North Korea's antivirus software whitelisted mystery malware

North Korea’s very own antivirus software has been revealed as based on a 10-year-old application made by Trend Micro, but with added nasties. So says Check Point, which was sent a copy of the “SiliVaccine” application and after analysis declared it contained “large chunks of 10+-year-old antivirus engine code belonging to …

[Anonymous Coward]

Do I need to add anything?

"a totalitarian dictatorship can only sustain itself with pervasive surveillance and leaving a backdoor that allows viruses in would facilitate just that"

I think you know what I'm thinking, as you are thinking the same.....

[Anonymous Coward]

Re: Do I need to add anything?

Do you mean some kind of "back door", for "law enforcement" to be able to break encryption?

[Anonymous Coward]

Re: Re: Do I need to add anything?

"Do you mean some kind of "back door", for "law enforcement" to be able to break encryption?"

You might think that; I couldn't possibly comment !!!

:)

[Christian Berger]

Now watch the next spin

This paper says that "SiliVaccine” might be connected to North Korea... but they obviously cannot know. Now if someone finds a new version of it, which is likely based on this copy of "SiliVaccine” they will then claim that according to the first paper, this must be from North Korea.

That's how attribution "works", when in reality it's trivial to pose as someone else. Everyone could write software in the style of North Korean software, and secret services do false flag operations for centuries.

[Anonymous Coward]

Re: Now watch the next spin

Don't be so Sili

[Rustbucket]

Re: Now watch the next spin

Even if the software is crappily written, it seems like a lot of work just to give a false attribution to North Korea.

It's unlikely we could have a much lower opinion of them than we already do, so what would be the point?

[TrumpSlurp the Troll]

Remind me

To take my own copy of anti-virus next time I take a PC into North Korea.

Or is the implication that this is being offered globally? The article didn't really say where the sample came from (possibly quite sensibly).

[Spacedinvader]

Re: Remind me to RTFA

"Check Point received the software from freelance journalist Martyn Williams, who sent what was billed as an installer but was actually a self-extracting WinRAR file"

[MadonnaC]

Re: Remind me to RTFA

But who sent the software to Martyn?

[MyffyW]

Re: Remind me

OK, so it's old and malware-infested, but at least it's not McAfee.

[rjstua]

Could it have also been badly written on purpose, like it was meant to be found and interrogated all along?

[Rich 11]

Are you suggesting that a possible false flag op is really a double-bluff bait-and-switch counter-espionage propaganda drop by black hats who might be white hats conned into working for the black hats?

Clever.

[Mark 85]

Rich11... you best claim the movie rights for that.

[Anonymous South African Coward]

SillyVaccine?

Nein danke.

edited to add : further permutations will add the ability to install selected top sekrit papperwork in order to implicate somebody in espionage stuff....

[Anonymous South African Coward]

Dear Leader no doubt is very unhappy about this.

[Anonymous Coward]

Reformed Character Alert !!! :)

"Dear Leader no doubt is very unhappy about this."

Dear Leader knows nothing about this, in his new role as 'Saviour of the Planet', Friend of all and all round 'Good Egg" [Nork Version].

I would still keep watching your back ....... Just in Case.

People who can change their personality THAT quick are usually most interesting to watch when they don't get their way. (Reminds me of a certain POTUS !!!)

I hope Korea gets peace but have some doubts about the 'Dear Leader' being the one to deliver it.

Short Term game for long term gain ........ buy popcorn and watch the show !!!

[Rich 11]

Re: Reformed Character Alert !!! :)

You could also save electricity by buying microwave popcorn and leaving it on your windowsill to get nuked for free.

[Anonymous Coward]

So they will only find the ancient NSA hack tools then not the more recent versions. sweet.

[arctic_haze]

How many governments should know my emails?

if you use Microsoft / Apple / Google operating systems on your PCs and phones, NSA knows everything about you it wants to know. But why willingly give the same data to companies dependent on a foreign regime? And I do not even mean this Nork pathetic attempt but things like Kaspersky Lab.

[Mahhn]

Sounds more like the NSA

" SiliVaccine has whitelisted one virus signature that Trend Micro’s products could detect. Just why North Korea’s government wants software that won’t spot some viruses is not hard to guess: a totalitarian dictatorship can only sustain itself with pervasive surveillance and leaving a backdoor that allows viruses in would facilitate just that."

Welcome to the planet of pervasive surveillance and backdoors that protect it's evil overlords.

[Milo Tsukroff]

Re: Sounds more like the NSA

> backdoors that protect it's evil overlords.

Backdoors ... like Spectre. Which showed up over 10 years ago, and is turning out to be devilishly hard to eliminate. Yep, sounds like the NSA.

[Fruit and Nutcase]

Stop!

Being a Sili Billy

[Anonymous Coward]

I thought North Korea were meant to be super hackers posing a severe risk to the west.

[Sheepykins]

It's honestly going to be interesting once the DMZ or 'Peace' zone comes into force.

Surely the DPRK know how hard its going to be to keep spreading their propaganda and weirdo rhetoric, especially if tourism between the two states is established.

Infact the whole thing confuses me. 4 months ago it was fire and fury, now its happy friend time and throwing nukes away. I'm kind of hoping Kim had a near death experience and has finally decided its not worth it.

[Wo]

"Infact the whole thing confuses me. 4 months ago it was fire and fury, now its happy friend time and throwing nukes away. I'm kind of hoping Kim had a near death experience and has finally decided its not worth it."

Isn't it related to the fact that their nuke lab collapsed after some recent tests triggered an earthquake?

Make friends to ensure they don't get attacked while they rebuild. Especially after poking at the man in the US.