Between Two Nerds: Hackers vs the state

0:03Tom Uren: Hello, everyone. This is Tom Uren. I'm here with The Grugq for another Between Two Nerds. G'day. How are you, Grugq? Finding yourself, Tom? Very well. This week's edition is brought to you by Permiso, which is a cloud identity security platform. Find them at permiso.io. So, spoiler alert, we're going to talk about hacker culture and the state. But I'm going to start with this article that hit us off on this track. And I found it fascinating. It's from the Daily NK, which is a South Korean magazine site that focuses on North Korea. And it talks about, well, the headline is, North Korea busts elite hacking ring inside its own banks.

0:51Tom Uren: So to me, this felt like a reversal of the total normal order of things in that the normal story is that a North Korean hacker steals cryptocurrency to take it for North Korean state coffers. And in this case, it's North Korean hackers steal from the North Korean banks, convert it to cryptocurrency for their own personal gain. so in a way this is not surprising at all you would think that if you've got enough hackers out in the world who are used to stealing from cryptocurrency exchanges you know it makes me think that there must be a lot of siphoning of those funds into rainy day personal accounts there's a couple interesting things here they were veterans from the the reconnaissance general bureau so they had been according to this story cyber operations people so they they're like real hackers they recruited some clever young things from particular universities they built a cryptocurrency trading network stole from two state banks converted it to crypto then converted that back to cash to then get it back into north korea so like so many questions about why you would do this, like why you would not hack somewhere else.

2:13Tom Uren: There's also questions about how much of this is the real story based upon information control and letting out a story that is less bad but suits whoever's purposes. Right. So, I mean, hypothetically, there might not have been the local banks involved with the crypto part. It might have just been people siphoning who got caught. Yeah. Who knows? Yeah. Anyway. But the key thing is that there were hackers. They were hacking something for personal gain inside North Korea and they got caught. Yeah. So that seems like what you'd expect a traditional hacker to do, an old school hacker. I would never say that I was actually in hacker culture.

3:04Tom Uren: so but i've always had this conception that it's and it always comes with the territory right to be a good hacker you need to both understand the rules but also be able to able and willing to test them and break them at times right i mean there's certainly a like a hacker ethos that you have to have like a hacker mindset of if someone says like here's how it works and you start thinking well how would that be implemented how how would it actually work how could that be bypassed like and then you sort of have to test that because you can't like having a like theoretically it should work like this like it's not good for clout to just say like i figured out how to exploit something but i didn't do it because i didn't feel like it i'm very clever but i'm also gutless and wimpy i don't think that goes together so the The take home from this was that, and also from other North Korean hacks, they have people who have that hacker mindset.

4:08Tom Uren: Right. For sure, right? And particularly since they're not hacking based on playbooks or whatever. These are people who are clever enough to come up with new playbooks or new techniques or whatever. Yes. Like they're developing from first principles in many ways. Sort of just like had to happen in the West. they're not going to sans training courses to learn how to do these things these are veterans so they've been around for a while i think the older the more old school you are the more you are uh self-taught more more exploratory right right there's less of a here's how you do this and sort of like here's the thing figure it out you have you have to you have to learn by doing because there's no other way of doing it yeah so we've got hackers there i actually like uh 2022 i came across this report that talked about the north korean smartphone hacking scene and so i remember this um yeah you're talking about it i mean my takeaway from that report was that there's mechanisms on North Korean smartphones that are really big brother coercive control mechanisms.

5:24Tom Uren: So, for example, one of the features of the phones they sell there is that it randomly takes a screenshot of the phone and stores it in a directory where you can see that there's screenshots, but you can't actually view them or delete them. and the idea is that it's just a reminder that yeah we can go back through and see what we're watching you yeah yeah and so one of the motivations for rooting your phone was to be able to delete those screenshots and it wasn't even necessarily so that you could hide what you were doing but because the longer you'd had the phone the more screenshots there would be so if you deleted a whole lot of them it would make it look like your phone was newer and therefore worth more for the second hand market um but again this this the report at the time said that you know only something like 10 of north korean smartphones were rooted and i was like only 10 that's a huge number um and so clearly there were some people that were willing to take that risk and so there's an anti-authoritarian streak there as well.

