In today's roundup of cybersecurity tech news: and you're going to love this, a hacker who
was himself quite literally hacked by North Korean spies has taken it upon himself to
get some revenge.
He "hacked back" North Korea, and yes - "hack back" is the correct technical term for revenge
hacking.
So what kicked all this off?
Well, North Korean government hacking groups have over the past few years been running
a whole array of operations targeting security researchers, ie: white hat hackers.
They'll typically set up fake cybersecurity companies, making them look as legit as possible,
with fake websites, fake research blogs, twitter accounts etc.
Then, on behalf of their non existent company, they'll DM legit security researchers, in
some cases they'll offer them jobs, in other cases they'll ask if they want to collaborate
on research together.
But in either case it always culminates in the researcher being sent malware - which
provides the North Koreans backdoor access to the researcher's computer.
Why?
To gain access to the research that the white hats are working on, such as fresh new vulnerabilities
and exploits that the North Korean spies will then use in their other operations.
Enter, "P4x" - a security researcher who himself fell victim to one of these North Korean operations,
"In late January of 2021, he opened a file sent to him by a "fellow hacker", who had
described it as an exploitation tool.".
But he later became suspicious when he saw a blog post from Google, exposing North Korea's
operation to hack hackers!
After analysing the file was sent, he realised he himself had been pwned by North Korean
spies.
Luckily though he took the right precautions and ran the malware in a virtual machine,
so it was only his VM that was pwned, so not a big deal - but he was still understandably
salty having been a target of North Korean hackers, I mean... who wouldn't be?
To make matters worse, whilst he was contacted by the FBI, they never offered him any support
in gauging the extent of the hack - and in an interview with wired (which I'll link below),
he said he felt like “there [was] really nobody on our side.”.
And so, he decided to take matters into his own hands - in his own words "If they don’t
see we have teeth, it’s just going to keep coming,”
And so in the past week or two headlines have started popping up about "North Korea losing
internet access in suspected DDoS attacks".
Literally all, North Korean websites were under attack - of which there aren't many
by the way.
A North Korean nameserver misconfiguration in 2016 leaked that they have only 28 websites
on the public internet - North Korean websites use the extension '.kp'.
Anyhow, it was kinda just assumed that some government was attacking North Korea, perhaps
in retaliation for recent missile tests?
But no, it was P4x, who is described in Wired's article as an "American man in a T-shirt,
pajama pants, and slippers, sitting in his living room night after night, watching Alien
movies and eating spicy corn snacks".
I can only guess this is wired's interpretation of what a hacker looks like, vivid but not
sure how I feel about that... but anyway.
Instead of blindly launching DDoS attacks, P4x found various vulnerabilities in North
Korean systems, vulnerabilities which are well known about, but ones that North Korean
sys admins just hadn't gotten around to patching.
He didn't go into detail on what these vulnerabilities were because he wasn't too keen on giving
North Korea tips in patching their systems.
But the exploits allowed him to single handedly launch denial of service attacks on North
Korea's infrastructure.
Causing pretty much all North Korean websites to timeout.
P4x said his hack back was equivalent to “a small-to-medium pentest,”, and he was surprised
just how "easy it was to actually have some effect".
However, whatever "effect" this denial of service attack did have was likely minimal.
The attack didn't disrupt North Korea's internal intranet, it only took down their public websites,
and I can't imagine North Korea has a large international audience of people visiting
their propaganda pages for anything other than morbid curiosity.
For example, one website that went down was a North Korean cooking website "cooks.org.kp"
- You won't find any recipes on here, the whole thing is of course a propaganda vehicle,
the website explains how North Korea "pioneered human civilisation" and "has made great strides
in food processing technology", all whilst showing off pictures of - well I'm not sure,
I presume it must be some kind of soup, but it looks like dish water garnished with a
few grains of rice.
I'm sure it tastes a lot better than it looks, but if you're aiming your propaganda cooking
website at an international audience, these dishes aren't the ones you want to stick on
your homepage.
I love Korean food, but somehow they've managed to make it look awful.
Whilst evidently, not much of value was disrupted in North Korea's downtime, many people have
criticised P4x for being reckless.
If North Korea misinterpreted these attacks as being from some Western government then
they might respond disproportionately.
Let's not forget, North Korea has a well known band of hackers in the form of the Lazarus
group, which by the way last year stole 400 million dollars in several crypto heists,
so this is an effective little group, not a bunch you want to piss off.
P4x has also been criticised for potentially messing with Western government operations
- as in, it's quite likely various 3 letter organisations have already scoped out these
North Korean websites.
And given North Korea will now probably have a security review, that might screw up any
ongoing operations against these sites or the infrastructure which underpins them.
Our hacker - P4x - who is staying anonymous, because he is breaking the law here, even
if the target is North Korea - P4x isn't giving up the fight any time soon, he explained that
he's started examining red star OS for juicy exploits, Red Star OS being North Korea's
own operating system.
It's a Linux distro, but with a skin to make it look like MacOS.
I can only imagine it was made by some Linux nerd with an Apple kink.
P4x has also launched a dark web site, the "Funk Project" - with the aim of recruiting
more hacktivists into his anti North Korea crusade.
Now, the "Funk Project" isn't linked to in the original wired article, and I searched
for ages, but couldn't find the site's onion link anywhere, if you have it, please let
me know.
So what do you think about P4x?
A living legend standing up for white hats everywhere and giving North Korea exactly
what they deserve?
Or do you think the party poopers have a point?
That this isn't a smart move, he's poking a hornets nest, and only bad things will come
of this?
Let me know in the comments.
This video is sponsored by Linode, who are giving you $100 worth of free cloud computing.
Linode is a totally customisable cloud hosting platform - whether you’re looking to quickly
spin up a VPN, website or host a kubernetes cluster - Linode has you covered.
If it runs on linux it’ll run on linode.
Linode just announced availability of their NVME block storage, the first alternative
cloud provider to officially support this state of the art hardware.
Linode’s philosophy is to focus on providing all the tools a developer really needs at
competitive prices.
Use the link in the description now to claim your free $100.
Thanks for watching, you know what to do, tickle that notification bell and follow me
on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.