Hacker News Reader

Comment by mrkstu | Hacker News Reader

I would imagine the intelligence services aren't happy he's providing them free pen-test services. He's taking potential tools out of their toolbox when they may need/want them in a future time of conflict.

View on HN

So if the reds start parachuting down over your community you should just sit pretty lest you interfere with your military’s operations?

The equivalence is not a false one in my eyes because a cyberattack against a US national’s systems should be seen as an attack on a US national’s property.

If they send a small aircraft onto your territory you shouldn't light it up with all your SAMs and take it down, because that will allow them to locate your SAMs for SEAD.

So that guy downloaded some random "hacking tool" a friend of his found, and no shit it had a backdoor. He was never directly targeted by the North Koreans.

NK did personally target security researchers for compromise. See the TAG post referenced inTFA.

Wow, the 'Reds' is a term which I had not seen in a while, feels like I'm watching an early 80's cold war movie.

I can see where the reference comes from, there isn't all that much to pick if you want to use a color:

https://abcnews.go.com/International/north-koreas-parade-big...

Maybe the CIA/NSA were all over inside the North Korean networks, thanks to the weak security, monitoring their emails (do they use emails?) or probably even inside their mobile networks monitoring the North Korean elites' texts to each other.

Meanwhile this kid comes in screaming "Leeeeroy Jenkins!" making the North Koreans aware of their shit security.

A parachute attack is different to stealth spy missions...

>So if the reds start parachuting down over your community you should just sit pretty lest you interfere with your military’s operations?

I imagine you would be told to evacuate if possible but I'm sure the military would prefer you just don't get involved. Civilians should stay out of warfare.

The article says he’s exploiting known (ancient) vulnerabilities

Yes, he's exhausting their quiver of easy/cheap and instead they'd be forced to waste zero days right up front.

Well, if they're not going to use them to find and shut down the NK hackers, then they should step aside for those who will.

(Of course, there could be deeper ops from the CISA side, but if their only cost is having to lose older vulns, so be it.)

The difference of course being, is that they don't want to shut them down during a time of relative peace. Getting them to harden their presence now is strategically a waste.

In the extremis they can always bring in the orbital cannons and overwhelm them of course.

At this point I would assume that foreign states have malware hooked deep enough into all the systems that the only way to eradicate them would be with an incinerator. Plus even after (if?) they update their software I doubt you’d need zero days to get back in. Im interested to see what the upgrade path is for the Red Star OS is though lol

Reply on news.ycombinator.com