Jenn Gile 0:00

All right, it is Thursday, September 24th, and oh my goodness, we have so many things to talk about, Paul.

Paul McCarty 0:09

Our list is like warm peace, I swear to God.

Jenn Gile 0:13

It is. I went a little bit nuts. Um, so did you see my notes as well, too? You put notes in. I'll have to check on your notes too.

Paul McCarty 0:21

They're below under the 24th. Sorry.

Jenn Gile 0:24

Okay. Well, I guess I'll scroll a lot. Uh oh, cool. I'll move that up. So, anyway, why don't we start with the thing that's big in the news? Um we learned earlier this week that Shiny Hunters uh is claiming, and it seems to be accurate, that they have uh hacked FBI records, uh, including an FBI jobs website. We're hearing that they also may have uh gotten information on the people in the FBI whose job it is to do, you know, proactive hacking. Um, but the statement that they released on X is uh that they are not looking for money, that this is all about their credibility, and that this traces back to a flash that the FBI released back in May. Um, when I'm trying to remember which LMS this was because we talked about it on the show. There was a a learning management system that was hacked and ransomed back in May. It remind me, was it Canvas?

Paul McCarty 1:37

Yeah, it was Canvas, yeah. Yeah. So Canvas is the is the brand name, and the company name is eludes me right now.

Jenn Gile 1:43

Yeah, I don't remember what the company name was, but essentially what they're saying is they have all this data that they're giving the FBI one week to retract the flash, and if they do so, then they won't release this data. Um wild uh thoughts.

Paul McCarty 2:03

Well, I mean, what can you say about this? Like, I'm gonna try really hard not to say any naughty words because like it's gonna be difficult. Because the first thing I want to say, let's at the top of this is hey shiny hunters, you're about you just effed around, and I think you're gonna find out, right? Let's just start with that. But it here's my second observation: tell me you're not an APT without telling me that you're not an APT, which is like going and picking a fight with the FBI, with the FBI, it's just nuts, and yeah, just like in not like in this whole thing, it's just so it screams out, I'm 17 and I don't understand how the world works, right? That's just what it screams out, and um yeah, I I guess we'll see where this ends up. But I mean, I guess um getting back to the the heart of the it the company is called Instructure. Um they're based in Salt Lake City, Utah. I actually have a contact that that works there who did not, I reached out when they got hacked back in the I didn't hear anything back from them. But um yeah, I mean I think the thing is that they've popped um you know they they've popped the FBI job site, so it's not like they per se.

Jenn Gile 3:17

Hacked the FBI, yeah. They they hacked a system. I believe it was a Citrix or something. Anyway, they exploited a what sounds like a zero day to get into personnel records, which don't get me wrong, are serious, especially for an organization like the FBI.

Paul McCarty 3:38

Yeah, I think they're I think they used what they're claiming is a zero day in PeopleSoft. Um I and and I I also want to say, I want to take the opportunity here, like these PeopleSoft is a great example. This PeopleSoft, WebLogic, all these kind of older, crusty, monolithic monoliths are prime. I just can't say this strongly enough. Are prime for this kind of thing?

Jenn Gile 4:07

They're all full of really old components that are really hard to upgrade without breaking 50,000 things. I mean, when I was working more in the DevOps space, you know, you saw a lot of the cloud migration and what's gonna stay monolithic. And I mean, these are just really old systems, and it's no surprise that there's a vulnerability.

Paul McCarty 4:33

Yeah, exactly. Um, and I think that's where I was going is that you know, enterprise organizations take note. You you know, you spent years building up these crusty, you know, special snowflakes in these monoliths, and they're public-facing, they all have portals, you know, whether it's an HR platform or whether it's you know your your your web platform like WebLogic or something like that, you know, they're connected to the internet, and so bad guys like shiny hunters are gonna attack them. And these particular um platforms are prime, like are just perfect for you know AI chaining bugs, right? So we're gonna see a lot more of this. In fact, we saw, you know, this week, I know I'm jumping off topic already, but we're we saw the Australian government saying that our Medicare system here was hacked as well. Calling it a hack is a little bit of a stretch, but was scraped in a way that the government doesn't like it. But yeah, we're just gonna we're gonna see a lot more of this. So getting back to shiny hunters, um I think they've bitten off more they can chew. Uh, I think they've gotten cocky that they, you know, like 17 year old, 18-year-olds do, that they haven't gotten popped, and now they're gonna they're they're gonna faux.

