Hacker News Reader

Everyone seems too focused on source IP address which any solid IT person can tell you can be hijacked. Even the phone home IPs can be obfuscated but it seems awfully suspicious they all belong to net blocks going to NK if I'm understanding things.

View on HN

But according to this, all the phone home addresses are generic open proxies that have been well publicised across the Internet and already abused for quite some time. None of the proxies listed appear to be in NK, and (to date) no evidence that NK IP addresses were on the other end of those proxies at the time.

It's a bit like saying "the attackers used malware which made DNS queries via the IP address 8.8.8.8, which has been used by NK in the past" - if anyone were really building a case on that key evidence, they should prepare to be laughed at.

Thanks @jamesbrownuhh where did you get that detail about the phone home proxies?

Reply on news.ycombinator.com