Loading summary
Transcript80 lines
- [00:03]
A
Hello everyone, this is Tom Uren. I'm here with the Gruk for another between two nerds. G'. Day. How are you, Gruk?
- [00:10]
B
Fine. And yourself, Tom?
- [00:11]
A
Very well. This week's edition is brought to you by Permiso, which is a cloud identity security platform. Find them at permiso IO. So, spoiler alert. We're going to talk about hacker culture and the state, but I'm going to start with this article that hit us off on this track and I found it fascinating. It's from the Daily nk, which is a South Korean magazine site that focuses on North Korea and it talks about. Well, the headline is North Korea Busts Elite Hacking Ring inside Its Own Banks. So to me, this felt like a reversal of the total normal order of things, in that the normal story is that a North Korean hacker steals cryptocurrency to take it for North Korean state coffers. And in this case it's North Korean hackers steal from the North Korean banks, convert it to cryptocurrency for their own personal gain. So in a way, this is not surprising at all. You would think that if you've got enough hackers out in the world who are used to stealing from cryptocurrency exchanges, you know, it makes me think that there must be a lot of siphoning of those funds into rainy day personal accounts. There's a couple interesting things here. They were veterans from the Reconnaissance General Bureau, so they had been, according to the story, cyber operations people. So they're like real hackers. They recruited some clever young things from particular universities, they built a cryptocurrency trading network, stole from two state banks, converted it to crypto, then converted that back to cash to then get it back into North Korea. So, like so many questions about why you would do this, like why you would not hack somewhere else. There's also questions about how much of this is the real story, based upon information control and letting out a story that is less bad, but suits whoever's purposes.
- [02:29]
B
Right. So, I mean, hypothetically, there might not have been the local banks involved with the crypto part. It might have just been people siphoning who got caught. Yeah, who knows? Or.
- [02:42]
A
Yeah.
- [02:43]
B
Anyway, but the key thing is that there were hackers, they were hacking something for personal gain inside North Korea and they got caught.
- [02:51]
A
Yeah. So that seems like what you'd expect a traditional hacker to do, an old school hacker. I would never say that I was actually in hacker culture, so. But I've always had this conception that it's. And it always Comes with the territory. Right. To be a good hacker, you need to both understand the rules, but also be able to. Able and willing to test them and break them at times.
- [03:20]
B
Right. I mean, there's certainly a like a hacker ethos that you have to have like a hacker mindset of. If someone says like, here's how it works and you start thinking, well, how would that be implemented? How would it actually work? How could that be bypassed? Like, and then you sort of have to test that because you can't like having a, like, theoretically it should work like this. Like, it's not good for clout to just say, like, I figured out how to exploit something, but I didn't do it because I didn't feel like it.
- [03:51]
A
I'm very clever, but I'm also gutless and wimpy. I don't think that goes together. So the take home from this was that and also from other North Korean hacks. They have people who have that hacker mindset for sure. Right. And particularly since they're not hacking based on Playbooks or whatever, these are people who are clever enough to come up with new Playbooks or new techniques or whatever.
- [04:20]
B
Yes. Like they're developing from first principles in many ways. Sort of just like had to happen in the West. They're not going to sans training courses to learn how to do these things.
- [04:34]
A
These are veterans. So they've been around for a while. I think the older, the more old school you are, the more you are self taught, more exploratory.
- [04:46]
B
Right, right. There's less of a here's how you do this and sort of like, here's the thing, figure it out. You have to learn by doing because there's no other way of doing it.
- [04:55]
A
Yeah. So we've got hackers there. I actually like 2022, I came across this report that talked about the North Korean smartphone hacking scene.
- [05:08]
B
And so I remember this. Yeah, you're talking about it.
- [05:13]
A
I mean, my takeaway from that report was that there's mechanisms on North Korean smartphones that are really Big brother coercive control mechanisms. So for example, one of the features of the phones they sell there is that it randomly takes a screenshot of the phone and stores it in a directory where you can see that there's screenshots, but you can't actually view them or delete them. And the idea is that it's just a reminder that, yeah, we can go back through and see what you.
- [05:48]
B
We're watching you.
- [05:49]
A
Yeah, yeah. And so one of the motivations for rooting your phone was to be able to delete those screenshots. And it wasn't even necessarily so that you could hide what you were doing, but because the longer you'd had the phone, the more screenshots there would be. So if you deleted a whole lot of them, it would make it look like your phone was newer and therefore worth more for the secondhand market. But again, the report at the time said that only something like 10% of North Korean smartphones were rooted. And I was like, only 10%, that's a huge number. And so clearly there were some people that were willing to take that risk. And so there's an anti authoritarian streak there as well.
