Hacker News Reader

Comment by imiric | Hacker News Reader

I wonder what the chances are that a security researcher would execute a Windows binary they receive over chat from a rando. This isn't even security 101, just common sense at this point.

If anything, I'm sure it gave researchers a chance to play around with the binary in a secure environment. They wouldn't even need to reverse engineer it, since the source code was made public by the attackers. Good guy black hats!

Speaking of, can someone find the exploit in the linked repository? I'm curious what it does, but can't bother with going through all files. TFA could've linked to it, as well as mention how they determined this project is linked to NK hackers...

View on HN

More often than you'd think.

Young infosec practitioners are encouraged to get certifications, OSCP, eJPT, etc. A lot of these cert mills require that you pwn known boxes. This gives rise to discord servers where you can "help eachother". Some of this help is in the form of binaries or obfuscated source code.

They run it on their pentest job laptop, you know, the one with the SSH keys to their report writing box. They get pwnd, and now DPRK has access to a bunch of US civilian corporate data and weaknesses.

I may have actually witnessed this.

That isn't what they said the threat was; they were sent a document that exploited a 0-day in whatever program reads it.

Ah, I misunderstood, thanks.

> how they determined this project is linked to NK hackers

If they have enough confidence to attribute and not disclose how/why, one can fairly guess they don't want to burn sources or indicators which might still be useful moving forward but likely won't be if disclosed...

> the threat actors sent a malicious file that contained at least one 0-day in a popular software package

i.e. not executables

It became an executable :)

Security 101 is that everyone will fuck up at some point. _Everyone_.

If the security researcher's environment isn't well designed (which absolutely happens, whether it's via budget or inattentiveness,) then the attacker can get to a delicious creamy filling very fast.

I’m not a security researcher but I would definitely do it if they seemed like a decent person who I had totalling to for a while and were running an open source project

Reply on news.ycombinator.com