North Korea hacked him, so he took down its internet
wired.com
wired.com
But I also am immensely proud that we have people willing to take things into their own hands when needed.
Also, I feel like the 2nd amendment should be interpreted to include the right to bear digital arms (strong encryption for a start). This will probably take another decade to figure out what that would really mean.
https://en.m.wikipedia.org/wiki/Export_of_cryptography_from_...
In the case of NK, they could probably even register a complaint and have it ignored, assuming the effort needed to locate the perp was greater than the fucks given by the appropriate authorities.
Hats off to the author but I would also caution them against broadcasting it publicly. The people who would appreciate this the most probably use secure channels anyway ;)
“Digital arms” are legal to possess in the U.S. as far as I know. Again, that is not the same thing as legalizing any use of them.
Also, don't engage in cyber warfare against other nations because the feds will come down on you harder than your target could hope to[1]. Obviously because it's stupid to put your country at risk.
[1] Unless you live in the US and that country is Israel.
I doubt the NRA would organize a picket to defend your right to run PGP.
I'm not American but if I was and I wanted to limit access to guns, I don't think arguing that the courts should decide the 2nd amendment doesn't actually give the right to bear arms would be the way to go. If you think Americans agree with you and don't actually want that part of the constitution, judicial activism wouldn't be needed.
From the other perspective: gun rights are under constant attack from fearmongering media and I find that bonkers. All it takes is one (1) psycho POS shooting up a school for the media to run a month of coverage claiming that everybody should now lose a fundamental right. Ffs most people agree that criminal activity doesn't justify violating everybodys rights (like police state measures), why is this specifically different? Because the media machine works for a political class that wants a disarmed and castrated electorate.
Theres been a creeping advance against these rights since the 1930s with the NFA passing and gun grabbers have been constantly demanding more for these 100 years with small concessions then larger infringements, racheting toward less gun rights, slowly but surely hellbent on taking away our weapons. Most of this is enabled by bullshit judicial activism that twists 2a for matters of convenience and political ends.
As a non American who doesn’t live in US, I agree with you on this.
I guess most of the non-Americans also don’t care that deeply about your gun laws.
Sometimes we see the incidents and perceive the loss of life to be painful. But this is human nature and it exists in me and you alike.
Sometimes non-Americans might express their opinions on this matter which I believe is fine. Just an opinion. :)
What "pro gun propaganda" is this exactly? Gun access is not getting more relaxed - talk about propaganda. The Federal form you are required to fill out at any gun shop in the country asks you to declare whether you have ever been adjudicated as mentally defective or have ever been confined in a mental institution. Answering Yes will result in your firearm purchase being denied.
We can't know ahead of time that someone is going to go off the deep end and go on a shooting spree. You can't legislate this risk away short of banning guns completely and confiscating all of them, which is unrealistic/impossible. Let's ban alcohol as well because it kills twice as many people as guns do (half of which are suicides) annually.
I'm an independent that shares plenty of the Democrat party's positions, but gun control isn't one of them. Guns are tools than can be used and misused like any other tool.
One point that gets lost about the 2nd Amendment is that it should be considered an inalienable right. Meaning, it cannot be diminished by any law of man. Consequently, most of the gun laws can be viewed as fundamentally unconstitutional, and any attempts to enforce them are illegal.
Of course, this is a highly unpopular opinion, as most of the population has surrendered itself to creeping authoritarianism.
You’ve decided to focus on guns in your comments, but that’s not a distinction that matters to my point.
That doesn't follow. The right to own something does not imply the right to use it.
> One point that gets lost about the 2nd Amendment is that it should be considered an inalienable right. Meaning, it cannot be diminished by any law of man. Consequently, most of the gun laws can be viewed as fundamentally unconstitutional, and any attempts to enforce them are illegal.
The Constitution does not and cannot bestow inalienable rights.
The Bill of Rights was never supposed to bestow rights, just protect them, as per the preface:
>"The Conventions of a number of the States, having at the time of their adopting the Constitution, expressed a desire, in order to prevent misconstruction or abuse of its powers, that further declaratory and restrictive clauses should be added: And as extending the ground of public confidence in the Government, will best ensure the beneficent ends of its institution."
That's like saying "The right to own a pair of pants does not mean you have the right to wear them." or "The right to own that Rembrandt doesn't mean you have the right to look at it". What, if not to use or consume an item, is the purpose of ownership at the fundamental level?