Jenn Gile 5:50

Yeah, you know, I'm getting a lot of in reading the shiny hunters statement. I shared uh a link to it on X from uh the Dark Web Informer account. Um lots of vibes that sound a lot like the same type of uh attitude and phrasing that we heard from Team PCP earlier in the year. You know, they take offense at being labeled com kids, you know, they they're they're drawing a lot of attention to themselves in a way that doesn't seem wise. Um, so yeah, as you said, mess around and find out. Um, you had a note here in our show notes, shiny hunters versus Klopp. Is that uh something you wanted to get into?

Paul McCarty 6:37

Yeah, really briefly. So basically last week, let's see what is it. No, no, this earlier this week. Um Klopp and Klopp is a ransomware crew or a Russian um uh aligned nation state aligned actor. Um Klopp and Shiny Hunters had a short-lived collab earlier in the year, and they had a falling out, and um Shiny Hunters has compromised um one of the Klopp um websites. And beyond that, they've just like called them out repeatedly on Twitter. I refuse to call it anything but Twitter. Um, and they are dropping names. They've actually used Shiny Hunters, has actually used names, so they've named several threat actors by last name andor handle. I'm not gonna repeat those right here, but you know, you can go and find those yourself. And so, you know, it seems like they're teasing real real life IRL data, Jen, like you know, dropping people's last names in their um uh, you know, Russian actors, uh and and just being super aggressive. And right now, Klopp and they've only made one or two statements in response to that saying, hey, reach out to us, the email we tried using doesn't work, and then shiny hunters came right back and said, You idiot, you blah blah blah. It's just like super combative. So, you know, I mean they obviously don't think that Klopp is can come at them, which I don't think is a smart thing to do. So it's just it's so interesting to see. Shiny Hunters, I suspect, has I mean, they're not a group, right? They're like it's like it's like when I was growing up in Michigan, like white kids pretending to be aligned with like street gangs, right? Like you're not really in a street gang, you're just saying that you're you know Latin kings or whatever, because you can say it, it doesn't mean you actually are. So we're gonna have a lot of that, but I think Shiny Hunters is a real organization, you know, has you know their time is limited.

Jenn Gile 8:38

Yeah. Okay, you also have in the notes uh something about uh WhatsApp Bailey's attacks, and you said you need to make a correction, so uh lay it on us. What have you learned?

Paul McCarty 8:50

Yeah, yeah. Last week I said that the there's so basically there's just all constantly every day, there's these uh these uh typosquats um for a library called Bailey's. Um and then there's uh the the whiskey sockets. And you know, I I understood what they did at some level, but I I made the incorrect assumption that this is attacking WhatsApp payments, and it's not. I took the time, uh I did what I did what every ADHD kid does, which is I went and I was like, I said something, I was like, I don't know if that's exactly true. So I went and verified and you know went really deep. And basically what these libraries do, or sorry, what these attacks are are are trying to do is when you install this library, you think that you're installing the real Bailey's library, which allows you to connect to the WhatsApp um APIs and do legitimate stuff, right? So you're building some app and you want to integrate with WhatsApp and you pull this Bailey's library, this fake one, and you think, or malicious one, and you think that's what it's gonna do. Instead, what it does is it immediately has you follow a number of WhatsApp accounts, and then there's all kinds of things that happen out of this. But most of these attacks, Jen, really are really simplistic. It's just like you basically without doing it yourself, you follow a bunch of things, and you know, they can they can send you to redirects and you know they can kind of find some ways to monetize your access. But in some cases, I've also seen remote access. So they're basically when you install this, you become like a remote, you you become a tool um a pawn of the WhatsApp-based um C2 infrastructure. Um, but the vast majority of it is about followers. So I just want to make that correction, not about parents.

Jenn Gile 10:30

Okay, I'm gonna go ahead and share in the comments a link to our threat reports that are relevant to this in case anybody wants to check those out. Uh next.

Paul McCarty 10:39

I've been using the tag, I've been using, I'm sorry, just to interrupt, I've been using the tag Bailey's.

Jenn Gile 10:44

Okay. Uh next, we released a blog. Was it last week? I think it must have been last week, on a new malware family that you have discovered and documented and uh we teased last week on the show that we've named it Weasel Biscuit. Um, which again, I enjoy. Uh it's fun.

Paul McCarty 11:07

Still laughing about it.

