Misconfigured cloud server leaked clues of North Korean animation scam
(2024/04/23)
- Reference: 1713849970
- News link: https://www.theregister.co.uk/2024/04/23/north_korea_animators/
- Source link:
A misconfigured cloud server that used a North Korean IP address has led to the discovery that film production studios including the BBC, Amazon, and HBO Max could be inadvertently hiring workers from the hermit kingdom for animation projects.
The server – which according to think tank [1]Stimson Center is no longer being utilized – was discovered by the author of [2]NK Internet blog , Nick Roy, in late 2023.
The Stimson Center, together with Roy, analyzed the files that would appear every day on the server's blog, according to a post on the think tank's blog, 38 North, penned by Martin Williams.
[3]
Many of those files included instructions for animation work and results of that day’s work, uploaded by unknown individuals. Editing comments and instructions were frequently written in Chinese, accompanied by a Korean translation.
[4]
[5]
"This suggests a go-between was responsible for relaying information between the production companies and the animators," alleged Williams.
[6]North Korea running malware-laden gambling websites as-a-service
[7]Execs in Japan busted for winning dev bids then outsourcing to North Koreans
[8]Superapp Gojek fine-tunes each new error message for a week. What? Why?
[9]Squid games: 35 security holes still unpatched in proxy after 2 years, now public
Google-owned cyber security outfit Mandiant had a look at the access logs and found most logins to the server were done over a virtual private network (VPN), but there were also three from China and one from Spain.
The researchers were able to identify a few of the projects – including season 3 of Amazon Prime’s “Invincible”, plus Cartoon Network and HBO Max's “Iyanu, Child of Wonder”. Files from BBC's Octonauts were found on the server, but appeared completed, so it is not known if work on the show was contracted out or if the files were there for other reasons.
Although documents do not explicitly name the organization, the researchers suspects that the contractor doing the outsourced amination was Pyongyang-based and state-sponsored animation company April 26 Animation Studio – also known as SEK Studio – which is subject to US sanctions.
[10]
"There is no evidence to suggest that the companies identified in the images had any knowledge that a part of their project had been subcontracted to North Korean animators," asserted Williams.
He posited that additional relay servers probably exist for North Korean orgs covertly engaging in other digital work such as software development.
North Korean citizens' efforts to earn money for the regime by posing as IT workers are [11]well [12]documented . The United States has issued warnings against the practice and advisories on how to [13]protect against inadvertently supporting Kim Jong Un's regime and slush fund.
[14]
In January, 38 North [15]warned that cloud computing service providers should take more care against unwittingly renting infrastructure to North Korea. At the time, the org was more concerned about North Korean access to AI infrastructure than hiring out its citizens as animators. ®
Get our [16]Tech Resources
[1] https://www.38north.org/2024/04/what-we-learned-inside-a-north-korean-internet-server-how-well-do-you-know-your-partners/
[2] https://nkinternet.wordpress.com/about/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZieGvegU2Hv5oW@iE3HPhAAAAIY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZieGvegU2Hv5oW@iE3HPhAAAAIY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZieGvegU2Hv5oW@iE3HPhAAAAIY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2024/02/15/north_korea_turns_to_designing/
[7] https://www.theregister.com/2024/03/28/japan_nk_arrests/
[8] https://www.theregister.com/2024/02/20/gojek_failed_state_error_designs/
[9] https://www.theregister.com/2023/10/13/squid_proxy_bugs_remain_unfixed/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZieGvegU2Hv5oW@iE3HPhAAAAIY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2024/02/15/north_korea_turns_to_designing/
[12] https://www.theregister.com/2024/03/28/japan_nk_arrests/
[13] https://ofac.treasury.gov/media/923126/download?inline
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZieGvegU2Hv5oW@iE3HPhAAAAIY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2024/01/24/ai_north_korea_cloud_warning/
[16] https://whitepapers.theregister.com/
The server – which according to think tank [1]Stimson Center is no longer being utilized – was discovered by the author of [2]NK Internet blog , Nick Roy, in late 2023.