> The Constitution does not and cannot bestow inalienable rights.
You'll be happy to hear it does neither. It recognizes rights that are inherent to human beings and (presumably) limits the ability of the government to infringe on them.
Or even "The right to own a car does not mean that you have the right to drive through red lights".
The fact that you can own something does not mean that you have the right to use it indiscriminately. In this case (if we consider them "digital arms") I don't see how using it for retribution (rather then self defense) would be considered ok.
This is exactly how it works (in the USA) currently. You can legally own a car, yet be unable to drive it legally (if you are not a licensed driver).
And even if you don't have a drivers license it can be perfectly legal to drive your car on your own property (hack your own computers) but not to drive on public roads / private property where the owner has not consented to you driving (hacking someone elses computer without their ok), but if they are ok with it it's perfectly legal (like for instance pentesting). Context matters.
Do you have the right to shoot at someone's house? Do you have the right to fire in a crowded theater? Do you have the right to fire your weapon right next to someone's ear?
Just because you own a gun does mean your use of that gun cannot be restricted by law, indeed severely so. The only issue is to what degree your usage may be curtailed. This is not black and white.
Of course, prosecutors love to double dip with charges, tacking on a weapons charge or two. These extra charges usually result in a far more severe sentence. Again, hard to see the legality of such practices, but this is the status quo that we have today.
Yes, it is most definitely and intentionally illegal. Things don't stop being crimes just because the victims are communists.
Things don't start becoming a crime until laws exist.
http://naenara.com.kp/main/index/en/politics?arg_val=leader3
One crime does not justify another.
The Parties agree to extradite to each other, pursuant to the provisions of this Treaty, persons sought by the authorities in the Requesting State for trial or punishment for extraditable offenses.
https://irp.fas.org/world/uk/extradite.pdf
As I understand it, this was an extension of the original 1972 treaty.
I'm not sure where this comes from, but you're now the second person I see on HN to say this (https://news.ycombinator.com/item?id=29896969). Is this "common knowledge" in the US or something?
Here is what I said the last time:
>> The US and KP are technically still at war (the Korean war stopped with a cease fire, not a treaty) and the US and its allies levy sanctions on them that hurt.
> Technically, I don't think the US and North Korea ever been at war. South Korea and North Korea are technically still at war though, as they signed the treaty with each other, not the US.
The conflict with North Korea ended with an armistice, not a formal treaty. The armistice intended for peace treaty discussions to start 3 months later... and they never really did.
The US, UN Command, and North Korea are still operating under a temporary cease-fire that's now basically 70 years old. (I don't think South Korea even signed the armistice).
somehow, I don't think that those are the people that are being targeted. it's the "elite" who actually have internet access, and can also eat.
those who make the decisions, and those who are friends of those who make the decisions would be the ones affected by the internet being down, not those who can barely eat and obviously don't have internet access.
> acting like they are at war, thus they aren't at war
It matters legally that you are technically at war even if you aren't acting like it. It allows the specific wartime actions.
South Korea this matters and the UN as well. North Korea is actively sanctioned as a result of not being at peace.
> The United States rejected a North Korean proposal to discuss a peace treaty to formally end the Korean War because it did not address denuclearization on the peninsula, the State Department said on Sunday.
2018: https://www.cnn.com/2018/04/27/asia/korean-summit-intl/index...
> Then they signed the Panmunjom Declaration for Peace, Prosperity and Unification on the Korean Peninsula, which commits the two countries to denuclearization and talks to bring a formal end to conflict. It was a startling conclusion to the first meeting between leaders of the two countries in 10 years.
2021: https://www.reuters.com/world/asia-pacific/south-korean-lead...
> "I once again urge the community of nations to mobilize its strengths for the end-of-war declaration on the Korean Peninsula," Moon said in a speech to the annual gathering of the world body.
If you are wondering why this is "common knowledge" in the US it might be because just a few years ago there were questions about whether this state of affairs should be changed. https://www.usatoday.com/story/opinion/2019/02/27/donald-tru...
I'd imagine it is a crime to attack a state that we are in a cease fire with regardless.
Ya, if I were the State Department, if be pissed
I don’t know if it’s illegal per se but it’s definitely a dangerous game. If there are any misunderstandings things like this could lead to retaliation and ultimately armed conflict.