- [06:42]
B
I wonder if it's even anti authoritarian so much as, you know, it's a thing you can do without getting punished because everyone does it and no one gets caught. We, it's the sort of mindset, right? Like if you were going to delete things on your phone so it looks newer, you're not thinking of the like, oh, screw the man, you know, I'm going to get back at the overbearing big brother. You're going to be like, oh, that's going to add like whatever, 10%, the 20% to the price that I can get for this phone. Yeah, of course I'm going to do that. That's normal. That's just like, that's what people do. Yeah. So I did have a few nitpicks with this report and that I just, I think that they didn't have someone who understood hacking consulting with them, so they, they misunderstood what they were seeing. So, and this doesn't detract at all from their findings. It's just some of the ways that they framed it was so, for example, they said that it was amazing that the North Koreans had developed this without access to other hacking tools like that. They sort of spontaneously learned how to hack and that's what everyone had to do. Right? So it's right. Like I, I don't, I don't find it like it's amazing on itself, but it's not like special that it only ever happened once. It's special. Like these people were smart enough to do it for sure, you know, kudos to them, but that's what I would expect. Like if you get, I mean, they say that this would be, it was in the top university with the computer science students who were mucking around and doing this. And that's exactly who you would expect, right. People who have these skills and have a problem that's presented to them like here's your phone. It doesn't do what you want it to do. Fix it. Right.
- [08:25]
A
Or in the top university. That is the funnel into North Korean overseas hacking.
- [08:34]
B
Right. What do you expect them to do?
- [08:36]
A
It's like a side project while you're learning how to hack Microsoft or something. I don't know.
- [08:43]
B
Right. And so I mean it seems to be very much. That's exactly what would happen. That's what I would expect. It's like I left this petri dish open for a few days and then when I put it away it suddenly started growing mold. I don't understand. Yeah, like that's literally what it's supposed to do. And then the other thing is, and this one is much more minor is that they say like the nature of the hacks is notable because they were conducted locally on the device or with a second link device rather than over the network. And it's like that's our phones are hacked. Like the majority of phone hacks for routing are done locally. Doing it over the network is. That's not what defines hacking. So I think that this is just a misunderstanding that they had. So it's a minor nitpick, but
- [09:28]
A
yeah, it was occurring in some of North Korea's more advanced computer science universities which, and I think they said that university students, maybe 30% had rooted phones. And so it, to me it's entirely consistent. You've got this group of people who you're funneling through there to learn how to hack. Right. They've got enough of the anti authoritarian verve or vim to do that. But then the state has other mechanisms of control to also might get them to do what they want them to do, which is hack for North Korea.
- [10:06]
B
Right.
- [10:07]
A
And I guess going back to the article the North Korean bank hackers, the story ends with talking about how serious the I guess the regime thinks it is or how serious everyone thinks it is. It's spread amongst Pyongyang's elite military circles and university communities reportedly caused shock at the scale and audacity of the scheme. So officials expect harsh punishment. This goes beyond ordinary guilt by association penalties. It will be hard for the entire family line to survive. So that is like an extreme level of consequence. Right. So I guess they've gone from a place where they would hack banks or hack cryptocurrency exchanges, steal vast amounts of money without any consequences whatsoever.
- [11:00]
B
That's gone back to now your grandparents and your uncles and aunts are going to get killed as well because of association.
- [11:06]
A
Yeah, possibly. Which is now I Don't know how much to associate a hacker ethos with their actions. Right.
- [11:14]
B
It almost kind of feels like it should be the new hacker ethos of the like, make money by hacking. Like there's this hacker ethos that you need to have of like, how can I test this system and push boundaries and all that stuff. But very historically there wasn't really money in it. There's like a thing that you did on the side that was just fun. And so there's a lot of like, you know, exploring and curiosity and all of that.
- [11:39]
A
How much do you think that is associated with anti government or anti authority attitudes? Like, do you think that they're. I think it was part and parcel part of the thought process.
- [11:53]
B
I think it's very fertile ground for that thought process. Like it's. If you have that mindset already, it's easy to adopt, like if that's the way you thought, but then you had to join like IBM and start wearing a tie.
- [12:09]
A
It's almost ludicrous, isn't it?
- [12:10]
B
Yeah, it's like you could see it happening to like a very small subset of people, but it's just, it doesn't really fit with like the mindset you're supposed to have for that. Like it works a lot better if you're able to.
- [12:22]
A
Yeah. So this is back in the day mindset, right?
- [12:24]
B
This much.
- [12:25]
A
This is what we're talking about. We're not talking about the hacka types today.