6:42I wonder if it's even anti-authoritarian so much as you know it's a thing you can do without getting punished because everyone does it and no one gets caught. There's a sort of mindset, right? Like if you were going to delete things on your phone so it looks newer, you're not thinking of the like, oh, screw the man, I'm going to get back at the overbearing big brother, you're going to be like, oh, that's going to add like whatever, 10 % to the 20 % to the price that I can get for this phone. Yeah, of course I'm going to do that. That's normal. That's just like, that's what people do. Yeah. So I did have a few nitpicks with this report in that I just, I think that they didn't have someone who understood hacking consulting with them.

7:22So they, they misunderstood what they were seeing. So, and, and this doesn't detract at all from their findings. It's just some of the ways that they, they framed it was, So, for example, they said that it was amazing that the North Koreans had developed this without access to other hacking tools, like that they'd sort of spontaneously learned how to hack. And that's what everyone had to do. Right. So it's like I don't I don't find it like it's amazing on itself, but it's not like special that it only ever happened once. It's special. I'm like, these people were smart enough to do it, for sure.

8:02Kudos to them. But that's what I would expect. Like, if you get, I mean, they say that this would be, it was in the top university with the computer science students who are working around and doing this. And that's exactly who you would expect, right? People who have these skills and have a problem that's presented to them. Like, here's your phone. It doesn't do what you want it to do. Fix it, right?

8:25Tom Uren: Or in the top university that is the funnel into North Korean overseas hacking. Right? What do you expect them to do? It's like a side project while you're learning how to hack Microsoft or something. I don't know. Right. And so, I mean, it seems to be very much that's exactly what would happen. That's what I would expect. It's like, I left this Petri dish open for a few days, and then when I put it away, it suddenly started growing mold. I don't understand. Like, that's literally what it's supposed to do. And then the other thing is, and this one is much more minor, is that they say, like, the nature of the hacks is notable because they were conducted locally on the device or with a second link device rather than over the network.

9:10And it's like, that's our phones are hacked. Like, the majority of phone hacks for routing are done locally. Like, doing it over the network is, like, that's not what defines hacking. So I think that this is just a misunderstanding that they had. So it's a minor nitpick.

9:27Tom Uren: Yeah, it was occurring in some of North Korea's more advanced computer science universities. And I think they said that university students, maybe 30%, had rooted phones. And so to me, it's entirely consistent. You've got this group of people who you're funneling through there to learn how to hack. they've got enough of the anti-authoritarian verve or vim to do that but then the state has other mechanisms of control to also get them to do what they want them to do which is hack for North Korea and I guess going back to the article the North Korean bank hackers the story ends with talking about how serious the I guess the regime thinks it is or how serious everyone thinks it is it's spread amongst Pyongyang's elite military circles and university communities reportedly cause shock at the scale and audacity of the scheme so officials expect harsh punishment this goes beyond ordinary guilt by association penalties it will be hard for the entire family line to survive so that is like an extreme level of consequence right so i guess they've gone from a place where they would hack banks or hack cryptocurrency exchanges steal vast amounts of money without any consequences whatsoever they've gone back to now your grandparents and your uncles and aunts are going to get killed as well because of association yeah possibly which is now i don't know how much to associate a hacker ethos with their actions, right?

11:14It almost kind of feels like it should be the new hacker ethos of the, like, make money by hacking. Like, there's this hacker ethos that you need to have of the, like, how can I test this system and push boundaries and all that stuff? But very historically, there wasn't really money in it. There's, like, a thing that you did on the side that was just fun. And so there's a lot of, like, you know, exploring and curiosity and all of that.

11:38Tom Uren: How much do you think that is associated with anti-government or anti-authority attitudes? Do you think that they're part and parcel of the thought process? I think it's very fertile ground for that thought process. If you have that mindset already, it's easy to adopt. If that's the way you thought, but then you had to join IBM and start wearing a tie. it's almost ludicrous isn't it yeah it's like you could see it happening to like a very small subset of people but it's just it doesn't really fit with like the the mindset you're supposed to have for that like it works a lot better if you're able to yeah so this is back in the day mindset right this is much this is what we're talking about we're not talking about the hacker types today Yeah.

12:31And so I think the other thing is that just culturally, the way that a lot of the hacking knowledge was disseminated was in the same sort of information channels as these, like they were called anarchist files way back in the day. It was very much an idea of like, you know, independence, screw the man, you know, do your own thing, fight the system. It was very much this counterculture of thinking. And part of screwing the man would be like, get free phone calls. Yeah. Right. Don't pay for this sort of thing. And then that sort of get free phone calls became more of a thing for like technical people to sort of get really excited by and keep playing with.