That's the definition of terrorism when it's not "domestic terrorism".
that seems to be standard US foreign policy. it's probably actually worse in reality; where the US even 'intervenes' even if it does have a peace treaty with them. [1]
[1] https://en.wikipedia.org/wiki/United_States_involvement_in_r...
I'm sure this is not new, but to me it is a fascinating concept: the modern era equivalent of Partisan soldiers, conducting cyber warfare in their jammies.
They did manage to induce mess on Belarus railways transporting Russian military equipment to Ukrainian border. It probably stalled, but still didn't prevent Russian military reaching the Ukrainian border through Belarus.
But I wouldn't bet money on the right expanding beyond firearms any time soon, given the glacial pace of constitutional law review.
OTOH, the SCOTUS has achieved a political supermajority and will probably move much faster with policy changes now.
A judge answers the question someone else asks.
They can deny policy based on existing policy.
Would you interpret _that_ as meaning we could only eat eggs for breakfast?
https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
Not sure how that'd interact with 2nd amendment issues (but it did come into conflict with the 1st).
In what state?
I think it is a stupid law though. Imagine if we applied that logic to other constitutionally protected rights. "Anyone who is an unlawful user of or addicted to any controlled substance shall not have the right to vote" or "Anyone who is an unlawful user of or addicted to any controlled substance shall not have the right to due process".
I'm not so sure about that.
Not the same thing at all, because a firearm is directly and irrevocably more dangerous while under the influence of drugs.
You can debate the tradeoff of "right to bear arms" vs "right to regulate arms" (just as voting has gone through lots of regulations, some terrible (black people, women), some OK or debatable (showing proof residence or citizenship somewhere in the process), but it's not obvious simply by analogy to other rights.
While BATF Form 4473 and the Gun Control Act may lead some to conclude that you cannot be "addicted to marijuana" and simultaneously legally possess a firearm, consider that many laws are on the books that would likely be adjudicated unconstitutional. The second amendment concludes with "shall not be infringed", and denying somebody their right to possess a firearm (for any reason) appears to be an infringement of that right, according to the second amendment.
> The 2nd amendment allows for heavy regulation of arms.
I'd be curious to hear what leads you to believe this. The language of the second amendment is clear, and the founder's intentions even more so. If you're developing your view based on the term "well-regulated", go do a bit of research on what that term meant when the Bill of Rights was authored (hint: it's different than what "regulated" is often interpreted to mean in 2022).
> The right of the people to be secure in their persons, papers and effects shall not be violated by unreasonable searches and seizures
I think it is likely North Korea could charge him with a number of crimes that may be extraditable, like cyber "terrorism" (the quotes are necessary, right?) The US has extradited at least one Russian hacker [1] P4X is also likely now featured in intelligence summaries in countries with security treaties with North Korea, like China and Russia. Also, it's possible P4X has violated the Logan Act.
[1] https://www.justice.gov/usao-ma/pr/russian-national-extradit...
The case presented in the article is not at all what the 2nd amendment or any self defense laws are about. This guy was seeking revenge and punishment for an act, not attempting to prevent damage from a imminent threat. The court systems are for dealing with those types of situations. Granted, the court systems wouldn't have helped in this situation, but it's important to make the distinction that this was an attack, not self defense.
Both reasons seem pretty compelling. "Keeping your mouth shut" is such a fundamental rule of opsec that it's hard to take this persons skill/expertise seriously. Why put yourself in a place where you (and your family) have to look over their shoulder for the rest of your life.
It's reckless to go bragging (even under a pseudonym) when your adversary is one of the biggest organized crime networks in the world (masquerading as a country): https://www.bbc.co.uk/programmes/w13xtvg9/episodes/downloads
I applaud the guy for his civil courage, but seriously this just painted a huge target on his back and probably changed his life forever. Hope he is OK and even more so hope he has no family or friends who sure didn't sign up for it.
It's also entirely possible that this action, including the WIRED article and it's high visibility, is part of a broader effort and strategy. In reality we just won't know in this type of situation.
Any casual judgement that talks about how obviously naive this is may be a little too shallow.
Targets (individuals, interior or gapped networks, etc) can be difficult to identify or locate and are even more difficult to get access to. Consider that it may be easier to run an operation where you intentionally pseudo-identify a security researcher engaging in his own attack to draw attention. Better yet, this researcher is known to be in possession of valuable tools, after all, the article says so.
