such conditions, who are proficient in all latest technologies.
What's the rationale for allowing the development of offensive tooling on github? Is this a free-speech thing, or are these repositories relevant for scientific research in some way?
It was just a summer internship and FB was like 'only' 80 engineers back then. But they still took it seriously.
Otoh nmap isn't a privacy problem for users of Facebook (or any other tech company).
I've departed early at least twice over this. Draconian IT serves nobody. Been doing this long enough I deliberately poke any new employer; see what's in store.
Nobody cares, though. EDR appliances sell without careful administration. The industry will outlive us all.
Same with even doing packet sniffing. It can be detected when using wireshark because it does reverse DNS lookups for each ip it sees in its default configuration.
I had legit reasons for it at work so I always mentioned it to the network guys before ding stuff like this. We also had a firewalled lab network. We did get some pushback once when some scans leaked out to the office network. But it was their fault for having the firewall open.
https://docs.github.com/en/site-policy/other-site-policies/g...
You could hypothetically make it work, but it would mean an extremely different Internet and device landscape than exists today. (And even then I doubt it stops a nation-state level attacker, they can always use old fashioned espionage to get someone in meat space and get around any technical barrier)
https://docs.github.com/en/site-policy/other-site-policies/g...
> GitHub now has a license from OFAC to provide cloud services to developers located or otherwise resident in Iran. This includes all public and private services for individuals and organizations, both free and paid.
> GitHub cloud services, both free and paid, are also generally available to developers located in Cuba.And if you think that doesn't matter, look at the Monroe Doctrine [1].
Taken further, the so-called Cuban Missile Crisis should really be called the Turkey Missile Crisis. The US (through NATO) placed Jupiter nuclear MRBMs in Turkey, only hunddreds of miles from Moscow. The USSR responded by doing the exact same thing, by placing nuclear weapons in Cuba. And the US almost started World War 3 over it.
It was the USSR who stepped back from the brink and, as a result of a secret agreement, the Jupiter MRBMs were quietly removed from Turkey [2].
[1]: https://en.wikipedia.org/wiki/Monroe_Doctrine
[2]: https://www.wilsoncenter.org/blog-post/jupiter-missiles-and-...
I haven’t heard about the disarming stuff. I don’t think that part happened.
Comparing this with Ukraine wanting to join NATO or the EU for the defense of their right to self-determination and to live free of an authoritarian police state is laughable. But such a comment can only come from ignorance of the differences between systems of government with human rights and those with none, or else be sheet wicked propaganda paid for by an authoritarian regime.
The equivocation here is in your comment - one must wonder what your actual motive is.
No one has the heavens mandate to any land. We are only human. Not gods. You don’t get to do whatever you want on the land of your nation state just because of blood and soil arguments like you and your blood is from there.
Western and liberal democracy is not about human rights.
If China never had claims to Taiwan…then the KMT never should’ve gone there either according to your logic. And don’t have rights to that land now unless settler logic is used.
> one must wonder what your actual motive is.
I am an anti-imperialist and [pan-]nationalist. I don’t hide that. That is in contrast to most westerners or Europeans who go based off enlightened centrist and liberal vibes along with western, white, settler, and European chauvinism and supremacy.
Yet you get to invade your sovereign, self-governing and peaceful neighbors if you're Russia or China, and have such grand imperialist adventures all while claiming to be anti-imperialist? How convenient. And oh, Russia's annexation of Crimea isn't about blood and soil? That was sure the pitch made to its own population.
You say you're a pan-nationalist, but then what's wrong with Ukraine choosing to ally with Europe? Is pan-nationalism only valid when the alliance is under Kremlin despotism? Whatever Putinism is, it certainly isn't about human rights either. [Perhaps you meant you are pan-Slavic? In that case, Kiev may as well be your capital]. And if you're so cynical as to believe that no system is any better than any other system when it comes to human rights, who are you or the despots and tyrants you side with to declare who should do what? What system are you offering the citizens of Taiwan or Ukraine that they would want? Your entire argument seems to boil down to a circle of hypocrisy: The people of some country have no inherent right to be there, so even if a larger belligerent power has no right either, there's nothing wrong with annihilating whatever freedom the local people have.
By your statements, you are actually justifying settler-colonialism. Should the Han take over Tibet and dispose of Tibetans? Sure, in your opinion, since no one has claim to land. (Strange how the new settlers lay claim to the land though, isn't it?) What right do native American people have to their land? None, according to you. So then what's this imperialism of America you're yapping about? It would be easier to say: It's not as if America has done anything China or Russia isn't currently doing. But that would be playing into your trap of equivocation. As a Tibetan freedom fighter friend of mine once said, when I suggested that America was sliding toward authoritarianism: never ever compare America to how much worse things are in a dictatorship like China. To do so is an insult to everyone fighting for their freedom from these thugs around the world.