13:14And then it moved away from the, you know, how to make a bomb in your kitchen, which was part and parcel of that anarchist file thinking. But I think a lot of the like the original cultural, like just anti-authoritarian independence, do your own thing. And to be fair, this was in the West where that's very like the individualistic do your own thing is very like prevalent anyway. way. That's just the way that you're supposed to think. So I think you then add in like all the cyberpunk stuff where it tends to be like this lone hero against the system. Like that's, again, it's like it feeds into that cultural identity that was building at the time of like the hacker is the person against the system.

14:03And that system becomes like, you know, the corporations and the government and all this stuff. So I think that by the time you get to like the 2000s, that's like that is the default culture that you're getting when you're getting hacking is it's just this idea of like the internet is new and free it's separate from all these other things you can be independent and you know apart from all this stuff and then someone showed up and said would you guys like to make a huge amount of money yeah yeah so it does seem that that

14:35Tom Uren: ethos which i agree was a thing um and you sort of see reflections in it still nowadays but it's not the dominant culture it seems like everyone has been subsumed by the ability to actually earn a living so yeah anti-authoritarianism or anti-authority feelings are great but they don't they don't pay the bills it's interesting right because the i remember and this is like maybe 15 years ago 10 15 years ago as we were talking with dave vitel and he was saying he was talking about how china was developing a problem that it didn't anticipate which was that they were making all of these hackers like They're training thousands and thousands and thousands of hackers.

15:27And they're going to then be these very skilled, powerful people in this way. But they're also going to inherit and adopt the natural ethos of the hacker, which is this anti-authoritarian, anti-system sort of thinking. And that's going to be a problem for the state because now they're going to have thousands of people who can do things who are against the system. And I don't think that that's worked out exactly.

15:57Tom Uren: Yeah, so I would say that nowadays the exact same thing has happened in China as has happened in the West where it's a job and you may have those innate rule-questioning tendencies. But again, I think everyone's been focused on making a buck instead of making a statement. and it seems like also in the beginning hacking in China was captured as a nationalist thing. So there's this phenomena of, was it red hackers? Yeah. Is that the term? And I think that the Chinese government did a good job of capturing the sentiment, the anti-authoritarian sentiment, and directing it outside. Right. So in the US it was like, I'm a hacker, screw the government.

16:52And in China it was I'm a hacker, screw the American government. Yes, that's right.

17:01Tom Uren: And I think, you know, that was during that unipolar moment where the US was the sole superpower. And so I think that from a, like it's sort of an interesting contrast, I think, to US, China, North Korea. both China and the US can be focused on the US government because that's the most overweening presence in both their lives. Yeah, and now if it isn't anymore it doesn't really matter because the economic incentive has taken over. Right, yeah. So it was originally almost always for the love of the game rather than for money, right? Right, because there wasn't money. And now it's the opposite. Yes, yes, exactly.

17:44I think it's sort of sad that there isn't as much of the hacking for the love of the game. And in a way, it might be that there's even more of it happening just because there's more people involved. But because overall it is so much bigger that you aren't able to find that community anymore. Because I've seen, like externally to me, it doesn't look like there is. and then I'll meet someone and suddenly find out that they're part of a community that's just doing really cool hacking stuff. They're messing around with things that doesn't show up and be like, oh, wow, that's still going on. That's great.

18:23It's good to know that there's still people doing it for the love of the game.

18:27Tom Uren: I mean, in a way, it feels like some of the AI-enabled hacks that I've read about recently, they're kind of hacking because they think hacking is a good thing to do, and then they're almost as an afterthought trying to figure out how to make money out of it. and so from uh you know the objective internal hacker i have it's like yes you're using ai to hack that's kind of cool and it's like oh it's almost disappointing now why am i doing this right yeah now it's almost disappointing that you're trying to figure out how to make money out of it afterwards it's almost like you feel that you should be doing this mind you they were unemployed some of the examples i was thinking of so they probably are looking for a way to make money so like i feel one of the things that sort of harmed the love of the game angle is bug bounties and you know not to say that they're wrong because i think it's been very very helpful for a lot of people but it made this like if you find a bug in a program like if you do a security audit you find something people would then email the author and be like hi what is like how much will you pay me i found a thing yeah that shouldn't like it feels like that shouldn't be the reason you do things and then if you get really pissed off that he's not going to pay you.