Maybe P4x exists or is a fiction, but either way there's a difficult yet traversable route of information that leads to "his" network. Somewhere there's an encrypted volume that presumably holds his cherished tools and information. But P4x knows that the encryption he's using suffers from undisclosed 0day. In fact, the 0day was developed by P4x et al and released into the wild to be found and used in just this kind of situation. The tools that appear to be protected by researcher P4x are actually compromised themselves, meant to be taken. He schedules an interview with WIRED, he talks shit and trashes NK operations, and plays the cocky and justice hungry hacker trope. He chums the water.
There are countless ways that misdirection and narrative can be layered to draw your adversary into a worldview that is the creation of your own. It's not _just_ floors of camo-clad cyberoperaters phishing management types and looking for document dumps.
Doing that is one thing, and certainly won't increase your personal safety. Doing that and telling the western press to embarrass them is insanely stupid. Kim Jong-un is widely believed to have ordered the assassination of his half-brother. And you want to threaten the infrastructure of his country? Talk about a keyboard warrior.
PBS Frontline's special on the assassination:
https://www.pbs.org/video/north-koreas-deadly-dictator-2pobw...
Frankly, I feel that international relations are going poorly enough without vigilantes poking the bear. And also, I doubt that bringing down their network infrastructure will have the desired effect of them lessening the cyber-attack capabilities.
> In late January of 2021, he opened a file sent to him by a fellow hacker, who had described it as an exploitation tool. Just 24 hours later, he spotted a blog post from Google Threat Analysis Group warning that North Korean hackers were targeting security researchers. Sure enough, when P4x scrutinized the hacking tool he'd received from a stranger, he saw that it contained a backdoor designed to provide a remote foothold on his computer. P4x had opened the file in a virtual machine, digitally quarantining it from the rest of his system. But he was nonetheless shocked and appalled by the realization that he'd been personally targeted by North Korea.
The article specifically states he received it "from a stranger", not a friend, which suggests that he was indeed personally targeted. Yes, it does say "fellow hacker", but again this is obviously not someone he knows because it's a "stranger".
I guess it comes down to your definition of "personally targeted". Sure, this isn't a spearphishing campaign, but according to Google's blog writeup about these events [1], they basically targeted individual researchers:
> The actors have been observed targeting specific security researchers by a novel social engineering method. After establishing initial communications, the actors would ask the targeted researcher if they wanted to collaborate on vulnerability research together...
[1] https://blog.google/threat-analysis-group/new-campaign-targe...
You're amplifying their propaganda.
The whole reason why NK repeatedly tests nuclear and conventional strike capabilities is to power project, get people to the negotiating table, and try to get supplies/food/money from countries in exchange for a halt of testing.
Calling it a "bear" is utilizing the common expression "Don't poke the bear," not an assessment of North Korea's abilities.
[1] - https://www.wired.com/story/eternalblue-leaked-nsa-spy-tool-...
The equivalence is not a false one in my eyes because a cyberattack against a US national’s systems should be seen as an attack on a US national’s property.
https://abcnews.go.com/International/north-koreas-parade-big...
Meanwhile this kid comes in screaming "Leeeeroy Jenkins!" making the North Koreans aware of their shit security.
A parachute attack is different to stealth spy missions...
I imagine you would be told to evacuate if possible but I'm sure the military would prefer you just don't get involved. Civilians should stay out of warfare.
(Of course, there could be deeper ops from the CISA side, but if their only cost is having to lose older vulns, so be it.)
In the extremis they can always bring in the orbital cannons and overwhelm them of course.
Him talking so openly to a major news outlet and warm response of us gov officials point towards that
Wired is!
- Website: http://www.rodong.rep.kp/en/
- Wikipedia: https://en.wikipedia.org/wiki/Rodong_Sinmun
Things are really easy to misinterpret, like when Ukraine's undercover attempt to capture Russian PMC soldiers resulted in Belarus thinking Russia was attempting a coup in Belarus.
---
looselipsinkships
loose lip sink ships
loose lip sinks hips
loose lips ink ships
loose lips inks hips
Warfare falls within the domain of the state, that includes cyberspace. Americans love their vigilantes but this has the potential to be incredibly destructive.
It's no different from the private Russian attacks on American oil infrastructure. Private actors causing tensions between nuclear powers is a bad idea.