Jenn Gile 11:08

Yeah, it's it's still fun. It's a stripped down beaver tail otter cookie JavaScript self-contained malware. Um, it's interesting because uh what? It doesn't include a rat. Um, it's a lot like thinner than a lot of things that we've seen. Um, so you said you've observed it in 16 NPM packages so far. So it's not like it's um taking off super fast in the way that we've seen, let's say, the null receiver technique taking off, but uh perhaps someone's doing some experimentation right now. I think it's a little bit interesting because with otter cookie, what we saw was let's um consolidate multiple different malware families into one so that this one malware family does more things. Weasel Biscuit goes the other way. It's more simple, it has fewer stages. I think you said it only has three stages. Is that right?

Paul McCarty 12:08

Correct.

Jenn Gile 12:08

Yeah, what do you want to share about it?

Paul McCarty 12:11

Yeah, I think you mentioned just a second ago, I think the most important takeaway from Weasel Biscuit is that it's just evidence of DPRK. Oh, and by the way, uh, you know, we said it was, you know, looked like it was DPRK, but attribution was still a work in progress. I am 90% certain this is DPRK, and there's and there's a couple reasons, you know, why we've attributed that, and some of which we can't talk about. But the reality is that I'm you know I'm pretty sure this is DPRK. So, under that assumption, you know, I think this is evidence of DPRK just innovating and evolving and you know creating new stuff and just you know using the same tools we are, they're figuring out what works and what doesn't. Um and I think what they wanted here is they wanted just a quick, fast smash and grab, you know, info stealer, which by the way, we know for a fact is working. Right, we're not gonna get into details, but we know for a fact this is working. This campaign has victims, um, and the focus on the key logger and the um clipboard stealer is really important. They wanted something that focused on those so they could get access, ongoing access while the process is live, um, you know, to victims' clipboards and their keystrokes. And that's exactly what they built here. It's super stripped down, and as somebody pointed out on LinkedIn, really important point, it just skips a bunch of the things that you know tools look for, security tools like EDR and and and detection, mostly detection, you know, would look for. It doesn't do those things. And so somebody asked me, why would they do something? Why would they build something this stripped down? Well, one, it's fast, two, it does what they want, and three, it bypasses a bunch of the detection we have. I mean, that's a win for them. Yeah, not for us.

Jenn Gile 14:09

That definitely makes a lot of sense. Um, our last two three topics are all kind of uh falling under the same theme. Um, so last week the FBI issued a warning about contagious interview and the DPRK IT workers um scam. Um it is under the code name Waterplum. I did a little digging to see does that mean something? It's just a code name. For whatever reason, that's what they're using to describe contagious interview. It's not like it's a different campaign, it's not like it's being tracked differently. Um, it's a joint warning between the United States as well as agencies from Japan, Australia, Europe, it includes Germany. So uh lots of governments got together. As these warnings tend to be, it's fairly simple. Um, it you know, covers, I would say, things that people who've been looking at this space probably already know. But it's a signal that um, you know, the governments are taking this seriously, that this is a known problem. Um, I took down a couple of things that I think are worth calling out from this. Um first, you know, they talk about contagious interview broadly targeting um or pretending to be from legitimate AI companies, crypto companies, and uh NFT companies. And I didn't even really know NFT companies were still around, but apparently they are. Um I don't play in that space. Um, but you know, understandably they're pretending to be from those types of employers because those types of employers attract certain types of profiles of people. And so the um targets that they're going after, no surprise here, uh individual web developers, engineers, and people who are specializing in cryptocurrency, blockchain, and web three technologies. Um, they have some interesting numbers in the paper. They said that they've attributed uh infection to uh contagious interview uh for 30,000 devices in more than 100 companies, countries. Sorry. So 30,000 devices infected in more than 100 countries. That's a lot. Uh they say that they have uh been able to track that exfiltrated funds and credentials are coming from over 7,000 cryptocurrency wallets. And here was one thing that surprised me. The figure in terms of cryptocurrency assets stolen, in my opinion, sounds really low. Uh, they're saying uh it's the equivalent of about uh $10.7 million of stolen crypto. I mean, we've seen numbers in the billions. So it's a little surprising to me that it was uh in the millions, but you know, it's a very basic report. It may not be all-time figures. Hard to say like what the the asterisks are. Um Paul, it sounds like you want to jump in there for a second.

Paul McCarty 17:30

Yeah, I just want to because like you, I saw that and I thought, what are they what are these guys on? Well, first, you know, they're missing this document. While, you know, I think you and I both felt like it's awesome that that they've come out with this, right? It it kind of helps lend legitimacy to some of the enterprise customers that we talk to that like, oh, what does GPRK do? Well, hey, here's FBI warning you about this thing you probably don't haven't thought about. That aside, um, I think that the 10.71 million dollar thing is just kind of you know, I don't know, them being clueless. Not clueless, that's not the right word, but just you know, being kind of kooky, right?

