DPRK IT Workers in Open Source and Freelance Platforms | Hacker News Reader

DPRK IT Workers in Open Source and Freelance Platforms

ketman.org

11 pointsjtraglia8 comments

One risk of open source development and development in public is that anyone can take part, hence appropriate management of merge is key. Therefore automated services without appropriate strategies to mitigate this are probably not useful. I am curious did these contributors actually make any malicious changes?

Author here,

No, they didn't. Not in this case. That's not to say they wouldn't at some point. In some of the previous cases we dealt with, North Koreans were obsessively trying to get write access to CI/CD from the repo owners. They will also try to get your PAT tokens if possible. Similarly, any other access tokens (AWS etc.). We had one case where malicious npm dependency was injected after few months of regular work.

DPRK IT Workers focus is not hacking, it's:

1. Getting paid (The quality of work is variable, sometimes they are not that bad, but most of the time they are basically stubborn junior devs)

2. Then, stealing secrets to exfiltrate to actual DPRK hackers

3. Then, credibility building, so they could return to your co-workers with a job offer or some repository code with an "issue to debug" and force you to open code/attachments.

They will also recommend each other for jobs. If you'll hire one and signal that you want to hire more, they will invite their "friends". In some organizations this can go as high as 3 to 5 DPRK IT Workers for the 10 people team.

Hard to understand - why North Koreans being in open source a problem while Americans not? It wasnt North Korea who killed 1 million in Iraq. Its not North Korea who is protecting and arming Israel as it commits genocide.

If its because of 'authoritarianism', why do we not also designate the US as 'authoritarian' because, regardless of who the Americans vote for, the US keeps committing genocides?

(and no - being able to insult your leaders means nothing if whatever you do cant change the policy)

Americans that lie about their background and then proceed to steal your organization secrets, infect your co-workers and turn your company into a supply chain attack vector - are exactly the same type of the problem.

The thing is, it's somehow mostly (not only) North Koreans utilizing this particular tactics.

PS. They wouldn't allow you this rhetoric, regardless of you being sympathetic with them. It would be allowed only if you embrace the Juche and the Supreme Leader cult in fullest. Otherwise, you're nothing to them, an enemy, you don't deserve the Geneva convention or any of the basic human rights, by the doctrine's definition. The system there is not even like China's "One country, two systems", it's a thing on it's own.

> Americans that lie about their background and then proceed to steal your organization secrets, infect your co-workers and turn your company into a supply chain attack vector - are exactly the same type of the problem.

Like the diplomats and state dept. employees who Hillary Clinton ordered to do corporate spying in a memo, or is that any different...

With all the agents, backdoors, the legal power that the CIA has, why are American developers not a problem? It wasnt North Korea who ran 'rendition flights' or who does corporate spying and persecution. Its the US.

> PS. They wouldn't allow you this rhetoric, regardless of you being sympathetic with them

The US is persecuting those who oppose genocide right now. Those arguments are moot.

> Otherwise, you're nothing to them, an enemy, you don't deserve the Geneva convention or any of the basic human rights, by the doctrine's definition

Those like you who defend the Angloamerican establishment while it commits genocide and persecutes those who oppose it make everything more surreal. The US is doing everything you say right now. Where's the backlash and criticism? Where's the 'concern'?

Reply on news.ycombinator.com