- [12:30]
B
Yeah. And so I think the other thing is that just culturally the way that a lot of the hacking knowledge was disseminated was in the same sort of information channels as these like they were called anarchist files way back in the day. It was very much an idea of like, you know, independence. Screw the man, you know, do your own thing, fight the system. It was very much this counter culture thinking. And part of screwing the man would be like, get free phone calls. Yep. Right. Don't pay for this sort of thing. And then that sort of get free phone calls became more of a thing for like technical people to sort of get really excited by and keep playing with. And then it moved away from the, you know, how to make a bomb in your kitchen, which was part and parcel of that anarchist file thinking. But I think a lot of the, like the original cultural, like just anti authoritarian independence, do your own thing. And to be fair, this was in the west where that's very like the individualistic do your own thing is very like prevalent anyway. That's just the way that you're supposed to think So I think you then add in like all the cyberpunk stuff where it tends to be like this lone hero against the system. Like that's again, it's like it feeds into that cultural identity that was building at the time of like the hacker is the person against the system and that system becomes like, you know, the corporations and the government and all this stuff. So I think that by the time you get to like the 2000s, that's like, that is the default culture that you're getting when you're getting hacking is it's just this idea of like the Internet is new and free, it's separate from all these other things. You can be independent and apart from all this stuff. And then someone showed up and said, would you guys like to make a huge amount of money? Yeah.
- [14:34]
A
So it does seem that that ethos, which I agree was a thing
- [14:41]
B
and
- [14:41]
A
you sort of see reflections in it still nowadays, but it's not the dominant culture. It seems like everyone has been subsumed by the ability to actually earn a living. So yeah, anti authoritarianism or anti authority feelings are great, but they don't earn, they don't pay the bills.
- [15:03]
B
It's interesting, right, because the, I remember and this is like maybe 15 years ago, 10, 15 years ago, as we were talking with Dave Itel and he was saying, he was talking about how China was doing, developing a problem that it didn't anticipate, which was that they were making all of these hackers like they're training thousands and thousands and thousands of hackers and they were going to then be these very skilled, powerful people in this way. But they were also going to inherit and adopt the natural ethos of the hacker, which is this anti authoritarian, anti system sort of thinking. And that's going to be a problem for the state because now they're going to have thousands of people who can do things who are against the system. Right. And I don't think that that's worked out exactly.
- [15:57]
A
Yeah. So I would say that nowadays the exact same thing has happened in China as has happened in the west, where it's a job. And you may have those in a rule questioning tendencies, but again, like, I think everyone's been focused on making a buck instead of making a statement. And, and it seems like also in the beginning hacking in China was captured as a nationalist thing. So there's this phenomena of was it red hackers? Is that the term? And I think that the Chinese government did a good job of capturing the sentiment, the anti authoritarian sentiment and directing it outside
- [16:49]
B
in The US it was like, I'm a hacker, screw the government. And in China it was, I'm a hacker, screw the American government.
- [16:57]
A
Yes, that's right. And I think that was during that unipolar moment where the US was the sole superpower. And so I think that from, like, it's sort of an interesting contrast, I think, to us, China, North Korea, both China and the US can be focused on the US Government because that's the most overweening presence.
- [17:26]
B
Yeah.
- [17:26]
A
In. In both their lives.
- [17:28]
B
Yeah. And now if it isn't anymore, it doesn't really matter because the, the economic incentive has taken over.
- [17:35]
A
Right.
- [17:36]
B
Yeah.
- [17:36]
A
So it's originally almost always for the love of the game rather than for money.
- [17:40]
B
Right, right. Because there wasn't.
- [17:42]
A
And now it's the opposite.
- [17:43]
B
Yes, yes, exactly. I think it's sort of sad that there isn't as much of the, the hacking for the love of the game. Right. And it, in a way it might be that there's even more of it happening just because there's more people involved, but because overall it is so much bigger that you aren't able to find that community anymore. Because I've seen like, externally, to me it doesn't look like there is. And then I'll meet someone and suddenly find out that they're like part of a community that's just like doing really cool hacking stuff. Like, they're messing around with things that, like, doesn't show up and be like, oh, wow, that's still going on. That's great. It's good to know that there's still people doing it for the love of the game.
- [18:28]
A
I mean, in a way it feels like some of the AI enabled hacks that I've read about recently, they're kind of hacking because they think hacking is a good thing to do. And then they're almost as an afterthought trying to figure out how to make money out of it. And so from, you know, the objective internal hacker I have, it's like, yes, you're using AI to hack. That's kind of cool. And it's like, oh, it's almost disappointing
- [18:54]
B
now, why am I doing this? Right, yeah.
- [18:56]
A
Now it's almost disappointing that you're trying to figure out how to make money out of it afterwards. It's almost like you feel that you should be doing this. Mind you, they were unemployed, some of the examples I was thinking of. So they probably are looking for a way to make money.
- [19:09]
B
So, like, I feel one of the things that sort of harmed a lot of the game angle is bug bounties. And you know, not to say that they're wrong because I think it's been very, very helpful for a lot of people. But it made this like if you find a bug in a program, like if you do a security audit, you find something, people would then email the author and be like, hi, what is, like, how much will you pay me? I found a thing. Yeah. That shouldn't, like, it feels like that shouldn't be the reason you do things. And then if you get really pissed off that he's not going to pay you.
