Hacker News Reader

Comment by daenz | Hacker News Reader

> Careful to protect their exploits, the attackers deployed multiple safeguards to make it difficult for security teams to recover any of the stages. These safeguards included:

  * Only serving the iframe at specific times, presumably when they knew an intended target would be visiting the site.
  * In some email campaigns the targets received links with unique IDs. This was potentially used to enforcea one-time-click policy for each link and allow the exploit kit to only be served once.
  * The exploit kit would AES encrypt each stage, including the clients’ responses with a session-specific key.
  * Additional stages were not served if the previous stage failed.

Is this a normal level of sophistication for a CVE?

View on HN

We see some of this with just normal spear phishing against companies. The "single click" thing is reasonably common, it makes things a bit harder to catch as often the clickthrough will change to whatever is being spoofed in the first place. A homophone ycornbinator.com would serve the malware first time, then next time it would send a permanent redirect. Unique IDs you'll see in things like spam SMS, both to work around automated blacklisting, but also to work out who clicked through and who might be a potential mark the next time even if they didn't completely fall for the scam.

Most of what we got was recycled RAT malware with various packers though, it didn't trend towards being particularly interesting because you usually don't need to be to catch people, at least that's my impression. Maybe it's bad toupee fallacy.

I am receiving increased SMS spam past week. Is connected to this exploit? Msgs are all different domains with unique ID appended.

Me too, receiving spam job offers with bit.ly links.

I too saw one of these. Very odd since I was expecting a note about a job.

Don’t reply to those SMS. Your geolocation can be derived from your reply, even a STOP or UNSUBSCRIBE reply.

Can you explain how this works if you don't click any links?

I read about it on HN some months ago. I don’t recall if it was in comments or an article. But I read the info and sources and was convinced enough at the time. I’m sorry I didn’t save the original info. I’ll try some googling “geolocation from SMS” and see what I can find.

Presumably if they have the number to text to, they already roughly know the geolocation for most people, through the area code.

Only in the US (or whole NANP?)

Mobile numbers are non-geographic everywhere else that I know of.

Well, depends. For example, Singapore's numbers are 'non-geographic' in that sense. But Singapore itself is small enough.

Greek here, mobile phones are non-geographic but used to be service provider specific, but even this practice isn't applicable due to number portability.

Landlines used to be geographic but this isn't relevant any more again new to number portability.

I mean non-geographic within the country. As far as I know, the US practice of assigning mobile numbers to 'area codes' is unique.

Yes. I was broadly agreeing with you.

Just saying that some countries are small enough that it's essentially the same.

That’s not what I’m talking about. And since number portability and mobile devices became possible, area codes are mostly irrelevant. For example, I’ve lived 2000 miles from the area code of my phone number for probably 10 years now.

They're not mostly irrelevant. 72% of Americans live in or close to the city that they grew up in. Area code is remarkably accurate.

Here’s the best I could find:

https://stackoverflow.com/questions/18523417/can-i-retrieve-...

(Twilio is awesome by the way)

That information is completely derived from the phone number.

Yes, would like to learn more as well.

Here’s the best I could find:

https://stackoverflow.com/questions/18523417/can-i-retrieve-...

(Twilio is awesome by the way)

Can you provide a pointer showing how this is supposed to work?

Probably not. No signs that this is linked to any mass activity.

Tax time

Hearing Americans regularly complain about SMS and robocall spam still blows my European mind. I haven't received a single spam call or SMS in my life, ever.

Back in the 90s and early 2000s the worst that could happen was, say, texting a commercial number to get a polyphone ringtone, and that actually being a subscription. But obviously that is something you have to initiate first, not something passive.

I live in Germany and I get a lot of spam calls and spam SMS. It's always in waves. Some days I stop answering calls if I don't recognise the number, because its one of these days where Interpol has informwd me already three times that my identity was stolen and I have to give them all my details to fix this ..... They're very patient at Interpol, I keep hanging up on them and they never give up.

