Hacker News Reader

Comment by dylan604 | Hacker News Reader

help me think like a blackhat. what is the end game for this? attempting to see what knowledge researchers have to be able to detect, circumvent, etc what the "bad guys" are up to? attempting to dox, smear the research(er)?

View on HN

1. Spy on researchers, harvest 0-days before they're published, monetize them (selling 0-days, spreading ransomware, etc), 2. Sell info/research to publish academic research before the victim does, 3. geopolitical leverage, 4. blackmail researchers to get more of the above, 5. use 0-days found by others for global dragnet surveillance, which translates to money and political power, 6. plant (dormant) code in critical infrastructure internationally for geopolitical leverage / future war. 7. inject any code into any repo that the researchers have access to or that the researchers are known to make use of (tools), 8. economic espionage / accesss to high-tech international IP

Just kind of what the NSA does really with the exception of monetizing on ransomware?

Given the crazy shit the CIA has been documented to get up to, and the fact that the NSA has similar lack of oversight of agents in the field, why do you think that there isn't any monetizing on ransomware going on?

I'm thinking they are hoping to find exploits that the security researcher(s) are working on, and may not be known to others (use a 0-day to steal other 0-days).

I'd presume that a decent security researcher's laptop would have much more valuable things on it, compared to Bob the Waiter's laptop.

Educated guess. Grain of salt, etc...

I don't know - I think primary research on these things might be easier than sifting through all the "exhaust" on someone else's laptop to figure out what they've discovered.

yeah although there might be easy things like correspondence on a bug report embargo

On difficult targets this is unlikely to be the case.

Total speculation, but:

> North Korean threat actors used social media sites like X (formerly Twitter) to build rapport with their targets. In one case, they carried on a months-long conversation, attempting to collaborate with a security researcher on topics of mutual interest. After initial contact via X, they moved to an encrypted messaging app such as Signal, WhatsApp or Wire. Once a relationship was developed with a targeted researcher, the threat actors sent a malicious file that contained at least one 0-day in a popular software package.

In the past, actors would release something, watch it spread, and see what reports back. Sometimes detonation would be limited to certain IP ranges or institution types, but broad deployment would quickly put itself on the radar of security researchers and someone would sound the alarm.

I'm thinking this targeted approach works like doctor-shopping: you find the most paranoid people you can and see if you're able to exploit them. If you pull one over on them, then the unsuspecting won't stand a chance. If they do catch on, you run away, iterate on your approach, and try it against another researcher who doesn't know you're making the rounds doing this.

Super common spear phishing in modern times, back a few decades-ish chinese plants would attend military convferences, or would monitor those from the US who went to said conferences, then would "follow-up" with an email talking about how they met and talked about "some program or weapon that person was in the know of" on a superficial level and stroke their ego a bit... then phish them with malware based on that supposed meeting and ego stroking...

I’m pretty sure that ransomware and other tactics that largely end with a significant crypto transfer is their end game. Evidently, they are really good at it - $1.7 billion in 2022.

So anything to slow down the researchers are my guess. Keep the drain open, so to say. Just my two cents.

https://www.cbsnews.com/amp/news/cryptocurrency-hackers-stol...

It states clearly in the article the goal was to acquire debug symbols for Ms, Citrix, and others with the goal of reverse engineering. If you have been following Citrix, their Netscaler product has been the subject of multiple high severity vulnerabilities, and they sit in mission critical networks. From here the most likely move is their most common, ransomware, the proceeds from which they use to fund parts of their military.

That was the stated legitimate purpose of the GetSymbol software by its creators. As far as I understand, this data is freely available and the GetSymbol software makes it easier to download rather than having to go to multiple different websites.

The ultimate purpose of the malware embedded within the GetSymbol software is what is not known.

That was the decoy behind the secondary infection vector, not the motivation.

I'm skeptical given the ms attack involved stealing keys from core dumps

The speculation I've seen is that they're intending to steal someone's research, weaponize it, and using it against their adversaries.

Do you understand why [foreign government] would want to spy on Raytheon, Lockheed, General Dynamics?

Security researchers often have the most access to stuff at big companies.

I don't know about that. I work in security, as a service to customers, but we have a running gag about "the real security people" who give you a phone call if you accidentally step off the path on your work machine.

I don't work in security anymore, but when I did, access tended to be... loose. Outside of security, there hasn't been a single job (of quite a few) where I didn't have root access.

At one of the hosting companies I worked at -- for example -- I was able to download the root password of every linux host and the domain password for every windows host as a proof of concept for a project. Nobody told me to stop but as a courtesy I did end up telling the manager of the internal SOC that it was possible. He was pretty floored. Apparently they setup monitoring for single queries of passwords, but since my queries returned more than one result, it wasn't "caught".

So yeah. Lots of access.

also the research they are doing; I would guess most researchers know of vulnerabilities counter parties would be very interested in weaponizing

Reply on news.ycombinator.com