Troll, but Verify: Security Lessons From North Korean Job Candidates | Thiago Silva & Michael Be |

[Music] hello hello good afternoon uh we got a amazing exciting next talk um it's called troll but verify security lessons from North Korean job candidates please welcome uh Chiago Silva and Michael B from Kraken Round of Applause thank you everyone um so my name is Michael and this is Chago we both work for Kraken and we also support Inc which we hope to be the secure home of Defi and so a lot of people have been interested about what's going on with North Korea and I had planned on trying to you know remind you that North Korea is still a threat but luckily things happened uh in the news if you've been following so I don't feel like I need to spend any time talking about why this is such a threat right um they're after crypto they're targeting them specifically and so um a lot of the hacks thaten you know we imagine all of these crazy wild outlandish technical details and at the end of the day they are doing often very simple things like fishing um applying for jobs um and those are the types of things that uh we really set out to figure out what can we do to help secure the community and hopefully today share with you a little bit of the lessons that we learned uh doing some analysis so uh Kraken is part of an organization called the crypto ISAC um it's kind of like the cabal of information sharing um you know we do share and partner with other centralized exchanges for the purpose of um securing customers helping make sure the community is safe um but one of the things that we often get with this group as a member is we often get hot tips from three-letter agencies where they're investigating they have lists of emails names and they'll say hey centralized exchanges we have a list of emails um we believe they're associated with the government of North Korea please do what you need to do but here's the emails and then we work through and go through that process so we get this from time to time um and often you know we don't have any matches but in this particular case uh around September October um we got a list from one of the crypto ISAC members from a three-letter agency likely um that that said that okay here's this list and we decided to check it so we wanted to see does anyone have a kraken account no but we found something a little bit more interesting we actually found that they were applying for jobs to work for Inc and other places within our organization so you can see here uh this is from our application screening thing they actually uh got autore rejected their resume was not so good and we'll look at that here in a little bit but I kind of feel bad for them it feels like me applying for jobs where they would apply uh every month to different roles regardless of their experience so I kind of feel bad for them a little bit but they were very very persistent uh this one particular individual uh this individual's Alias name we'll call him Giovani um so Giovani you know what we want to do is like okay so now we know this person works with North Korea what can we learn about him right let's do some uh information gathering right let's see what they have out there on social media on GitHub on LinkedIn let's figure out what makes them tick and so one of the weird things that we saw from Giovani was that not only was Giovani applying for jobs with Kraken every month to different onchain type of roles uh Giovani was also hiring people for his team which was very odd um nobody really has time to do your normal job and recruit people and be a you know all these different things so we found that very suspicious and uh the most suspicious thing of all was that they said that they were excited to work together and Lead projects at Accenture so I come from Consulting before crypto that's a huge red flag definitely not true so we decided to investigate him so here's what their resume looks like um you know you're probably going to see a lot more of this type of thing with AI right you can autogenerate a resume and AI is kind of fallible there's certain things that AI does that you might not think about it but if you've used chat GPT enough you start seeing these Trends and so knowing that this was probably fake we really took a more uh specific look at this and some of the things that really stood out to me here this is is a real company but it was like a startup so tough to verify tough to find someone to talk to they didn't have an HR department we could just say hey is this person working for you is this real is this not but what really stood out to us was the fact that they were putting percentages on literally everything they like improve security by 40% what what does that actually mean right they for whatever reason the resume just uh I guess it was the best practice maybe it was part of their prompt but we found that to be uh a little bit silly so we thought what do we actually do right what's the point of this what do we do with them now that we get them well you know at Kraken we'd like to do a little trolling right that's kind of our culture um we want to actually learn about them what they do how they do this um you know what IP addresses are they coming from how do they get these identities but mostly we also want to troll and so uh if you've seen on YouTube kit Boga we do have a partnership with kit Boga who basically trolls uh scam artists and we thought we would take a page from that book it's part of our culture and drive them crazy so um here is a a clip from one of the interviews that we did uh one of the interesting things about this is that there appear to be multiple people on this interview the person who originally took the call they had a very strong Korean accent and then as you'll see here there's someone completely different and so we kind of wanted to play with them a little bit and ask some questions that we figured they really wouldn't know but uh here's a quick clip from some person working with this person who is associated