Jenn Gile 18:07

Because we know for a fact, last year alone, Bybit, one single attack was a big but that wasn't contagious interview, they're talking explicitly about contagious interview here.

Paul McCarty 18:20

Yeah, agreed, but I also don't because they don't, you and I both know they have they're not talking about Pollen Rider, and Pollen Rider is part of the contagious interview, you know, evolution of what contagious interview has become. And so my reason to bring it up by bit is just to say, you know, I don't think they're really looking at the whole scope of this attack surface itself. But anyhow, let's just let them be a little bit kooky.

Jenn Gile 18:43

Well, uh, one thing that I found worth calling out from the paper that was, I wouldn't say new to me, but I don't hear people talking about it, is they said that they have found infrastructure overlap between contagious interview actors and North Korean IT workers. So they said that they're using the same IP addresses when they're accessing laptop farms, uh, using the same cloud sourcing services and applying for positions at the Japanese cryptocurrency exchange. Um, so I think we kind of knew that these groups were coming together. Uh, not a huge surprise that there would be something in common with the same IP addresses. It makes me ask, what else are they reusing? Uh it's an area that we were already looking at, but I think that's a question all researchers should be asking right now is is what's shared.

Paul McCarty 19:40

Well, yeah, and on that point, I think first, I think that egress, they because they like to use Astral VPN, the egress IPs from there's only so many IPs that Astral has total, right? And those numbers, those IP addresses are well defined, so you can go look them up. So, right, they're gonna reuse those. If they continue to use Astral, they'll they'll reuse those. Um uh second, um the um the overlap between IT workers and the stuff that you and I care about is interesting to you and I, but over the last few weeks, we've definitely seen overlap now between clickfix and what clickfix is becoming and all these other variants, right? And classic contagious interviews slash pawn rider. There are, you know, some of the C2 infrastructure are the same, some of the payloads are literally exactly the same. So um, you know, the I think something that we heard generally at at UE is that DPRK is starting like these different groups that used to be kind of separate and isolated by design are starting to work more together, like the uh blue voyant kind of, you know. So because of that, I think it's not surprising that we're seeing now more of this stuff kind of overlap, which is good for us because when we identify an indicator, right, that indicator might be used in clickfix and it might be used in contagious interview and VS Code stuff. So um, you know, it expands the reach of our what we can see.

Jenn Gile 21:09

Yeah, and I mean to the to keep following that train of thought, um shutting down a piece of infrastructure can have more of a blast radius in terms of you know disabling activity if they're sharing infrastructure.

Paul McCarty 21:26

That's a that's a really good point, Jen. Good job for bringing that up. That's a really good point. When we you yeah, well, I'm you said it well. I'm not gonna done.

Jenn Gile 21:35

So let's let's start tearing stuff down. Okay. Uh another report came out on contagious interview. We're on a roll. Uh friend of mine posted this on LinkedIn the other day. They work at Atlassian. They've been working on this. Um, so Atlassian uh released a report of their own internal research on contagious interview. You might ask, why would Atlassian be looking at this? Well, Atlassian owns Bitbucket, which is a competitive. Competitor to GitHub. I think it's a really nice piece of research. I'm going to copy the link into the comments here. And what I'll say is you can read kind of a summarized blog version and then you can download their PDF to PDF something like 40 pages. I think it's definitely worth looking at both, not just the blog. But I want to call this out for a couple of reasons in a positive way. So we get asked a lot every time we're out in the community, why isn't GitHub doing anything about this? So it's really interesting to hear from another vendor, another SCM platform. Atlassian looked at GitHub, GitLab, and Bitbucket. So they were looking at multiple SCMs. Gosh, there's lots of ways to take my opinions on this. First of all, Atlassian is clearly doing something about it, which I think is fantastic. You know, they said in their paper that they're actively working on ways to detect and respond to attempts to abuse their platform. So they claim they've taken down hundreds of contagious interview repositories and accounts, and that they're continuously improving their detections, they're improving their threat hunting, and they've made it easier to report abusive content on Bitbucket. So I think that's nothing but good. Like amazing for them, amazing for Bitbucket users. I think the other part that's worth talking about is we've really only talked about pollen writer and contagious interview on GitHub. And the reason we do that is because it's just so easy to find it. Like not only are the repos public, but you can search and you can just see anything there. You know, that doesn't mean Bitbucket and GitLab aren't seeing contagious interview. And what this report that they shared uh proves is that yes, in fact, these other SCMs do see it also. So you're not safe if you're not using GitHub. I'm sorry, you're not any safer, if that makes sense. Um so they are in those other SCMs, but uh, you know, it's a little bit more hidden. And then the last thing that I would add, uh, reading between the lines on the report, because they don't talk about the Pollenwriter malware. They're really focused on uh the contagious interview repositories, but they've talked about victims infecting other people. And what that sounds like to me is they certainly have seen some indicators that Pollenwriter is in Bitbucket as well as you know, potentially other places.

