Srsly Risky Biz: Being a North Korean hacker is about to be less fun

0:04James Wilson: Hey everyone, I'm James Wilson and welcome to this week's Seriously Risky Biz. This is our cybersecurity policy and intelligence podcast and it is based on the awesome newsletter that my colleague Tom Uren writes. And you can find Tom's newsletter at our website, risky.biz. It's titled Seriously Risky Business. And not only can you view the newsletter there, but you can also subscribe to it so it lands in your inbox each week. Tom will be along shortly to talk about the newsletter with me, but first a quick thanks to our sponsor, which this week is Permisso. Permisso makes a identity security platform, and I published an interview this week with their CTO, Ian Arle, where we talked about how when you're taking a step back and looking at something like a shiny hunters, you know, an identity-led attack, there's actually a lot of intrusion signals that are just hidden in plain sight.

0:56James Wilson: And Permisso does a great job of creating that single view, stitching together multiple sources to help you spot these things happening and hopefully catch them before they do too much damage. Now, on to Tom's newsletter for this week. He's got two topics. The first one is that being a North Korean hacker is about to become a whole lot less fun. You know, what used to be quite an elite appointment with status and benefits akin to landing that major role at a big Silicon Valley tech company, well, that could be all set to change, and it could end up being very heavily monitored, very heavily restricted, and just not a whole lot of fun.

1:31James Wilson: And this is all due to the theft of funds from North Korea by some former DPRK elite hackers, that is, veterans that are now seemingly going out on their own, but bizarrely have decided to use their talents to steal money from the North Korean government themselves, which, frankly, I don't need to be a cybersecurity policy intelligence expert to tell you is a real bad idea. And the second topic that Tom's got is that cyber war is here, but America is politically unprepared. Now, this builds on our conversation last week about how these Iranian attacks on US water treatment and supply facilities seem to be actually quite a well-calibrated campaign.

2:12James Wilson: They might not have resulted in a huge amount of, you know, actual disruption or harm, but they've certainly seemed to have achieved their strategic game of stirring up some anti-war sentiment amongst folks in the US. And Tom's assertion is here that this could have been avoided. And he doesn't mean by updating the firmware and changing the passwords. What Tom means here, and he talks us through this, is that if you are doing a major military campaign against another country with your sophisticated army, well, you bet you you're going to get some blowback in the form of some cyber retaliation.

2:48James Wilson: And the crazy thing here is that the anti-war sentiment that's been stirred up, that could have been avoided and mitigated by the US being prepared and having a plan that said to their constituents that, hey, we're already working on this. We know what the problem is. Here's the work we've already done. Here's what we're going to do to take care of this. Don't worry, you're in no further risk. And, you know, that quite possibly would have made this just be a complete non-event. But nonetheless, here we are, and it's quite the interesting event. So I'll drop you in here where, going back to the story of North Korea hacking about to be a whole lot less fun, Tom talks about the journey from even sort of early childhood of being selected and being trained to become one of these elite hackers and the status and the benefits that afforded them, but perhaps that is all now about to change, and maybe that's not an altogether bad thing.

3:40James Wilson: Enjoy.

3:41Tom Uren: Actually, it does seem that if you're North Korean, it seems like the hackers, at least in the past, have been viewed as elite military types. And so reporting, which is admittedly quite old, says that if you were selected, they select you when you're young, they do talent identification, they train you up. because your vote's so valuable to the state. They'll do things like move your entire family from regional areas, very poor regional areas, put them up in Pyongyang, good conditions. They get treated and almost pampered. And they've had good conditions. And what's happened recently is that a group of former hackers, former veterans were found to be stealing from North Korea's state bank.

4:39Tom Uren: This is extremely risky, a terrible idea. It seems like the punishments are going to be extreme.

4:47James Wilson: Yeah, the line you used in the newsletter here just gave me a real chill. What was it? The official said it will be hard for the entire family line to survive. Yeah, yeah, yeah. And they're not kidding. No, no, no.

5:00Tom Uren: And it's bad individually for those people who've been caught and their families, it seems like. But it's also a dangerous time for people running that entire enterprise. So North Korea has Reconnaissance General Bureau, which is their intelligence organization that conducts financial cyber hacking. So they've done cryptocurrency thefts, famously, quite a lot of them. something like 60 % of cryptocurrency thefts last year have been pegged to North Korea.