If Ukraine had wanted to join Putin's Russia, they had ample opportunity. If Taiwan wanted to join China, they could do so tomorrow by a majority vote. And if your only argument is that the West is no better and just as hypocritical - apart from the fact that I believe you to be arguing in bad faith - then what difference is it to you which sphere of influence they end up in?
> So then what's this imperialism of America you're yapping about?
Same here. You saw me say a general principle and then assumed a bunch of logic. As if what I said isn’t a basic general philosophy that many societies and cultures have had (none that you like ofc).
—
I think the political knowledge gap between us is too wide so it will just keep resulting in the same issues of you projecting your [white and liberal] supremacist ego on to others.
Like thinking pan nationalism can mean the global north too. A bananas thing to say while accusing others of being bad faith or hypocritical.
Those are all closely related topics in geopolitics.
It's more that Cuba requested nukes first, the USSR opportunistically took, then they to resolve the crisis they took that opportunity to remove Turkish missiles. It wasn't really a tit for tat on part of the USSR's intentions, Cuba was the primary agent here.
Not that it really mattered later on once ICBMs are developed.
> Your missiles are located in Britain, are located in Italy, and are aimed against us. Your missiles are located in Turkey.
> You are disturbed over Cuba. You say that this disturbs you because it is 90 miles by sea from the coast of the United States of America. But Turkey adjoins us; our sentries patrol back and forth and see each other. Do you consider, then, that you have the right to demand security for your own country and the removal of the weapons you call offensive, but do not accord the same right to us? You have placed destructive missile weapons, which you call offensive, in Turkey, literally next to us. How then can recognition of our equal military capacities be reconciled with such unequal relations between our great states? This is irreconcilable.
According to General Boris Surikov [2]:
> 'Khrushchev and his Defence Minister, Rodion Malinovsky, were at Khrushchev's estate on the Black Sea. They went for a walk and Malinovsky pointed in the direction of Turkey and said: 'That's where the American rockets are pointing at us. They need only 10 minutes to reach our cities, but our rockets need 25 minutes to reach America.' Khrushchev thought for a while and then said: 'Why don't we instal our rockets in Cuba and point them at the Americans? Then we'll need only 10 minutes, too.'
This article goes on to quote the Soviet Ambassador to Cuba, Alexander Alexeyev, who was a direct witness and a go-between between Khrushchev and Castro:
> 'On 14 May 1962 I was called to a meeting of the Defence Council at the Kremlin. Khrushchev said, in effect: 'Comrades, I think it would be a good idea to instal rockets in Cuba. Do it clandestinely. I don't want it known in the US until November (after the mid-term Congressional elections). Alexander Alexeyev, how will Fidel react when we present him with our decision?'
[1]: https://microsites.jfklibrary.org/cmc/oct27/doc4.html
[2]: https://www.independent.co.uk/voices/the-cuban-missile-crisi...
That dosen't refute anything from his own words as a justification as opposed to his primary goal to provide Cuba with defence here to deter a US invasion. As others have pointed out, the USSR was annoyed by these placements in Italy and Turkey earlier, but they did not declare war or start a crisis over it beforehand. It's more that Turkey was a bargaining chip here.
>>Our aim has been and is to help Cuba, and no one can dispute the humanity of our motives, which are oriented toward enabling Cuba to live peacefully and develop in the way its people desire.
You need to place here in context that the Jupiter missiles in Turkey were already obselete but the US had the overwhelming advantage in a nuclear strike with their Atlas ICBMs in USA at the time, relying more on a fleet of intercontinental bombers that could targeted by NORAD.
Removing nukes for Turkey did little to change the strategic calculus, but it did heavily deprive the USSR of an opportunity to change that calculus with Cuban nukes at the time, which was a major factor in Kruschev's later removal from power.
This paints it as tit for tat, but to advert invasion the Cubans asked for the missiles over a year later than the missiles were placed in Turkey. The resolution combined these separate issues.
Due to the scale of their population collapse, the influx of immigrants would have to be massive. Which country does that? It would completely overtake its native ethnic population... which unlike a country built on immigration like the US, is surprisingly homogeneous.
I'm no expert, I encourage you to read on the matter. It apparently truly is something that cannot be stopped now. It surprised me as much as it (apparently) does you.
By the way, countries that are better off, like the US, are largely helped by immigration indeed. Which is why anti-immigration policies would be like shooting themselves in the foot.
But it's going to cease to exist as it is anyway. One way or another. And the people that remain will not be staring at a wall waiting for it to end. Also, young people seem to have a radically different mindset there, which is what tends to happen when they see their parents screwing everything up.
Maybe the culture isn't there yet but it will be. Having said that, I would never be happy to live in a country with strict moral codes like Japan or South Korea. But I'm sure many people would be. In particular conservatives tend to love these societies, you often hear comments like "this is what we should do here in the US".
