Hello world, first up in today's exploration of cyber security tech news, the US has just
put a multimillion dollar bounty on the heads of North Korean hackers through the "rewards
for justice" program.
These guys are well known for being the internet's number 1 cryptocurrency bandits - and now,
if you happen to possess information that can lead to the disruption of their operations,
and are willing to submit it through the US government's dark web site, you could be in
for a $5 million dollar payout.
So, these North Korean crypto crooks usually go by the name "Lazarus group", but to make
matters more complicated they are known by a dozen or so other names.
Now, Lazarus makes regular appearances on this channel, usually for their crypto heists.
And I guess some things never change, because just a few weeks ago in their latest operation
which earned them this new bounty, they stole over $600 million dollars worth of Ethereum
from a blockchain network powering the play-to-earn game "axie infinity", in what turned out to
be only the largest cryptocurrency heist of all time.
The developers of the network claim "All evidence points to this attack being socially engineered,
rather than a technical flaw.", but specific details of that social engineering attack
aren't yet public, in fact, given this is so recent they're still down for maintenance.
This attack alone netted Lazarus more than their entire haul from 2021, which was $400
million dollars made up from various heists.
These guys aren't interested in low level scams, tricking granny out of a couple hundred
dollars through phishing emails, so they can buy a slightly nicer watch.
They're in it to make real money, and not even for themselves - this group plays an
important role in the financing of North Korea's government - and so, they go after only the
juiciest of targets to supplement the other illegal income streams for Kim's regime.
And what happens to the millions, maybe even by the end of this year billions in stolen
crypto?
Well, it's laundered through exchanges before apparently being used to fund North Korea's
nuclear weapons program, at least according to the UN.
And in case you weren't aware, the US isn't too keen on the North Koreans having nuclear
weapons, and hence the $5 million dollar reward, for information on those who attack "financial
institutions and cryptocurrency exchanges around the world, for the benefit of the Government
of North Korea".
And just so we're on the same page, these crypto heists are no small problem, to put
it into perspective, North Korea's government has an estimated budget of only 8 and a half
billion dollars a year, so this single 600 million dollar heist represents 7% of North
Korea's government spending, it's a bit mad.
Also, I found this funny, the US government has made the most needlessly dramatic promotional
video for their new $5 million dollar bounty.
Let's have a watch.
[video] Ever so slightly over produced imo, but I suppose it gets the message across.
Next up, defending against the future of quantum computers has taken another step forward,
with the maintainers of openSSH integrating quantum safe encryption methods to combat
"capture now, decrypt later" attacks.
And if that sentence made no sense to you, I don't blame you, the problem quantum computers
pose is kinda esoteric, but it is super interesting.
The dilemma is, that whilst the encryption methods we use today are pretty good at protecting
against brute force attacks from regular computers - in some cases they're not so great at protecting
against decryption attempts from quantum computers, in particular quantum computers are good at
cracking asymmetric encryption - the kind that uses a public key and private key.
But luckily quantum computers are still not really a thing - I mean, we have them, but
they're kinda experimental and not really useful yet, so, this encryption armageddon
isn't an immediate issue.
However, the worry is that adversaries are currently performing man in the middle attacks
on encrypted communications and storing it for some potentially distant day, possibly
decades down the road, when quantum computers are good enough to break into it.
But, the good news is, things like your credit card information and current netflix password
aren't going to be much use to cybercriminals 10 years down the road.
The threat quantum computers pose is more of a problem for governments because confidential
national security information could still be just as relevant decades down the line.
For example the UK's newly built aircraft carriers will have a lifespan of 50 years
so information relating to those will be valuable into the 2060s.
And so, people in the defence industry are adamant that "National data is currently being
stolen and stored with the intention of decrypting it".
So this brings us to openSSH, this software comes pre installed in pretty much all major
operating systems as the tool of choice for remote shell access, it doesn't need much
of an explainer - if you've ever remotely connected to a raspberry pi via a command
line interface, it was probably through openSSH.
In it's latest release, 9.0 - a new quantum safe encryption method is being layered on
top of the previous method to add a blanket of protection against "capture now, decrypt
later" attacks.
This is really good news because openSSH is probably one of the most ubiquitous tools
in computing.
As always however, there is some controversy, particularly surrounding their chosen encryption
encryption method - primarily because so far there is so far no consensus on industry standard
quantum safe encryption.
But we won't have to wait long for that, because "NIST" - the US government organisation tasked
with deciding on crypto standards is currently running a competition to select which quantum
resistant encryption algorithms we should all use by default.
This competition has been ongoing since 2016, but they'll have decided on the standards
within a couple of years, or at least that's the plan.
This video was made possible by Altium Designer, the world’s number 1 PCB design software.
35 years of innovation and development has gone into this bit of kit, and it really shows.
Nothing else I’ve used comes close to the sheer breadth and depth of features.
If you dabble in PCB design at all, you have to give this a go - the routing engine even
just in of itself is just sublime.
Grab your free trial via the link in the video description.
Anyhow, as always thanks for watching, and I'll see you in the next video, have a good
one.