5:33James Wilson: And actually, Tom, that's one aspect I found interesting here, which is that there's so much stolen crypto that moves around by North Korean operatives, yet they've decided to steal funds from the bank. Like, why not just have a little stash of crypto on the side that you then launder? That's something I just couldn't quite square.

5:52Tom Uren: Yeah, yeah. So that is, I think, also interesting. So there's, I think, different moving parts. One part is that these people have traditionally been given a bit more freedom than some other North Koreans who are deployed overseas. So there's quite a few stories from North Korean IT workers. So they're in a different, they work under a different department, but they're kept under extremely strict conditions. All these people are outside of North Korea, maybe not all, but many of them are outside North Korea because of better internet access. and the IT workers are closely surveilled, they're monitored all the time, there's screen monitoring software, they're not allowed to go for walks or limited amount of walks, they're kept in very tight dormitories.

6:39Tom Uren: So it seems like the hackers have had different conditions in the past but the concern is that if you're in the RGB, you're running all these hackers and some of your former hackers have gone rogue, is the spotlight going to turn on you? Are there currently rogue hackers in my organisation? Does that going to make me look bad? And I think it is inevitably going to lead to a tightening of the controls on hackers because did they do that because they've been used to skimming a bit off the side? Is there a culture of doing that kind of thing? Just a bit of moonlighting, a bit of hacking on the side that you hide and squirrel away some funds.

7:28Tom Uren: That would be my concern if I was an official in the RGB. And so there's kind of the cryptocurrency hacking. Those are large, intricate, I'd call them capers, right? They're kind of like, what is it? Ocean's 11 style capers where there's large teams involved doing intricate things that are very tightly orchestrated. I don't think that's the kind of operation where it's possible to go, oh, we're going to steal$6 million. I'll just squirrel a few hundred thousand off to the side. Because it's teamwork and there's a lot of oversight, it's high interest because it is, well, maybe not even$6 million, maybe it's$600 million of cryptocurrency.

8:10James Wilson: But perhaps something like a ransomware campaign where it's like same mechanics, right? Is that more susceptible to the squirrel a little on the side?

8:18Tom Uren: Yeah, I think so. And the reason I think so is that the whole point of ransomware, particularly ransomware as a service, is that it enables skilled individual hackers to get paid for doing hacking. And so it's very much there's an individual who can just do it by themselves. This is what we see with ransomware affiliates. They're not typically working in large teams doing highly complex orchestrated attacks. It's just one person who can follow a playbook, more or less. So there have been at least one North Korean state-sponsored group who has done ransomware. So they have dabbled with creating their own versions.

9:01Tom Uren: And in recent years, they've used a number of different ransomware as a service offerings. And you spoke yesterday about this group, which is unnamed. I think they don't, or they didn't specify which group they think it is. But it was very, very tightly linked to Gunra ransomware. And so I think this is just the sort of thing that it's, if there's going to be moonlighting and hacking for personal gain, that's where it'll be because that's the whole dynamic. That's the point of ransomware as a service.

9:35James Wilson: But do you think that the way that the DPRK thinks about managing, as you said in the newsletter, there's essentially these three different buckets, right? There's the capers that you mentioned. there's the IT workers and then there's ransomware. Is your sense that the response to this will be sort of, I guess, a bit draconian and applied across all of those buckets? Or do you think they're going to realise that actually the capers are not the problem? Let's let them run and let them still be the elite operation that they are. IT workers, as you said, is already heavily restricted. I guess the question is, if there's a government response here that cracks down and makes hacking not cool again, will it focus on just the ransomware aspect of this Or do you think it'll affect the capers, that sort of more elite action as well?

10:17Tom Uren: Yeah, I think if you are seriously concerned about your life, you'll take a portfolio approach to this. So I think it makes sense to crack down on just in general, more technical controls on what your people are doing, more oversight. That 100 % makes sense. and then I think it's possible they might go ransomware we're not into it anymore because it I think it represents high risk I it's hard to know one group it appears that one group has been dabbling in ransomware it definitely has had benefits for the state like they've used stolen cryptocurrency to buy services to hack with so it is fulfilling a state purpose that It seems like pretty strong evidence that it's state directed.