Paul McCarty 24:46

Yeah, agreed. Um I'm not surprising that Pollenwriter is going to be in all those places because the reality is that you know, in that that text that I shared with you earlier today, the you know, all we've been seeing and reporting on are public repos with exactly. We can only imagine the sheer number, you know, outweighing the public stuff by factors of who knows what, of private repos. Because when PollenRider goes and writes their payload and stuff, they don't go, oh, let me only write it into the public ones. They write it into all of them. And you know, everybody's gonna have way more private repos than they've got public. So to that point, right there, um, you know, I'm not surprising that it's gonna be in Bitbucket and everywhere else. Now, a couple things I do want to say. First, I love the article as well. Sorry, the the blog post from Atlassian. I really I like that they've always been a little bit more responsive and you know, I like their behavior better, but but also too, the problem is much smaller in Bitbucket.

Jenn Gile 25:47

Oh, for sure. It doesn't have the same blast potential that GitHub does. You know, both GitLab and Bitbucket aren't built on uh like a real PLG type of business model, the way that GitLab, uh GitHub is.

Paul McCarty 26:07

Well, yeah, and the oh the specifically the public open source projects, you know, obviously at you know, you're speaking to that point, like 99.9% of them with some ridiculously huge numbers, you know, on GitHub. And so we just get a lot more visibility into GitHub. And you know, frankly, like they they the number of GitHub repos outweighs the other two by factors of who knows what again. I don't have many, I don't have the math in front of me. But to the last point is that yeah, the volume is a lot higher in GitHub, but also to when I find something in Bitbucket, I can reach out to my network in Atlassian and they work on it, like they immediately you know action it. And it's just so frustrating right now. GitHub, I'm talking to you again, that I can only I can only report these as malware, these repos individually. Now, my little hack is that I use one individual repo to report it, but then I put a list of like a thousand in there, which I know you love, but you're not making it easy for me to report these things that are happening in the thousands because you have no bulk API, there's no bulk process. You've chosen to make this very difficult for me to disclose, and so hey, suck it. Um but you know, Atlassian they action it, and that's really important. And I want to make a call. I didn't I didn't ask my friends at last at Lasian if I could drop their names, so I won't, but I do want to speak to them, say thank you that you know for being responsive. I wish I had one quarter of that from the you know from GitHub. Hell, I'd be happy with one tenth of that from GitHub.

Jenn Gile 27:32

Amen. Okay, the last topic is a long one.

Paul McCarty 27:36

Um this is all me.

Jenn Gile 27:41

I made the debatable decision, uh, as the person who runs our social media to open a TikTok account for open source malware. And I did this a while ago. I did it around the same time we started podcasting.

Paul McCarty 27:55

You're welcome, Shina.

Jenn Gile 27:56

Yeah, well, you know, they're not getting anything that we're not already streaming onto the internet, so it's like whatever. Uh and if I can reach more people and educate more people, then I'm good with it. Now, the irony here is I won't use X. So call it what it is. But anyway, I you know had just been kind of posting snippets from our podcast on TikTok. And then uh one or two weeks ago, I decided, you know, I'm gonna record a short tutorial that explains how the tasks uh auto-run function works with a fake font file. And so I picked a random repository, recorded, you know, a little explainer. Uh, anybody who's worked in tech uh who's done explainers, like this is pretty standard stuff where you're like, here's what this thing does. So I talked about the task file, I talked about uh you know the fake font file, I talked about the obfuscated JavaScript, I tossed it up there and um it went viral, which I was not expecting. As of right now, it has over 300,000 views. Uh, it has thousands of likes and comments. And yeah, uh unexpected. But the reason I want to talk about it is because as I was scrolling through the comments uh and ignoring the trash fire that was in some of them, uh I saw some really clear themes. And given that the audience that was engaging with this video included a lot of very obviously developer type people, I thought that these themes would be worth us having a conversation about here because it kind of shows in many ways a lack of understanding of how malware is getting into open source and how developers are consuming it. And so I thought kind of talking about this um, you know, might might be helpful. So I'm not going to take these necessarily in order because there's what, I don't know, eight or nine of them. Um some of them we'll touch on really briefly, and some of them I think we should talk more about. So one area that I saw a lot of questions about was how does this get on my machine in the first place? Uh there was not a lot of understanding that normal development behavior is what exposes developers to Pollenriner. And I don't think there's like a whole lot more to say about that, but it was like, great, but like how do I even ingest this? So I guess Paul, you know, that came as a little bit of a surprise to me. I would have expected going in that people would have understood that forking a repo is how you get this kind of stuff. What do you think?