When I have a spammer/scammer on the phone (and I actually picked up), I usually just put my phone on mute and stop talking to them. They waste a bit more time that way before they hang up (without more effort from me).

I try to help them out by letting them know that I have been trying to reach them about their car's extended warranty.

That's fun, when you have the time and want to spend it.

Side anecdote, I was taking to some sales people and they mentioned this concept of "ringless voicemails" ugh idk why people have no shame.

I solve that problem by just not having any voicemail box.

If you have your number up on the net somewhere, you will recieve calls. For example that domain registration you did 30 years ago that required a phone number... I got myself a smartphone for the reason I could easily block out of country phonecalls. I haven't had any recent spam calls though, was many years since the last one.

I, in Australia, had never received a spam call or SMS, until two years ago. I now receive several per day. All automatically blocked, but still.

My number was leaked in a particular data breach that actually had nothing to do with me, but a different family member who had all of their contacts vacuumed up before the breach. So from my perspective it was passive.

in india its pretty common for businesses/ orgs to sell number data in bulk which is bought by advetisers.

you can be sure to be bombarded with calls and sms if a students applies for a notify thing or gives their number somewhere outside exam halls or on student help websites.

same for shops asking for mobile numbers.

then there are marketers who randomly call each number, send sms to see what sticks.

the situation is pretty bad i would say because for every careful person who sees through the ruse, there are hundreds who fall for million dollar prizes and kyc scams and all.

people call you and say "we are form bank. main branch. you need to verify your debit card or your account will close". no name of bank, no place of branch, just "from bank. main branch".

Here in Singapore SMS and phone spam comes and goes.

At the moment it's pretty bad with lots of calls from overseas. (People with hilariously un-local accents trying to tell you they are calling from the Ministry of Health of Ministry of Manpower...)

Those overseas callers are faking caller id to look like local numbers.

Thanks for the input. A nit, sorry, but maybe relevant to readers learning a little about anti-phishing: homophones sound the same ('-phone' refers to sound, like telephone) but differ in meaning, such as 'write' and 'right'. I don't know the term for ycombinator.com / ycornbinator.com, which is a real problem, of course.

It's a homoglyph https://en.m.wikipedia.org/wiki/Homoglyph

Typically used via poorly named idn homograph attacks https://en.m.wikipedia.org/wiki/IDN_homograph_attack

Technically ycornbinator.com is just a lookalike.

Homographs look exactly the same.

(And of course "homograph" ["same writing" or "same picture"] is a better name than "homoglyph" ["same carving"].)

That's fair I'm not really one for jargon and whatnot (I think it can actually become less useful if the goal is just to communicate something to a person), but the first line in wiki says:

> a homoglyph is one of two or more graphemes, characters, or glyphs with shapes that appear identical or very similar.

"Very similar" and "two or more" being the key words.

As for homograph I found homoglyph by reading the wiki and it saying homoglyph is more appropriate.

(Insert obligatory "wiki it's not always accurate etc etc"). Overall I'd take either one and personally don't care. Just trying to match what you're saying with what I'm reading and make sense of where the truth is.

> (Insert obligatory "wiki it's not always accurate etc etc"). Overall I'd take either one and personally don't care. Just trying to match what you're saying with what I'm reading and make sense of where the truth is.

Diving in (even if the parent doesn't care :) ):

The last sentence is the real challenge: Meanings depend 100% on writer and reader understandings. If two agree that 'homograph' means 'chicken poop', as long as they're the only ones communicating then 'chicken poop' it is; but if someone else reads it, our language subsystem fails.

Some dictionaries influence meaning by being prescriptive (e.g., American Heritage, IIRC); others report what has been understood by being descriptive (e.g., Oxford). The problem is, Wikipedia is neither: It represents the understandings of a few editors of unknown knowledge; it is neither descriptive nor prescriptive and we quickly get into chicken poop scenarios.