11:08Tom Uren: But I also think that in terms of some of the huge hacks they've carried out, it's small beer. Like it's a sort of middle of the road approach. Like one of the approaches is the very complex, big payoff cryptocurrency hacks. A lot of investment, a lot of return. And the IT worker scam, which has run out of a different department, so I don't know that it will suffer the same thing, and is already tightly controlled, is a broad-based, let's get a little bit of money from a lot of things and just scale it by using less skilled people, people who know how to run Word or interact with IT, but they don't have to be elite hackers.

11:55Tom Uren: And so the ransomware sort of falls in between, so I don't think it brings in the same amount of money. It's kind of useful.

12:02James Wilson: But it almost feels like a why wouldn't we do this? Everyone else is doing it.

12:06Tom Uren: Yeah, yeah. So to me there's a question. I think they'll definitely tighten controls. Will they pull back from an entire business line? I mean only one group appears to be doing it, so maybe they will. But that still remains to be seen. I think fundamentally if you're worried about North Korean hackers, this is probably a good news story because more control is just slower. There's less hacking to be done if you're completing paperwork, you've got getting your manager to sign off on everything. I'm just imagining like the go-to-market plan that has to be put together

12:43James Wilson: for a campaign and bureaucracy is not fun. Yeah, yeah, exactly.

12:48Tom Uren: So I think fundamentally a good story. It'll be interesting to see how visible it is, like what the actual threat intelligence community sees of this in six months or a year.

13:00James Wilson: Well, I think the second order impacts are potentially also quite interesting and potentially beneficial for those that are afraid of, you know, especially these large scale crypto heists, for example, because, you know, what becomes of the elite talent if that elite talent is subjected to conditions that they don't like or they're not happy with? You know, I suspect that would have a chilling effect on people even wanting to pursue, you know, that elite end of, as you said, right, there's, in those three buckets, you've got the IT workers, yeah, they can use Word, great. You've got the ransomware operators, that's increasingly getting easier and easier, especially with ransomware turn the key.

13:37James Wilson: But those heists that happen up in that upper echelon, it's still like the, you know, it's beautiful work. Like, I'm thinking back to things like the, you know, the multi-signing with the JavaScript that had to be implanted just in time. And do you think that we might even see less of that happening because they just can't, if they're overly regulated, they actually disincentivise people from even wanting to skill up to that elite level?

14:01Tom Uren: I think the North Korean state has a lot of levers. So I mentioned right at the beginning that they take their family and put them in nice digs. So I think they've got strong incentives. One interesting thing when I was researching this is that you basically never see North Korean hackers defect. Like there's no public reports of I was a North Korean hacker, here's the conditions I was working under. So it seems like they've got a pretty good wicket. IT workers, you get a number of them defecting because the conditions are terrible and some percentage of people are willing to do that. So it'd be interesting to see if perhaps, depends how draconian those conditions get.

14:47James Wilson: Well, Tom, that's probably a good point to pivot to the next story, but just suffice to say, if there is any elite level DPRK hackers out there that do want to defect and have a chat to us, please reach out, editorial at risky.biz. We would love to have a chat with you. But let's go to the second story, Tom, which is cyber war is here and America is politically unprepared. Now, you and I covered this last week. I very much enjoyed your framing that although these Iranian attacks on these water treatment and water supply plants across the US, they don't amount to much in terms of actual harm or damage or lasting effect in the communities, but they were seemingly perfectly calibrated to elicit just the right sort of anti-war sentiment from the public.

15:31James Wilson: Before we started talking, though, you made a great point here, which is that the fear around cyber in a wartime environment was always the cyber pearl harbor, right? There's this massive thing that's going to rival or equal kinetic impacts. But we're not seeing that. But yet, it does seem to be effective in a particular strategic way. So why don't you talk us through what's happened over the last week since we talked about it and why has it elicited this realization that the U.S. is underprepared?

15:59Tom Uren: Yeah, so last week I wrote about, I guess, the beginning of these attacks, which had struck Minnesotan utilities, water utilities. There was some question about whether it was Iran, like that's where the smart money was. And since then there's been attacks in over a dozen states. So a dozen states responding. The effects have been very, I would say, manageable. Like some places have said you should boil your water. whether that's out of precaution or whether they manage to introduce some risk, I guess, would be the best way to say it. So that's not cyber Pearl Harbor. That is not mass devastation.

16:41Tom Uren: That is not bringing the US to its knees. But it is something that I think if you were politically prepared, you could reduce the impact of it quite a lot. And so in the context of real war, What we've seen over the last several years is that cyber attacks are typically very ephemeral. They have short-term impacts that you can get over. So the best use of them, in my view, has been when particularly the US has combined them with conventional kinetic attacks. So in its attack on Iranian nuclear facilities, there was a cyber element that was useful. It helped facilitate the conventional attack. and also in its kidnapping of President Nicolas Maduro of Venezuela.

