Securelist

There is a lot of independent analysis pointing at North Korea[0][1][2][3]

The infosec industry are extremely skeptical of attribution especially coming from government - it took a long time for a higher-certainty attribution to be established in the Sony and Bangladesh reserve bank cases, and there are still open cases of attribution in other incidents

Along with technical evidence, Wannacry also fits the North Korea m.o of financial incentive but also incentive to sow chaos[12], as well as how their attackers operate in Singapore and China and outsource some components.

On the contrary there is little to no evidence pointing anywhere else - meaning the second best probability of attribution for Wannacry is much further down the list.

The key difference there is that during the Iraq invasion there was zero corroborative evidence, the actual weapons inspectors said there was no evidence.

Further - the USA doesn't need a made-up pretext for war with North Korea. They're technically still at war and North Korea are in violation of UN Security Council resolutions and treaties (they routed around the UN for Iraq)

North Korea has sunk a ship[4], downed an airliner[5], attacked South Korean islands[6], tested nuclear weapons, developed a missile program, fired across the DMZ[7] (as recently again as today[8]), assassinated foreigners on foreign soil[9], been caught attempting to sell weapons of mass destruction[10], sold arms to Syria and others in violation of sanctions[11]…

Rather than having a daily list, I use Feeder (Chrome extension: http://feeder.co/)
to read my RSS feeds, I had always preferred it to Google Reader, I never did get myself into the mantra of checking Reader often (it ended up being once every few months, when I randomly remembered)
; however Feeder is nice in its minimalistic approach, just showing me how many items for each feed, which encourages me to zero it out, although unlike Reader it just shows the titles of RSS feed items, so I end up judging whether or not to read an article based on the title.

A few feeds I follow:

News

* Hacker News - https://news.ycombinator.com/ (https://news.ycombinator.com/rss and https://news.ycombinator.com/bigrss [a lot of the posts are repeated over both, and note these are not necessarily the front page posts, my guess is that they are upvoted new posts, so I end up reading some posts before they reach the front page])

* Phoronix - http://www.phoronix.com/ (http://www.phoronix.com/rss.php)

* ThreatPost - http://threatpost.com/ (http://threatpost.com/feed)

* TheNextWeb - http://thenextweb.com/ (http://feeds2.feedburner.com/thenextweb)

* Wired - http://www.wired.com/ (http://feeds.wired.com/wired/index)

* iClarified - http://www.iclarified.com/ (http://iclarified.com/rss/rss.xml)

* TorrentFreak - https://torrentfreak.com/ (http://feeds.feedburner.com/Torrentfreak)

* r/WorldNews - http://www.reddit.com/r/worldnews (http://www.reddit.com/r/worldnews/.rss)

Blogs

* Securelist -…

> These measures are always marketed as being for security from hackers and more recently also in the name of privacy

That's because they are. The reality is the existence of side-loading and third-party stores on Android contributes directly to the spread of malware on the platform, which is why Google has made it more difficult to do so with each successive release of Android.

According to Nokia's threat intelligence report (https://onestore.nokia.com/asset/205835), Android devices were responsible for 47.15% of malware infections compared to 0.85% from iPhones. (Note that even after scaling for the number of devices there is still an order of magnitude difference.) Windows/PCs at 35.82% and IoT devices at 16.17% make up the rest. That's right, Android has overtaken Windows as the biggest malware vector on the planet.

According to Kaspersky's mobile malware report (https://securelist.com/mobile-malware-evolution-2019/96280/), 13.89% of users in the United States were attacked by mobile malware in 2019. In some other countries the numbers are significantly higher: 21.23% in Brazil, 24.14% in Mexico, 27.36% in Malaysia, 37.98% in India, and 60.64% in Iran. The overwhelming majority of mobile malware targets the Android platform.

If you want to argue that your right to "freedom" over your device is so important to you that you believe the risk of malware is worth the tradeoff, that's one thing, but don't hand-wave away the very real security benefits of strictly…

It's so bad that even some intelligence agency-developed malware gets busted (in part) due to leaky paths and other strings in binaries' metadata.

Here's a leaked CIA Wiki/CMS thread from 2015 discussing some of the fuckups found by Kaspersky in NSA ("Equation Group") malware binaries: https://wikileaks.org/ciav7p1/cms/page_14588809.html

>This is PDB string, right? The PDB path should ALWAYS be stripped (I speak from experience. Ask me about Blackstone some time.). For Visual Studio user mode stuff, the /DEBUG linker switch should NOT be used. For drivers, it's a bit harder to avoid it, but a post-build step using binplace will strip the path information.

>For other strings generally, yeah, search the binary for them. Don't use internal tool names in your code.

Examples from Kaspersky's report (https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf):

>"Timeout waiting for the “canInstallNow” event from the
implant-specific EXE!"

"Implant" is NSA lingo for "persistent malware". Probably best not to include routines for helpful error messages in your production-build nation-state malware code.

>"Manual/DRINKPARSLEY/2008-09-30/10:06:46.468-04:00"

Conspicuous all-caps NSA codename.

>"standalonegrok_2.1.1.1"

"The codename GROK appears in several documents published by Der Spiegel, where “a keylogger” is mentioned. Our analysis indicates EQUATIONGROUP’s GROK plugin is indeed a keylogger on steroids that can perform many other…

I was about to make that connection, this is similar to Brazil's boletos. The difference is that in Brazil it is a standardized system that spans all banks: anyone with a bank account that wants to receive money can have their bank issue a "boleto", which is essentially a barcode that routes money to the destination account. A payer can go to any participating place (post office, convenience store, bank tellers, etc) and surrender cash, which then gets routed through the banking system to the right account.

Which brings us to a potential problem: there has been a tremendous amount of fraud in this system (Brazil's Boletos), with all sorts of malware changing the barcode when it is downloaded in an infected computer to issue a boleto with a different destination account.

Back in 2014 this was well documented by Krebs[1], and at amazing detail by @assolini from Kaspersky[2]. I also documented a specific case that happened to a friend[3]. While it should be possible to mount similar attacks on the Amazon system, having people deposit money into others' accounts, it should be straightforward for Amazon to detect this, since it is a single issuer system...

[1] https://krebsonsecurity.com/2014/07/brazilian-boleto-bandits-bilk-billions/
[2] https://securelist.com/analysis/publications/66591/attacks-against-boletos/
[3] http://cs.brown.edu/~rfonseca/notes/net-bb-dns-poison.html

>if you released a vulnerable piece of hardware, SOMEONE SOMEWHERE will notice

But is that someone somewhere only part of the NSA or its Chinese equivalent?

It makes me think of the TriangleDB iPhone exploit.

I don't think anyone could have realistically known that those MMIO opcodes were there, without being part of the actual CPU design team.

https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/

>The exploit targets Apple A12–A16 Bionic SoCs, targeting unknown MMIO blocks of registers that are located at the following addresses: 0x206040000, 0x206140000, and 0x206150000.

>The prompted me to try something. I checked different device tree files for different devices and different firmware files: no luck. I checked publicly available source code: no luck. I checked the kernel images, kernel extensions, iboot, and coprocessor firmware in search of a direct reference to these addresses: nothing.

>How could it be that that the exploit used MMIOs that were not used by the firmware? How did the attackers find out about them? What peripheral device(s) do these MMIO addresses belong to

I believe it's very easy nowadays to release undetectably vulnerable devices.