http://arstechnica.com/security/2015/01/surprise-north-koreas-official-news-site-delivers-malware-too/
By Sean Gallagher
Ars Technica
Jan 12, 2015
A security researcher examining the website of North Korea's official news
service, the Korean Central News Agency, has discovered that the site
delivers more than just the latest photo spread of Democratic Peoples'
Republic of Korea leader Kim Jong Un inspecting mushroom farms. There's a
little extra surprise hidden in the site's code—malware. The news site
appears to double as a way for North Korea to deliver a "watering hole"
attack against individuals who want to keep tabs on the "activities" of
the DPRK's dear leader.
Ars has independently verified a reference within part of the site's
JavaScript code called from the home page to a download named
"FlashPlayer10.zip." The file, which is set as a JavaScript variable
"FlashPlayer" on the site's main page and on other site pages, contains
two files labeled as Windows executable installers containing updates for
the long-since obsolete Flash Player 10—one for an alleged ActiveX
control, and the other for a browser plug in. Both are identical files,
and they contain a well-known Windows malware dropper, based on an
analysis through the malware screening site Virustotal.
[...]
--
Evident.io - Continuous Cloud Security for AWS.
Identify and mitigate risks in 5 minutes or less.
Sign up for a free trial @ https://evident.io/
