North Korea Accused of Attacking Windows Users

Microsoft has warned users to pay particularly close attention to emails that appear to come from "microsoft.com". A simple trick involving spelling was the key to a security attack that Microsoft believes was instigated by North Korea.

A US court has given Microsoft legal control of 50 web domains it says were used to carry out cyber attacks on Windows users. It's said to be the work of a group dubbed Thallium operating out of North Korea.

Microsoft says the attacks were targeted at "government employees, think tanks, university staff members, members of organizations focused on world peace and human rights, and individuals that work on nuclear proliferation issues." (Source: microsoft.com)

Social Media Used For Targeting

The attacks involved something called "spear phishing." That's a variant on the familiar tactic of sending messages that appear to come from a trusted source to trick recipients into opening an attachment, then clicking a link or handing over sensitive data. The end goal is to use malware to gain access to, and even control of, the victim's computers.

"Spear" refers to the attackers not simply spamming as many people as possible and playing the numbers game, but rather specifically targeting users in particular groups. That may have involved using social media or even staff directories. (Source: forbes.com)

In this case the bogus messages claimed somebody had tried to sign in to the user's account and that Microsoft itself was contacting the user as a security check. One variant of the message invited users to click a link to review their recent web activity.

Misspelling Overcomes Skepticism

The trick which appears to have worked comparatively well involves the sender's address. Often phishing attacks rely on spoofing the displayed sender's name and hoping the victim doesn't look closely at the details in their email software or service, which often reveal the actual address from which the message came.

The attackers were able to send the messages from an address at "rnicrosoft.com." That may be clear for many readers on Infopackets, but in some email applications and with some type settings, it's not obvious at first glance that the "rnicrosoft" begins with an 'r' and an 'n' rather than an 'm'.

What's Your Opinion?

How good do you think you are at spotting phishing attempts? Have you ever contacted a friend or colleague to check if it was really them who sent an attachment or link? Can companies and governments really hope to win the battle against scammers if they are up against state-sponsored hackers?