* Homograph, report Merriam-Webster and Oxford, means words with the same spelling but different meanings (or origin or pronunciation), e.g., the bow of a ship and a bow and arrow.

* Homoglyph doesn't appear in Oxford, Merriam-Webster, American Heritage, or any others (per Wordnik and OneLook), except Wiktionary. Wiktionary descriptively traces the word back to 1938 (though maybe with a different meaning in that case) and says it means a glyph with the same or similar appearance but different meaning. That still doesn't define a term for the entire string "ycornbinator.com", only the "rn", but close enough!

There is also 'homeograph' - "A word similar — but not identical — in spelling to another." That seems a better fit for your needs.

> Some dictionaries influence meaning by being prescriptive (e.g., American Heritage, IIRC); others report what has been understood by being descriptive (e.g., Oxford). The problem is, Wikipedia is neither: It represents the understandings of a few editors of unknown knowledge; it is neither descriptive nor prescriptive and we quickly get into chicken poop scenarios.

To be clear: reporting what has been understood still influences meaning. Choice of inclusion moderates spread; definitions are inherently lossy and cannot capture the whole range of nuance; the compiler's understanding can be inaccurate. Lexicography is not a neutral art, no matter your choice of biases. And OED no less "represents the understandings of a few editors of unknown knowledge" than Wikipedia does. With different goals, and to different standards, to be sure, but Gell-Mann amnesia goes hard until you get into the weeds.

> reporting what has been understood still influences meaning. Choice of inclusion moderates spread; definitions are inherently lossy and cannot capture the whole range of nuance; the compiler's understanding can be inaccurate.

I agree and actually had a sentence in the GP that said it, but removed it because it was getting too long. An important point. Also, the Oxford English Dictionary intends to be descriptive and says so, but many readers won't understand that and take it as prescriptive.

> OED no less "represents the understandings of a few editors of unknown knowledge" than Wikipedia does.

The knowledge of OED editors is not unknown but well known and exceptional - the world's leading lexicographers, with the best training and decades of experience. The resources are exceptional: top-notch professional lexicographers, domain experts, databases, teams of volunteers reading and contributing, etc. The definitions are not based on the contemporary understanding of a few people but on over a century of accumulated research, back to the beginning of English, and the understandings of those people, plus it depends on the input of domain experts, editors, etc.

I'm not knocking Wikipedia, which has its value, and the OED is, like every human institution, limited. But beyond that general statement, the quoted sentence doesn't describe the OED at all.

Awesome response. Thanks for taking the time to write it.

I think it’s currently unusual but makes sense as a pretty obvious SOP for an attacker with a specific target set who is sitting on top of a pretty valuable vulnerability (RCE on a fully up to date Chrome in this instance).

They are hard to come buy and building tooling is a long and expensive process on top of everything else.

For CVEs? No. CVEs are awarded for things as (relatively) little as static keys being packaged with APKs.

What is unusual is that NK used a sophisticated attack chain to successfully pwn a hardened industry (notably, fintech).

At this point I think it’s safe to say that NK is a significant competitor to FVEY in terms of cyber warfare capabilities.

I would say this isn’t necessarily unusual for NK. As far as I know, they’re the only nation state actor known to hack for profit and they’ve committed several of the largest cyber bank robberies ever. Nation state actors have an _incredible_ amount of time, resources, and motivation.

Indeed. The amount of skill they've demonstrated as Lazarus (Lazarus Leaks (Vault 7), the Bangladesh Bank Heist, and Dark Seoul) is certainly notable and this seems to fit well within their MO.

Much of it seems like normal ad-tech practice to identify individuals and discourage click-farming. Unique keys sent in an email campaign? Oh my scaaary stuff.

For targeted ones I think it is. The details that emerged around SolarWinds were quite sophisticated in terms of execution, timing, hiding, and cleanup.

Reply on news.ycombinator.com