Slashdot Mirror
North Korean Hackers Infiltrate Chile's ATM Network After Skype Job Interview (zdnet.com)
A Skype call and a gullible employee was all it took for North Korean hackers to infiltrate the computer network of Redbanc, the company that interconnects the ATM infrastructure of all Chilean banks. From a report: Prime suspects behind the hack are a hacker group known as Lazarus Group (or Hidden Cobra), known to have associations to the Pyongyang regime, is one of the most active and dangerous hacking groups around, and known to have targeted banks, financial institutions, and cryptocurrency exchanges in the past years. Lazarus' most recent attack took place at the end of December last year but only came to the public's attention after Chilean Senator Felipe Harboe called out Redbanc on Twitter last week for not disclosing its security breach. The company, which has direct lines into the networks of all Chilean banks, formally admitted to the hack a day later in a message posted on its website, but that announcement didn't include any details about the intrusion. However, a day after Redbanc's admission, an investigation conducted by Chilean tech news site trendTIC revealed that the financial firm was the victim of a serious cyber-attack, and not something that could be easily dismissed. According to reporters, the source of the hack was identified as a LinkedIn ad for a developer position at another company to which one of the Redbanc employees applied.
Just for the record, I had nothing to do with this.
I am not interested in articles about life extension advancements.
It's not "after a skype interview", but rather "after the user opened a malicious executable which compromised the system". How is this newsworthy again?
That was sarcasm, in case anybody didn't get it...
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
This is what you deserve for hiring cheap remote workers.
The title makes it seem as if Skype was the infection vector, but reading the article will tell you it wasn't. The problem, as usual, is stupid people doing stupid things, "during this interview [the Skype call], the Redbanc employee was asked to download, install, and run a file named ApplicationPDF.exe, a program that would help with the recruitment process and generate a standard application form." Yes, Skype is a mess, but it didn't infect the computer system.
North Korea has nothing to gain by doing flippant things like this at this point in time when they're trying to reconcile with the world. This is just malicious attribution most likely carried out by the U.S. to continue throwing wrenches into the work as always.
Also, what could they possibly gain by doing this? Plop out money at some cash dispenser and then send an agent to collect the "booty" and bring it back home? As usual, a "report" with no sense to it.
I read the title, and I was thinking of Chilie's Bar and Grill, (a somewhat popular food chain in the US). I was picturing some early 20 something store manager, just getting tricked by this guy. Then I read a little further realize it was the country.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
trendTIC reports that during this interview, the Redbanc employee was asked to download, install, and run a file named ApplicationPDF.exe, a program that would help with the recruitment process and generate a standard application form.
LOL, what idiots
"known to have associations to the Pyongyang regime" Seriously? If they are operating out of North Korea they are just stooges for that Joffrey wannabe. Get it straight. There is no Pyongyang regime. There is no North Korean government. It's just that piece of slime. Every news report or article that says something like "the North Korean government did or said thus and so" should get the publisher slapped silly. They know his name.
You're not getting it. It's easy to play the "idiots get what they deserve". In practice, someone looking to get a job at a company will lower its guards since he need that job and refusing to follow a stupid company process will likely disqualify them.
And even when interviewing for very "technical" companies, HR folks usually have no clue about security and will put the candidates at risk all the times, so even if you're a security expert, it's really hard to know whether the interviewer is trying to trick you or just bad at security.
I've been asked so many times to provide personal information through unencrypted email, like banking accounts ; this is very common. Every time, I configured a web server with HTTPS and authentication for the HR person to retrieve the documents securely, calling them to give them the password or creating the password to that part of it would be only known by the HR person. Obviously not everyone would do that and I was lucky the HR person managed to retrieve the documents (they were nice and helpful and managed to follow my instructions).
Job interview - social engineering *is* brilliant and really hard to counter.
Just reading the headline, I was thinking if N. Koreans can bypass your security, you're a piece of red meat in the jungle filled with hungry amateur hackers.
It was "EggShell" security, a hard perimiter with no protection once it cracks. Any breach and -everything- is lost.
I am not sure that it counts as any security at all, these days...
If refusing to follow a stupid company process will likely disqualify one from being hired by that company, then one ought be glad that one will not be hired by that company as it is apparent that said company is not one for which one would want to work.
You make a compelling argument but what has this to do with TFA?
Redbanc is an ATM monopolistic corporation owned by the local Banks around here.
“The dropper used to deliver the malware is related to the PowerRatankba, a Microsoft Visual C#/ Basic .NET (v4.0.30319)-compiled executable” ref
.. insert one of China/Russia/Iran/NORK/Venezuela ..or who ever else the deepstate is trying to pick a fight with ..
they ask for your SS# as part of the application and that in it self it is bad.
In Chile the RUT (Unique Identification Number) is not secret. There are third party web sites that find a RUT given your name, and those are not illegal.
This had NOTHING to do with LinkedIn or Skype. The victim was tricked into downloading and installing a sketchy executable, which basically opened the door for the attack. The attackers simply used LinkedIn as the social engineering tool, and Skype was just a word used in the job listing.