with the dprk you're not affected by the hurricane by the way are you um I saw you in Georgia um are you doing okay with that I am safe but right now I am in North Georgia I am I am visiting my friend there so I am fine okay that's I will get back to I will get back to Georgia in few like in next week maybe okay so I have no idea what he was talking about um the the hurricane in the the hurricane was happening if you remember and so this person said he was from Atlanta and so he claimed that he was moving to North Georgia with his friend he he had no US geography so we found that to be a little silly but a little bit comical and worth sharing um another thing that from your experience um is there anything that related to Security in xgs that we should be aware of hello hello can you hear me yeah sorry I I I just lost your like your question if you come again please yeah so you can see here what he was doing right he was stalling and faking for time you can see on his glasses uh popping up different Windows prompting uh likely probably had people chatting with him and telling him what to do and say there was no drop connection right everyone's connection was totally fine the classic fake of virus attack move uh he was really not that good of an interviewer so what are some lessons and takeaways we got from this person so originally like I said he joined with a different name and two different voices which uh unless they're demon-possessed is usually not a good person to hire um they their responses honestly I was hoping to kind of learn from this like mystical North Korean group like what they do and have these like be super cracked out developers it was just word salad right you can kind of see there they really just memorized a few things and that was it they they faked that bad connection they they really weren't prepared for this kind of interview probably a function of the fact that they were just trying to get hired in any role possible Right like you saw they applied for like 10 different jobs in totally different departments no knowledge of US geography like I said uh North Georgia but one really interesting thing to talk about here as well um their IP address that you know that they used to submit and join this type of thing uh it was located in London in a mobile provider right there are other exchanges out there that block vpns because they're so worried about this threat of bad guys using them and guess what that policy would not have even stopped this right they're using just a regular throwaway probably burner type of uh device based in London which by the way made no sense for someone in Georgia but um we didn't call them on it but we did see that this IP address was in some of these coin blocker lists which indicates to me that maybe it was used for other things in the past of maybe previous compromises is uh interesting things like that so what was the result of interview number one what do we learn outside of that well uh he actually ghosted us um so uh I think he maybe either picked up on the fact that we were trolling him or things like that but in true Millennial fashion he just dipped and did not say anything out so candidate number two his name was step and so here's an example of Steven's resume um you know one of the things that also you notice with AI generated resumes is the Double Dash they use double dashes everywhere people don't really normally do that but you know there's a plethora of things I actually have a friend at Cisco I asked him about this um he had no idea what this was so maybe that's perfect for them to decide that they are going to pretend to work for Cisco with all this experience um but uh something that we'll get into in a little bit they also said that they like movies which I thought was a weird inclusion uh on their resume so here's Stephen showing what he can do what are the different types of uh cross SC and type and uh what could someone do if they can exploit uh cross scripting attack vulnerability on kraken.com uh okay I'm sorry the first one was clight scripting and what is the second one for uh like uh if you have like if you discover a crossy scripting attack right how would you right to exploit you know users and and uh you know uh admin or something like that so he did the same thing right he really had no idea what we were talking about with a very basic conversational security question um completely dumbfounded stalled for time um you know you can kind of see the the different things flash which again was was really disappointing so we wanted to kick it up a notch right we want to say okay we kind of know theyo now how are we going to officially troll uh dprk operator so here's what we decided number one power move only accept interviews at 3:00 a.m. Pyongyang time they didn't like that very much um but we convinced them that was the only time the team was available and so uh we you know just to make their lives a little bit more miserable for making all of our Lives miserable um we also gave them a take home test we do take home test at Kraken I kind of hate them but it's a necessary evil sometimes um but we made it due this week right we gave them an interesting take-home test that I'll show you here uh in a little bit um we as part of the take-home test we actually made them have a kyc kraken account because we thought if they're dumb enough to do this where we have all this data and they're submitting a license or passport they deserve what's coming to them so we thought it would be interesting if they would try that and then uh while we had the interview with them we asked them about all sorts of us culture the classic North Korean tests right asking him about American culture movies Sports holiday things things um chat about motorcycles right he had a a motorcycle designation on his license that you'll see here in a little bit and then ultimately spend the whole interview trying to see like their phone right trying to see like how they were connecting what apps they had installed if I can