Paul McCarty 30:54

Yeah, I mean, I think it's kind of like if, you know, you show up to a group of religious purists and you say, hey, this other thing is true, and it doesn't align with their worldview. They're like, that's not possible. And so my crazy Paul metaphor here is that, you know, I think developers aren't, or many software engineers aren't aware of the fact that the source code itself can be dangerous, right? They have to think there's gotta be like a binary. Like, you know, this kind of like gets us back to this all this antivirus history that we have and about how it works, and that's it's kind of influencing their thinking. So, particularly when combined with the fact that they don't understand that VS Code, which you know 76% of them have on their machine and they're using daily, is helping this campaign. So, Microsoft DPRK sends its thanks for allowing auto you know tasks to run. Again, the the the not understanding those two things, Jen, I think is at the heart of this. And it really does, it really and I've seen this for 30 years, you know, trying to work with software engineers around security principles. When you're basically saying to them something that you're doing is insecure, the natural inclination is to respond back with with um kind of anger and combat. Like, no, it's not, you know.

Jenn Gile 32:12

I wouldn't describe this as anger, I would describe it as genuine, like, I don't get it. How does this work?

Paul McCarty 32:18

Well, yeah, so that's a good point. I guess what I'm saying is that they're respond responding back like that. No, that's not possible. How does that work? Because you're calling into question some of these fundamental things that they don't understand, and they're used to being, I've said this about software engineers for a long, long for you know, many, many years, which they create stuff out of nothing, and it's magic, it is the equivalent of magic in the modern world, and they're so used to being, uh, which is great, you know, it's awesome. We create things out of nothing, but when you call into question something they don't understand that's fundamental to how they operate, that's you know, I think that's the problem right there. Interesting. So many of them just don't understand.

Jenn Gile 32:56

I would say there were definitely people in the comments who did understand, but where their understanding stopped was the human behavior part. And so uh I would group this into wouldn't branch protection or sign commits stop this? Uh wouldn't disabling task auto run stop this, wouldn't um not clicking I trust this, you know, repository stop this. And they're right, all of those things would stop this. But maybe bear with me, bear with me. Okay, when your default is you have to opt into those kind of things, it means that the vast majority will not have opted in. And that's the way that both GitHub and VS Code have designed their tools, is many of the things that would reduce your exposure are things you have to know what it does, know how to turn it on. So I'm not gonna like debate like would sign commits totally stop this. But the point is more when you require these things to be opt-in, that's what's making it more dangerous. And I think it's um irresponsible of people to say, uh, oh, well, then it's you know, just stupid humans. You know, we're all this is this is human psychology. We're all stupid, I'm sorry.

Paul McCarty 34:35

Our brain is our brain has been wired to take the easy course whenever we can, right? Because it's time.

Jenn Gile 34:41

Our brain is wired for trust, which is crazy, but our brain is just why like if if you are shown something and asked, Do you trust this? our brains are wired to say, Oh, yeah, I do.

Paul McCarty 34:52

Right? When when all the data, all the experience behind that shows that we shouldn't trust it, our brain goes, Okay, we will. Yeah, I am I so hey Jen, I'm gonna be spicy here, as I like to do, and say, in my experience, when somebody pushes back against me, well, wouldn't sign commits fix this? And I say to them, Well, do you sign your commits? They will often say, Well, sometimes, yeah, right on one of my machines. So they're not even doing it. So they're they're coming back with a thing to to prove that what we're saying is.

Jenn Gile 35:24

Oh, absolutely, they're probably not doing it anyway.

Paul McCarty 35:27

Well, and here's the thing is you very correctly said in your notes, and I think in your your blog post, that you know, just signing your commits, the the bad guy that's on your machine, that just automatically happens. Like the bad guy, DPRK has persistence on the work on the developer's workstation, and so they just push and it rides the successful commit in, unless you use an SSH key and you wrap a password, which many people don't even know you can do, and they won't want they don't want to do it because every time they do uh they commit, it's gonna say, Hey, can you add your password? And they're like, I'm sick of typing my password. But guess what? I do that. Why? Because that's the only way for me to know that somebody on my machine cannot push code as Paul. Boom. So I accept the fact that there's a little bit of latency and a little bit of hassle because of this, and humans need to do that more often and they don't, and that's the problem.