Good. I'm sick of foreign policy being determined by spreadsheets that say whether defending ourselves or others will be profitable.
Why is this dubious criminal activity being endorsed as being positive?
Is it wise to endorse criminal activity as positive - depending on what our relation with the victim is?
Can North Korea ask for him to be found and delivered to stand trial there?
Would it be ok for North Korea to find and steal him from his home at night and bring him to trial?
Can North Korea expect that politicians from US to denounce this act as unacceptable?
What does USA intend to do, to stop such acts which are mostly originating from their country?
Attacking a foreign power, or serving a foreign power's military, are both crimes from what I know (am not a lawyer, but cybersecurity tangential).
Specifically, taking out the power affects everyone who lost power, and could be construed as an attack that causes harm to foreign officials. As a result I'd think https://www.law.cornell.edu/uscode/text/18/112 applies. Again, not a lawyer, but the days of hacktivist actions without major retributions have been gone since the early 90s (hackers often get worse sentences than rapists or murderers). It's a different world now, more's the pity. For some background I recommend The Hacker Crackdown (https://www.mit.edu/hacker/hacker.html)
Does NK hire hackers? How is it possible for NK to have competent hackers?
North Korea successfully stole tens of millions by hacking banks via SWIFT between 2015 and 20216 and probably several hundreds of millions in crypto currency in 2021 alone.
https://www.bbc.co.uk/news/business-59990477
NK apparently has a very capable cyber warfare unit and hacking crypto currency wallets/exchanges is a major income for them.
Is it not potentially their mistake in the first place? They opened themselves to becoming exploited via social engineering. And if that is the real reason why, they were not really hacked. So can we stop using the term "hacked" so ambiguously?
He was socially engineered to open a file. It wasn't Abbacada 123, poof your hacked. It was his fault, he opened the file and that makes him foolish of him to "trust" and open a file.
End result, he got himself infected with an exploit.
Imagine someone did that to America in response to the NSA hacking them (read, most of the world's population all the time since the Bush administration).
We celebrate that when it's done to official enemies.
> 'We came, we saw, he died,' she joked. But overthrowing Gadhafi was a humanitarian and strategic debacle that now limits our options on North Korea.
> [Dave Aitel] points out that many of the targeted security researchers likely had significant access to software vulnerabilities, enterprise networks, and the code of widely used tools. That could result, he says, in “the next SolarWinds.”
Yikes.
Curious indeed. But even going on wired to brag about it, I wonder.
> Aitel agrees, though, that the government response to North Korea's campaign has been lacking.
From a certain perspective I'm not surprised: We're accustomed to the US government being hands-off the Internet, going back to the Internet's early idealistic libertarian days, and in the past lacked the technical abilities.
But we need to be surprised: Fraud, scams, theft, damage, hacking, ransoms, etc., etc. are commonplace. The Internet is highly insecure, yet the US government hasn't yet taken responsibility for enforcing the law and protecting the innocent there. It's just crime; it's not a special situation anymore.
But why stop there? Take out the power as well. Contaminate the water. We'll all have a good laugh. No wonder they're building missiles to shoot at us.
This hacker franchise has run its course. Ok it was a fun movie in 1995. But in our modern world what this guy has done is plainly terrorism, probably with a real body count. Not a prank, not hip and not cool. And if it was done to us it would be a clear act of war.
> As rare as it may be for a single pseudonymous hacker to cause an internet blackout on that scale, it's far from clear what real effects the attacks have had on the North Korean government. Only a tiny fraction of North Koreans have access to internet-connected systems to begin with, says Martyn Williams, a researcher for the Stimson Center think tank's North Korea-focused 38 North Project. The vast majority of residents are confined to the country's disconnected intranet. Williams says the dozens of sites P4x has repeatedly taken down are largely used for propaganda and other functions aimed at an international audience.
> While knocking out those sites no doubt presents a nuisance to some regime officials, Williams points out that the hackers who targeted P4x last year—like almost all the country's hackers—are almost certainly based in other countries, such as China. “I would say, if he's going after those people, he's probably directing his attentions to the wrong place,” says Williams. “But if he just wants to annoy North Korea, then he is probably being annoying.”
> For his part, P4x says he would count annoying the regime as a success, and that the vast majority of the country's population that lacks internet access was never his target. “I definitely wanted to affect the people as little as possible and the government as much as possible,” P4x says.
Idiot.