- [19:40]
A
Right.
- [19:41]
B
Like you'd see these little spats right where there's like, I did all this work, I founded this thing, he refused to pay me. So now I'm posting it publicly because, you know, screw that guy. And it's like that feels wrong in a way.
- [19:53]
A
It takes away the achievement of figuring out how to break something and just turns it into angst.
- [19:59]
B
Right. So I guess what we've seen is that there's a hacker ethos of the sort of like testing boundaries, thinking you found a way of doing something and then proving it because that's sort of part of it. And then that can marry into a culture that can direct that in certain ways. You can take that sort of idea of finding the problems with the system and overcoming them, fixing problems because it matters so much to you, even though you're not necessarily supposed to be able to do that, that can become part of a cultural identity. And if that cultural identity is mixed up with sort of other things like this anti authoritarianism, the individual against the corporations in the state and all that stuff, like I could, I could see how that historically would have been a thing that you'd had to worry about that hackers, like if you trained hackers, they would become like this and then you'd have unleashed them. But I wonder, I wonder if that sort of. It seems like that's not innate. That's, that was a sort of the directing of energy in that. It was sort of just a cultural thing that happened at that moment, uniquely those circumstances. And it's not innate to hacker thinking. Right.
- [21:15]
A
I mean, I kind of agree with Dave. I tell actually that I think it is innate. It's just that the, at that time, 15, 20 years ago, the US was totally dominant. And so the, it became the natural.
- [21:32]
B
If you're against the governing powers, you were against the US government.
- [21:35]
A
Yeah, yeah. And in fact, as China rises, we can imagine a day when it is the, perhaps the dominant power. And that in Fact, all China's hackers will be focused against the Chinese state and less against the US So I
- [21:52]
B
think what's interesting is Germany, for example, has a very, very strong hacker culture and it's like the ethos of hacking is deeply, deeply ingrained. So you'll find that there are German hackers who are so upset at the idea of working for the state that, you know, they would prefer like if there's one of those like conscription things where like you can be a conscientious objector and go to jail for like the four years or you could do your four years working for the government. It feels very much like they would take the jail as the thing. And I think that's one of the reasons that Germany's hacking capabilities, attacking capacity as a state is reduced is that the people who have those skills are just so anti authoritarian.
- [22:40]
A
Right. Yeah, they're far more counterculture. I guess I was just thinking about different state strategies to overcome that. And so I guess the US has become a bit more open about what they actually do. And I think that plus the pay mitigates it to some degree. Not that I think state hackers in the states of particularly well played compared to the alternatives. Yeah, the alternative jobs. Right.
- [23:10]
B
Yeah. I think we've gone over this as well though. There's a mindset of people who become civil servants.
- [23:16]
A
Right.
- [23:16]
B
Of the mission and that. So it's.
- [23:18]
A
Yep.
- [23:19]
B
I think they're well compensated in sort of in, in monetary like remuneration, but also in terms of like psychic or spiritual order. Like.
- [23:33]
A
Right.
- [23:33]
B
Morale, like there, there's, there's this sort of personal accomplishment thing that you get. So you might, on the, on the outside you could be very happy that you're making, you know, $300,000 and you feel good about that. And on the inside you're making $120,000. But you're also doing something that's really important. And so that makes up the difference, I assume. No.
- [23:54]
A
Yes, yes. I think it's 60, $60,000. Well, I think that was the deal that there was a trade off between fiscal compensation money and also mission.
- [24:10]
B
Right.
- [24:11]
A
And I think that over time that balances gone up and down and you know, it's always wherever it is, it's. Yeah, yeah. You know that, that was traditionally the deal. I think the Chinese is quite interesting in that it's gone for a totally very free market approach where it's not clear that the people are necessarily doing it for the mission. To me, from the kind of leaks that I've seen and it's almost mercenary in a way. Yeah, yeah but it seems like there's such a huge number of people that it's. You can do this low rent kind of hacking for whatever you get paid
- [24:52]
B
and see I, I think what the state is doing there is part of the compensation is you're allowed to hack things which is fun like if, if you've ever hacked boxes you know that like getting that root prompt is, is like it's a huge rush and so the ability to do this thing that you enjoy doing without fear of the state for example and to actually get paid as well if you do it correctly I think that that's the sort of compensating factor.
- [25:24]
A
Right And I guess there are.
- [25:26]
B
It's mission in its own way it's. It's mission for its own reward I
- [25:30]
A
guess and so they're in a way they're the purest hackers because, because they're getting a little bit of pay but they're still doing it for the love.
- [25:40]
B
Thanks a lot, Tom. Thanks mate.