Jenn Gile 36:20

Yeah, well, I posted a second related video because I realized there were a lot of questions about like the git history itself, and so I posted a short video talking about how uh DPRK is you know force pushing and faking git commit history. And uh there was a very um active sub thread about commit hashes and wouldn't commit hashes reveal the fake history? And the the easy answer, the short answer is yes. But like what you said with signed commits, this requires you to look at them, this requires you to save them, this requires someone to have a copy of it. Um I don't think there's a lot more to say there on like, yeah, these are all things that are true, but if they're not part of your process, if they're not, you know, codified into how you write code, then they're not gonna help you.

Paul McCarty 37:20

This is this falls squarely in that bucket I was talking about of things like the well, wouldn't just we're fixing like, well, do you do you track these? Well, no. Okay, then please don't mention it to me again. Thank you.

Jenn Gile 37:30

Yeah. Now, a lot of people replied and were like, Well, this is why I use Vim, which is an alternative to VS Code. Um, and I'm gonna say well, I mean they're not wrong. Um, you know, if you're using something that doesn't use tasks auto-run by default, then sure, you're gonna be safe from that particular attack.

Paul McCarty 37:56

Exactly.

Jenn Gile 37:57

I think using Vim in itself is not like, oh, Vim is more secure. It's more like it's not being targeted and it's not configured that way. If you configured VS Code in a smarter way, it's it's not necessarily worse.

Paul McCarty 38:14

Yeah, it's like saying that you know, a surface to air missile, like if I fly my jet, the surface to air missile and get me. So instead, I'm gonna drive a car because the service, like, you know, the jet is way better. And yeah, as much as I I love Vim, I don't know if VS Code is better than VM, but for the purposes of my metaphor, I'm gonna continue with to say, you know, it's it's just not the right thing, anyhow. Um, I think to your point, like one of the ways that DPRK was was using uh to infect people was was with Git hooks. And in using Vim, everybody uses Git, right? And so you're gonna get infected no matter what IDE you're using. So it's not really you know about well, sure. Like I was talking very specifically about the tasks thing, so like let's not conflate the understanding, yeah, yeah, yeah, it's true, but I'm just saying that like you people saying that using one, you know, there's other attacks that DPRK has that is gonna affect that one. So yeah, it's gonna affect now.

Jenn Gile 39:09

I do want to um talk about something that I'm sure a lot of listeners do have questions about in the same way people in the comments did on this video, and that was um, why doesn't antivirus catch this? And I mean, gosh, I wish antivirus was capable of understanding what code is doing. But the reason your antivirus will not catch uh pollen writer, whether it's the tasks JSON uh, you know, auto-run stuff, whether it's a config file with obfuscated code, whether it's a git hook, is because these are like normal development things that have bad stuff in them. So it's not like uh you know it's not a signal that it can look for in the same way that EDR can't look for it because this is weaponizing the normal way that people write code.

Paul McCarty 40:13

Yeah. Uh oh, my internet's getting I wonder if my internet's getting crappy. Um I think that there are some there are some EDR or AV engines that you know, Kaspersky is a good example of this that is is actively hashing individual JavaScript payload files, which is which is that's the closest this gets, right? And that's not a particularly effective way of detecting this stuff. So um, you know, I do see Kaspersky identifying things, and for example, Virus Total when other you know platforms like CrowdStrike and Sentinel One haven't, but that aside, I'm sorry, friends, for a whole bunch of reasons that we don't have time to talk about today. Um, you know, EDR and AV are not going to be helping you here. This all this stuff looks like normal standard Python or JavaScript processes on your machine. That's not what EDR or AV is built to detect. So, you know, it's like it's just not built for that.

Jenn Gile 41:14

All right. So the last thing I want to talk about, and uh this is a genuinely difficult question. Um I found myself as I was thinking about this question, uh, you know, kind of like the nesting dolls uh metaphor. So the hor part of the question is how do you know that this is North Korea? And my major reaction was, well, if you look at the obfuscated code and you know you look at the malware that's in it and the uh infrastructure that's in it, that's linked to North Korea. But I think a fair question that was asked is right, but how do you know that that belongs to North Korea? So, Paul, you've been looking at this for a couple years. How uh this is not a question I know how to answer. So I genuinely want to know like, how would you tell people that the industry has definitively said we know North Korea is behind this?