I'm a raging pro-lgbt polyamorous kinky progressive so for me it would be the wrong place. But there are lots of people that would love this kind of thing.
But reality shows it is happening, it is accelerating, and young people are part of the problem.
It's a real thing, and the consensus seems to be it's irreversible, however bizarre it may seem to us.
Will it disappear as we know it? Yes. But that is true everywhere. The America as you knew it in 2010 is also gone forever (and not for the better, unfortunately with its current politics). Same in Europe where the nazis are trying to take over. Change is a constant.
The South Korean population time bomb is a completely different thing to America in the 2010 changing.
Have you read what people who study demographics currently believe about South Korea. An informed opinion is really needed to discuss this, this is not about "feelings".
Doesn’t the fact that the people in said culture have decided it’s no longer worth reproducing, en masse, because of how their life is, imply that a lot of people wouldn’t actually like that kind of thing?
Because it's not a problem yet. What's going to stop them from doing it when the birth rate becomes a problem? Almost nothing.
> Due to the scale of their population collapse, the influx of immigrants would have to be massive.
Not really. You are mistakenly extrapolating the situation in the Western world, where purposefully brought in almost only criminals and freeloaders, to Korea. If you organize immigration of labor, then not so many immigrants will be needed
> What's going to stop them from doing it when the birth rate becomes a problem? Almost nothing
Their birth rate is already a massive problem. The South Korean government already acknowledges this is a crisis, it's just that the measures that are politically/socially viable just don't cut it, and Koreans seem unwilling to consider more drastic measures. But the problem is already here, and acknowledged, and already impacting the population of South Korea (there's apparently a "loneliness epidemic" going on already).
Because of the shape the population pyramid takes (more old people than young people) once it reaches the tipping point, which in South Korea it already has, there's no going back. No matter how they try, they simply don't have enough young people to revert it anymore.
> If you organize immigration of labor, then not so many immigrants will be needed
This is not (just) about labor, it's about population decline. Even if Koreans dedicated themselves to having more children, it wouldn't be enough anymore. They are beyond the tipping point. They would need massive immigration to live there and have children there and effectively become "the new Koreans"... and this is obviously unpalatable to many.
I encourage you to read on this. Do not debate me: I'm not the expert here!
These are not experts, they are deep state propagandists.
I mean, fortunately (or unfortunately), such processes have been going on for decades, and these experts have been in business for decades. So, nothing prevents us from analyzing their early models, explanations, projections, and forecasts, and comparing them with reality in order to form an opinion about the level of their expertise
> Their birth rate is already a massive problem.
Not exactly. Low birth rate itself is not a problem. What is a problem is the future consequences of low birth rate . And these consequences generally have not yet occurred, i.e. there is no problem yet.
> Koreans seem unwilling to consider more drastic measures
Yes, because there is no problem yet
> once it reaches the tipping point
Then it will become a problem and nothing will stop them from bringing in some foreign labor to fix it.
> They would need massive immigration to live there
Not that massive. Your ideas about the required amount of immigration to fix the labor shortage problem are probably formed by extrapolating Western immigration processes. But the point is that you can’t extrapolate like that. There are no obstacles to carrying out immigration tens of times more effectively than the West does.
Just to understand how irrelevant this issue is for Korea at the moment: the twentieth century was quite a turbulent time for Koreans, and now quite a lot of ethnic Koreans live outside of Korea. Many of them know the Korean language, want to move to Korea, but even with repatriation programs, this is not such an easy process. Korea has so many Koreans inside the country that they are quite reluctant to grant residence permits even to other Koreans with foreign citizenships.
Deep state? I feel like I've stepped into a conspiracy theory. What does the deep state have to do with anything? Deep state from which country? The US? Korea?
> Not exactly. Low birth rate itself is not a problem. What is a problem is the future consequences of low birth rate . And these consequences generally have not yet occurred, i.e. there is no problem yet.
Why "not exactly"? It's understood by everyone that low birth rate is a problem because of its rippling effects, which are not immediate. When I say "a massive problem" I mean "already in the near future".
But apparently it's causing problems for young people today, already.
> And these consequences generally have not yet occurred, i.e. there is no problem yet.
South Korean society is already quite unhealthy, and apparently for younger generations even more so.
To be clear: the numbers alone don't tell the full story. Population density is not the important metric here, but population aging is. There could be lots of Koreans today, but if the distribution is top-heavy, it cannot help them.
Let's do something else: link me a serious (non-conspiracy) study that there is no population decline crisis in South Korea, and I'll read it with an open mind. Be forewarned though, if it's a conspiracy article I'll ignore it.
The lack of serious offramps to reunification, along with not as huge a delta in quality of life between north and south for a long time (aid from other countries sure helps!), allowed the DPRK to establish itself as its own nation.