The Stimson Center, together with Roy, analyzed the files that would appear every day on the server's blog, according to a post on the think tank's blog, 38 North, penned by Martin Williams.
[3]
Many of those files included instructions for animation work and results of that day’s work, uploaded by unknown individuals. Editing comments and instructions were frequently written in Chinese, accompanied by a Korean translation.
[4]
[5]
"This suggests a go-between was responsible for relaying information between the production companies and the animators," alleged Williams.
[6]North Korea running malware-laden gambling websites as-a-service
[7]Execs in Japan busted for winning dev bids then outsourcing to North Koreans
[8]Superapp Gojek fine-tunes each new error message for a week. What? Why?
[9]Squid games: 35 security holes still unpatched in proxy after 2 years, now public
Google-owned cyber security outfit Mandiant had a look at the access logs and found most logins to the server were done over a virtual private network (VPN), but there were also three from China and one from Spain.
The researchers were able to identify a few of the projects – including season 3 of Amazon Prime’s “Invincible”, plus Cartoon Network and HBO Max's “Iyanu, Child of Wonder”. Files from BBC's Octonauts were found on the server, but appeared completed, so it is not known if work on the show was contracted out or if the files were there for other reasons.
Although documents do not explicitly name the organization, the researchers suspects that the contractor doing the outsourced amination was Pyongyang-based and state-sponsored animation company April 26 Animation Studio – also known as SEK Studio – which is subject to US sanctions.
[10]
"There is no evidence to suggest that the companies identified in the images had any knowledge that a part of their project had been subcontracted to North Korean animators," asserted Williams.
He posited that additional relay servers probably exist for North Korean orgs covertly engaging in other digital work such as software development.
North Korean citizens' efforts to earn money for the regime by posing as IT workers are [11]well [12]documented . The United States has issued warnings against the practice and advisories on how to [13]protect against inadvertently supporting Kim Jong Un's regime and slush fund.
[14]
In January, 38 North [15]warned that cloud computing service providers should take more care against unwittingly renting infrastructure to North Korea. At the time, the org was more concerned about North Korean access to AI infrastructure than hiring out its citizens as animators. ®
Get our [16]Tech Resources
[1] https://www.38north.org/2024/04/what-we-learned-inside-a-north-korean-internet-server-how-well-do-you-know-your-partners/
[2] https://nkinternet.wordpress.com/about/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZieGvegU2Hv5oW@iE3HPhAAAAIY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZieGvegU2Hv5oW@iE3HPhAAAAIY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZieGvegU2Hv5oW@iE3HPhAAAAIY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2024/02/15/north_korea_turns_to_designing/
[7] https://www.theregister.com/2024/03/28/japan_nk_arrests/
[8] https://www.theregister.com/2024/02/20/gojek_failed_state_error_designs/
[9] https://www.theregister.com/2023/10/13/squid_proxy_bugs_remain_unfixed/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZieGvegU2Hv5oW@iE3HPhAAAAIY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2024/02/15/north_korea_turns_to_designing/
[12] https://www.theregister.com/2024/03/28/japan_nk_arrests/
[13] https://ofac.treasury.gov/media/923126/download?inline
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZieGvegU2Hv5oW@iE3HPhAAAAIY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2024/01/24/ai_north_korea_cloud_warning/
[16] https://whitepapers.theregister.com/
A DPRK IP address, you say?
Yorick Hunt
BGP says they have the net sum of a single /22 subnet.
I'd find it hardly likely that they'd be allocating any of that space to things as frivolous as file sharing.
"... according to a post on the think tank's blog..."
Well, that explains it. Looks like someone's funding review is due.
Re: A DPRK IP address, you say?
Doctor Syntax
Earning foreign currency is frivolous?
Make trade, not war
It is just another proof that trading with the West is more beneficial than fighting with it.
There are many North Korean talents wasted, while the South Korean have proven they can deliver amazing results in business and science.