Paul McCarty 42:23

Man, that's a whole episode right there. But um, I will try to simplify for the purposes of the conversation. And just to be clear, I'm not an expert on attribution, right? I think the first thing we need to realize is that attribution in a kind of binary-based payload, the kind of traditional historical world, looks different. And so I can understand how some people would say, well, over here in this highly iterative world, how are you able to attribute it to DPRK? Um, and the reality is it's it's you know, it's not really a science. There's you know, some guessing and some, you know, because it's moving fast, you you have to make guesses where you you can't necessarily um you know attribute to a specific IP or what have you, but uh sometimes it's really easy. So, for example, you know, there were indicators, URLs and IP addresses that were used in kind of classic contagious interview um campaigns that were then reused in the early stages of PollenRider, for example, on Tasksjacker.

Jenn Gile 43:23

Well, this comes back to what we talked about half an hour ago about shared infrastructure between the IT workers and contagious interview campaign. At some point, somewhere back in the thread of history, someone was able to attribute a piece of infrastructure or some kind of a signal to North Korea. And I think with the IT workers, it's easier because we have things like language as a tell, uh locations as a tell. Uh, but the IT worker scam hasn't been around forever. So yeah, I mean, the the answer that's not an answer is at some point someone had an indicator that they connected to North Korea, right?

Paul McCarty 44:09

Yeah, I mean, like the the large organizations, you know, uh will attribute some of these components and then you know you base your attribution on the fact that something you found has a shared piece of infrastructure there. But let's be very clear, like the you know, a lot of the most of the DPRK stuff that we look at does not have a shared indicator, URL, IP address, or otherwise, with existing known attributed indicators. Instead, and this is really important, what happens is if you take the time, like open source malware does, to deconstruct the whole thing, what happens is you end up with a payload and a structure in a format and a pattern that matches other known, you know, patterns, right? And that's where, like if we see that it's delivering otter cookie, if we see that it's delivering some of these other kind of components, well, guess what? We use that to connect. Why? Because there's no way that you can attribute all these indicators because they're just too many of them. DPRK is creating hundreds of these things a day, and nobody at Palo Alto or CrowdStrike or any of these organizations are attributing all those indicators. Instead, you look for the patterns and then you say, Hey, this is exactly like all these other ones, therefore, we're gonna say this is DPRK. Is it a science? No, not claiming it's a science, but you know, it works, and that's what we've got.

Jenn Gile 45:29

Yeah. All right. Well, uh, thank you for taking on the hard question. Um, if you want to give us a follow on TikTok, go for it. It's entertaining, if nothing else. Uh and with I'm not there.

Paul McCarty 45:42

Jen will see it, but I won't.

Jenn Gile 45:43

Yeah, yeah, yeah. Uh so Paul, you're in Canberra for B-Sides Canberra. Enjoy the conference. Uh, I hope your training goes amazing. I'm sure it will. Uh remind me, this is the biggest B-sides in Canberra, or I'm sorry, obviously, in Australia.

Paul McCarty 45:59

Oh, it's a bit definitely the biggest in Australia. It is, I think. Well, no, it is. It's officially the biggest in the world. Last year we had 38 people, 3,800 people at Cam B-Sides, which is bigger than both B-Sides San Francisco and Las Vegas. Therefore, it makes it, as far as I know, unless somebody else comes out with a bigger one, it's the biggest one I know about.

Jenn Gile 46:18

Exciting. I'm gonna give one shout out. Uh, the B-side Seattle Conference just opened the CFP. Uh, it's gonna be closing here in about six weeks. Uh, I work with the B Side Seattle Conference. I am not in charge of the CFP. So if you don't like it, don't come yell at me. But please apply for it. Uh, I think it's the best B-Sides. Uh, you come find me.

Paul McCarty 46:44

Not the biggest, but the best, according to Jen. Um, I wish I wish I could put a paper in for the CFP and and come and join y'all, but uh, you know, that's a big trip.

Jenn Gile 46:54

That's a lot of travel.

Paul McCarty 46:55

That's a lot of travel.

Jenn Gile 46:57

All right, everyone. Have a great one. Thanks for sticking around for this extra long episode. Uh, maybe we'll be back to our regular length next week.

Paul McCarty 47:06

Oh, well, we got stuff to talk about. We got stuff to talk about, Jen. Thanks everybody for listening. Appreciate it.

Jenn Gile 47:10

Bye.

Paul McCarty 47:11

See you bye.