Now there is the surveillance state apparatus allowing the DPRK to exist in its current form in perpetuity. And even if tomorrow they showed up and said "let's unify Korea", South Korea (even ignoring all the ideological reasons it might not want to) would likely be unwilling to absorb an extremely poor country and pay for it (see the painful experience of Germany's unification).
There is probably no off ramp that exists unless people are willing to let the elite walk away clean from the situation in one way or another, and it seems hard to imagine such a future.
And if you are a north korean elite and you are allowed to travel to northern china, you will see a place where things are running more smoothly, but you're still going to see places with massive amounts of internal controls and restrictions. So who's offering the upside to some regime change here?
I had thought that Germans from both sides were overwhelmingly supportive of re-unification, even if it would cause short-term pain??
I believe the AfD political party in Germany won significant support in those areas of Germany that were once behind the Iron Curtain.
People vote far right because they're fed up with the status quo, and perceive the far right can't be that much worse when everything is already so bad. Politicians who are not far right would do well to take this into account in their politics. Sadly, they don't, and history repeats.
And on top of that at the end of the day Germany now has this bloc that votes "the wrong way" in all of its elections. Glib analysis though.
The German split was resolved 35 years ago and is still visible. How much time would a reunified Korea take to equalize itself? If you're a person who cares only about the economics of it all, how long do you think it would take for the payoff of unification to occur? Just seems quite long.
Basically people are willing to put up with a lot if their lives are getting better (economic growth). Problem with that is what kind of system of control an authoritarian government can setup in that period of growth.
Then those underdogs take over. They become paranoid about the possibility of being killed themselves, so they repeat the massacres they fought against. A lot of people who supported the new regime think it's just a few remaining enemies being taken out. It won't happen to them. Then the government starts laying out methods to solidify their control. The list of things seen as traitorous and against national interests grows. It becomes a frog in a boiling pot situation. By the time people realize they might be a target, the system is too complicated and widespread to take down alone, and a new generation of youths have been raised knowing only the current system. And to those youths, things are stable. The most terrifying thing to people raised in stability is the idea of losing that stability. So keeping your head down and following the law is much better than absolutely anything else.
And with the absolute control of information that NK has, a significant portion of people really don't even know a better world exists out there. And they're terrified of anyone that even talks about shaking things up.
The realpolitic of international relations very often follows the words of the British prime minister, Lord Palmerston: "We have no eternal allies, and we have no perpetual enemies. Our interests are eternal and perpetual, and those interests it is our duty to follow."
This claim doesn't appear to be true: https://www.reddit.com/r/AskHistorians/comments/1k6yi1z/comm...
And by the time you managed it the falsehood already netted a few dozens/hundreds/thousands more victims in the best case scenario where the rebuttal actually managed to attach itself right next to the falsehood.
Regular folks just can't compete with professional disinformation spreaders and their horde of victims.
after all chinese is the first one that has official military cyber unit (first in the world)
north korean following suit for monetary reason and have as far as Property (Hotel etc) on china mainland to run the operation from there
as for china??? they basically have an "laundry" business that can take dollar from korea in trade of supplies
Now, non-APT actors, if they wanted to up their level of sophistication, might replicate some of these workflows for their own nefarious activities.
There's no way to only give the information to one group without the other group getting their hands on it.
Unfortunately, it quickly turns into a discussion of how bad NK and China are and how China shouldn't support NK (because, again, they're bad).
I'll offer two words to expose the hypocrisy of this: Stuxnet, Pegasus.
> Use of Korean language, OCR targeting of Korean documents, and focus on GPKI systems strongly suggest North Korean origin.
I'm don't follow how needing OCR to read Korean documents points to them being North Korean?
Could also point in the opposite direction of them needing to copy the text for translation.
The OCR still tells us more about the target than the actor, but I guess they are suggesting the choice of target itself is the indicator.
They mentioned this was a pain in the ass, and a very weird restriction since technically any member of the public can ask for a copy of their emails via FOIA.
The article itself says that 100% phishing resistance is impossible. So I stand by my arguement that if you give an idiot a Yubikey, it still doesnt save them from themselves.
>Does this technology eliminate all risk? No. As this becomes widely deployed new attacks will be developed, but it will be MUCH harder for the cyber attacker.
> FIDO is extremely resistant to phishing attacks but adopting FIDO does not mean your organization is secure against phishing.
It's puzzling why the NORC hackers didn't use a nearest neighbor hack rather than leaving a trail of bread crumbs all the way back to Pyongyang ;)
The Russians do this a lot. This kind of attack that they want everyone to know they are being without telling you they are behind it and denying it in all colours.
it could simply be the guy maintains presence there because he has access. NK has no public internet so he might simply enjoy internet access -_- rather than neccesarily be either pretending to be chinese or working for them...