19:39Tom Uren: Right. Because you'd see these little spats, right, where there's like, I did all this work, I founded this thing, he refused to pay me, so now I'm posting it publicly because, you know, screw that guy. And it's like, that feels wrong in a way. It takes away the achievement of figuring out how to break something and just turns it into angst. Right. So I guess what we've seen is that there's a hacker ethos of the sort of like testing boundaries, thinking you found a way of doing something and then proving it because that's sort of part of it. And then that can marry into a culture that can direct that in certain ways.

20:22Like you can take that sort of idea of like finding the problems with the system and overcoming them, fixing problems because it matters so much to you, even though you're not necessarily supposed to be able to do that. But that can become part of a cultural identity. And if that cultural identity is mixed up with sort of other things like this anti-authoritarianism, individual against the corporations in the state and all that stuff. Like I could see how that historically would have been a thing that you'd had to worry about. That hackers, like if you trained hackers, they would become like this and then you'd have unleashed them.

20:59But I wonder if that's sort of, it seems like that's not innate. That was a sort of the directing of energy in that. It was sort of just a cultural thing that happened at that moment uniquely due to those circumstances. And it's not innate to hacker thinking. Right.

21:15Tom Uren: I mean, I kind of agree with Dave Vitell, actually, that I think it is innate. It's just that at that time, 15, 20 years ago, the U.S. was totally dominant. and so it became the natural. If you're against the governing powers, you are against the US government. Yeah, yeah. And in fact, as China rises, we can imagine a day when it is perhaps the dominant power and that in fact all China's hackers will be focused against the Chinese state and less against the US. So I think what's interesting is Germany, for example, has a very, very strong hacker culture. And it's like the ethos of hacking is deeply, deeply ingrained.

22:02So you'll find that there are German hackers who are so upset at the idea of working for the state that they would prefer... If there's one of those conscription things where you can be a conscientious objector and go to jail for the four years, or you could do your four years working for the government, it feels very much like they would take the jail. as the thing. And I think that's one of the reasons that Germany's hacking capabilities, attacking capacity as a state is reduced, is that the people who have those skills are just so anti-authoritarian.

22:40Tom Uren: Right. Yeah. They're far more counterculture. I guess I was just thinking about different state strategies to overcome that. And so I guess the US has become a bit more open about what they actually do. And I think that plus the pay mitigates it to some degree. Not that I think state hackers in the States are particularly well-paid compared to the alternatives. Yeah. The alternative jobs, right? Yeah. I think we've gone over this as well, though. There's a mindset of people who become civil servants. Right. Of the mission and that. So it's, I think they're well compensated in sort of, in monetary like remuneration, but also in terms of like psychic or spiritual or like morale.

23:34Like there's this sort of personal accomplishment thing that you get. So you might, on the outside, you can be very happy that you're making$300 ,000 and you feel good about that. and on the inside you're making$120 ,000, but you're also doing something that's really important. And so that makes up the difference, I assume.

23:53Tom Uren: Yes. Yes, I think it's... $60 ,000 is making up the difference. Well, I think that was the deal, that there was a trade-off between fiscal compensation, money, and also mission. Right. And I think that over time that balance has gone up and down and, you know, it's always a... Wherever it is. Yeah, that was traditionally the deal. I think the Chinese is quite interesting in that it's gone for a totally very free market approach where it's not clear that the people are necessarily doing it for the mission to me from the kind of leaks that I've seen. And it's almost... It's purely mercenary in a way.

24:40Tom Uren: Yeah. Yeah, but it seems like there's such a huge number of people that you can do this low-rent kind of hacking for whatever you get paid. See, I think what the state is doing there is part of the compensation is you're allowed to hack things, which is fun. Like, if you've ever hacked boxes, you know that getting that root prompt is like, it's a huge rush. and so the ability to do this thing that you enjoy doing without fear of the state for example and to actually get paid as well if you do it correctly like i think that that's the sort of compensating factor right and i guess there are it's mission in its own way it's it's mission for its own reward right yes and so they're in a way they're the purest hackers because they're Getting a little bit of pay, but they're still doing it for the love.

25:39Thanks a lot, Tom.

25:40Tom Uren: Thanks, mate.