17:30Tom Uren: There was, again, a cyber element that was useful. And so it seems that the best way to use cyber is, you know, these really well-done, clever, orchestrated conventional attacks. Now, Iran is not going to launch a conventional attack against the US. It's not going to hack the water supply and combine that with a missile to achieve, you know, synergistic effects. So in fact, I think the main thing that the US should be worried about from Iranian cyber attacks is the political fallout. And that's the sort of thing where you can be prepared and have like a plan on how to respond that doesn't brush away the attack.

18:13Tom Uren: But for example, in these water attacks, the mitigation that CISA has issued is, you know, Don't connect them to the internet. Change passwords and make sure they're good ones. And that's not a high bar, right? That's not a high bar for Iran, and it's not a high bar for CISA either. So I think if there'd been a plan, the right response for the US government would be, yes, we're aware of this. We knew this was a problem. We'd been working on it to fix it. We don't think there'll be any serious impact. It's all under control.

18:50James Wilson: And when I was looking at that section in the newsletter, admittedly, I did sort of challenge what you'd written at first because I thought, well, even if they had rolled out ahead of time, even if they'd done a lot of sort of preparation and I think you said something like a good solid effort to go and remediate these things ahead of time. Because you're right, it's simple stuff. It's like update the firmware, make sure there's a password, it's not the default. And I thought to myself, yeah, but it only takes one PLC they missed. It only takes one water treatment facility to have not got the memo.

19:19James Wilson: So, but I think your point was really sound that you backed that up with, which is that's not the point. The point here is that it's one thing to say, you know, it would have been a much better response to be able to say out of the 2 ,500 PLCs that we have remediated, there was 3 % that were found to have been missed. Those are the ones that have been attacked. Right. And I think that's the point you're trying to make here, right?

19:39Tom Uren: Yeah. Yeah. It's all about the communications. So I think, and I think that is, well, I think that is what cyber war is going to be like, right? If you bomb someone, there's a fair chance they'll respond with some sort of cyber response. And I think the evidence is that it's, you know, even the most damaging attacks are relatively short term. They're not cyber Pearl Harbor. And it's really about how you respond to that attack from a political point of view. It's about emergency management, communicating, crisis management. it's not necessarily I don't think about making your critical infrastructure impregnable because that's not going to happen anytime soon there will always be some way to get through but sort of conversely I guess the flip side of that is that adversaries will be looking at your critical infrastructure to try and get some sort of mileage out of it.

20:38James Wilson: Yeah so are you saying that even if there'd been sort of a broad spectrum campaign to tidy up the water, maybe they just pivot to energy. Maybe there's other pockets of critical infrastructure.

20:48Tom Uren: There will always be something for a long, long time to come because there's a lot of stuff now. But I think it's about communicating how you're dealing with it. Yeah.

21:02James Wilson: Well, and that's a point well made. It's not going to be Cyber Pearl Harbor. we're going to see seems like an endless amount of cyber mosquitoes, for lack of a better analogy here. But Tom, there was one person in the US administration who was very well prepared to deal with this and knew exactly who was at fault. And we can't leave this without commenting on that. Please. So tell us about President Trump's response here.

21:28Tom Uren: Yeah. So President Trump, when he was asked about the Minnesota attacks, He actually just blamed Minnesotan officials, said they were incompetent. I think that is kind of an own goal because it allows political opponents to say, this is just a stupid thing to say. It's clearly Iran. And I think a prepared response would just diffuse the whole situation. Yeah. That would be the goal of a prepared response anyway. where it's like, yeah, we knew about it. It was impossible to fix everything. You come up with some story about how you had a plan and you did the best you could and it's all under control, not a problem.

22:14James Wilson: Yeah, you're not at further risk because that's the thing that people get worried about most and turns this into anti-war sentiment. You're not at risk. We've got this. We've got this covered. Now let us get back to fighting that war I think is how this should have gone. But I love your summary of it that it was some pretty bonkers politics And Tom, I think on that note, I'll say thank you so much for another awesome newsletter. And I look forward to whatever Bonker Politics comes up next week.

22:37Tom Uren: Yeah, fun times. Thanks, James.