see you know red star OS in the background or something crazy like that so we had a lot of fun with them and uh Chago over here is going to go into a little bit of what we did here uh with Stephen as a result of the test here and let me there we go so here's the test um by the way so the test was very very simple a CLI app to make an API call on Kraken but as we talked about the key here was you need to make a new account and we really pushed this hard that you need to have a kraken account and username so we're really curious if they would actually do it or maybe they would try and then bail and then we can learn from that um but Cho here will kind of walk through what we saw with Stephen yeah so surprisingly he actually submitted his his ID for this now we can actually see some inconsistencies with this idea right so this is idea that he sent to us and right as we see this idea we can see that you know the there are some fields that are actually misaligned here so for example like the sax field it's a misalign with the m for example another thing and and actually here we can we can see how the original Texas IDE is like so you can see that you know the field the sex field is perfectly aligned with the mid so this we actually grabbed the official texd you know in the Texas portal for how to identify you know an Regional tax City so another thing here is is his name so you see that um it is kind of like overlapping with the blue um the blue start and the background and in the originality it doesn't even overlap right but what actually caught as attention was the ghost image so you see there the text is said he has two images he has the ghost image and the big one so if we try to actually resize the dimensions for the ghost image and then just compare with the big one we just try to perfectly resize that we see that it's not actually matching so he didn't even have the effort to perfectly resize the ghost image with the big one now as a comparison this is the original Texas Z this is the one that all people from Texas have so this one you can see it is perfectly aligned if you just try to resize the ghost image with the big one you're going to get like a perfectly resized image now let's see what we got for the second part of the interval process where where are you today like where you where you located I in just Texas in Houston in Houston Texas okay um what's the weather like how is it um yeah it's pretty nice now not not H not Co just just good per it just good awesome yeah doesn't look he goes outside so much but well let's see another part of this interview which actually pretty interesting your favorite Halloween movie a few moments later just um just oh yeah which one there's there's a bunch in that series I love the new ones just came out 2,000 years later 8 maybe well if I could just point jump in real quick uh he actually commented at one point he's like this is the strangest interview I've ever had so yeah uh he he he earned that one so well as a Halloween fan or actually like a horror movies fan he sucks at it actually so we actually collect collected a lot of information about this guy so you know we collected a lot of this a lot of insights about he how he performs un bille uh what actually his modop branding and everything so we tried to actually move on right so at the same time what we did was well there there's this guy called Zack xbt so some of you might know this guy Um Zack xbt is pretty famous for like collecting and investigating crypto scams providing a lot of information about how they work or how to actually recover some funds and at this point uh at the same time he was actually investigating a list of dprk workers so he compiled a list of DPR KRT workers and we got this list so this list had wallet number wallet addresses and email addresses as well so you know we tried to do our Hecker do we try to investigate all of these addresses so what actually is what actually hackers do well they just try to actually check this information on social media profiles leak databases try to find like the same username on other public sources like GitHub gab or any other type of like social media that do have like usernames and we try to look up on actually like other leak databases so so we found a lot of things um actually for for this user one of his emails was on inel X so at some point he probably got compromised some way um and we found a lot of accounts different accounts this guy was probably just registering for multiple accounts using different names different email addresses and even applying for different jobs and actually at some point we saw that um his email was actually on G GitHub with electri credentials for different accounts so he was probably using like different accounts for GitHub as well and we actually got hold for his Chrome history profile his Chrome history profile actually just got leaked as well and we found a lot of interesting information like he was searching for how the Russian passport works and so on and we even F like different accounts for Gmail Proto uh recruiting websites and so on and we actually found as well Auto credentials for this so uh on his Auto for Google Chrome we found uh a very interesting Korean name so this Korean name if you look at it on Google's translator it looks like this if you translate it and this is the name associated with uh with North Korean uh hacker list so this list got sanctioned and we probably discover another guy that was associated with this you know us sections list so some takeaways for this yeah so thank you everyone uh hopefully you found that interesting for us the main takeaway don't rely on you know your VPN to mean hacker or the background check or all those things you know watch for social media watch what's out there watch for exposed data because that hack is often not that crazy epic thing that you see it's often a very simple thing where someone applies for a job and it's your new coworker who who has admin access to AWS thanks everyone have a great day