Sony Hackers Seen Having Snooped for Months

http://www.bloomberg.com/news/2014-12-19/sony-hackers-seen-having-snooped-for-months-planted-bomb.html

by jack_axel • 12 years ago

67 48 12 years ago

bloomberg.com

sp3322• 12 years ago

Oh, not an actual bomb.

spacefight• 12 years ago

Look, a nord korean spider over there!

jagermo• 12 years ago

Thank you, I thought the same thing. But the journalist just re-watched Swordfish, it seems.

revscat4• 12 years ago

Hackers who broke into Sony Corp. (6758)’s Hollywood unit probably spent months collecting passwords and mapping the network before they committed a last act of vandalism, setting off a virus that wiped out data and crashed the system in 10 minutes.

Trend Micro Inc. (4704) arrived at these conclusions after running simulations on a copy of the virus that struck Sony Pictures Entertainment’s computers. The Tokyo-based developer of security software declined to reveal where it got the malware.

I am so far unconvinced that this was the work of a foreign government rather than an insider, and this article does little to make the case for DPRK involvement. The US government is heavily implying that they are to blame, but as yet have not given specifics as to why they think so. This article provides little new information in this regard. In fact, if anything, the following quote indicates an insider is just as likely to be the source:

While it’s unclear how the hackers got access to Sony’s network, the virus they used to destroy it is available on the black market and can be used without a high level of technical sophistication, according to Someya. It was customized for the company, embedding in the program account names and passwords and targeting the security software, he said.

personZ3• 12 years ago

In fact, if anything, the following quote indicates an insider is just as likely to be the source

The common narrative in discounting any involvement of North Korea is that they're too famished and uneducated to perform such an operation. Your angle is that the attack isn't sophisticated enough?

The evolving story is that a single IT worker with significant right grants was targeted by the group, and once that single user was exploited, their privileges were used to compromise the network. If you have the privileges of a superuser, your attack doesn't need to be sophisticated.

And ultimately this is exactly how I would expect these sort of attacks to go, especially when hitting targets in free and open nations. Why go through the trouble and effort of trying to winnow in from the outside when you can just exploit the kink or vulnerabilities of individual people -- who you can now discover via LinkedIn -- and then work your magic from the "inside". Sending out a group policy to disable all security software is a couple of lines. This "virus" seemed to be a simple efficiency measure, as with those rights they could do pretty much everything, though mass malice would probably be too labor intensive minus some helpful tools.

The defense against this is of course that even admins should have limits on their access and flags on their activities. Of course, the admins are the ones who normally implement this, so...

Reebles• 12 years ago

Most people I've seen question the North Korea angle absolutely acknowledge that they have the capability to do things like this. They usually argue that this does not fit the style and MO of a state sponsored attack, that The Interview was never mentioned by the hackers until after the media starting running with the story, and that there simply isn't enough public evidence to justifiably attribute it yet, among other things.

eat• 12 years ago

The common narrative in discounting any involvement of North Korea is that they're too famished and uneducated to perform such an operation.

This is the common narrative? Every narrative I've read bases their skepticism on problems with the language used by attackers.

berberous3• 12 years ago

An insider strikes me as extremely unlikely. You would need to have someone that is normal and skilled enough to be hired at Sony (presumably in IT), but malicious or wronged enough to attempt to destroy the entire company, including wronging all of your co-workers and risking serious risk of prosecution from the U.S. government. Also, you would presumably be skilled enough to evade the FBI, but still somehow be stuck in some mid-tier Sony IT gig.

On the other hand, this strikes me as totally within the realm of possibility for North Korea. They have the skills, they don't really give a shit about pissing off Sony or the FBI, and they have motive.

wpietri• 12 years ago

I think that's too narrow. You need one person with access to feel wronged, and you also need strong black-hat skills, but they don't have to be the same person.

Hollywood is famous for screwing people over, so I doubt there is a deficiency in people with grudges. Suppose one of those people were willing to spend $50k on this? Suppose they had a friend or a second cousin with a connection to some people with skills and a taste for large-scale lulz?

Morgawr• 12 years ago

Not disagreeing with you but

be skilled enough to evade the FBI, but still somehow be stuck in some mid-tier Sony IT gig.

Skill (whatever that is) has very little to do with how successful you are at your job and/or which company you are working at.

djrogers• 12 years ago

The majority of data theft, cybercrime, etc is done by insiders these days - a lot of companies just don't talk about it unless forced to by regulations...

roc• 12 years ago

"The hackers have released at least nine batches of data and promised a larger quantity on Christmas."

That's why it doesn't make sense as North Korea. Their accepted motive goes as far as THE INTERVIEW, which was dodgy-enough to begin with, but which has already been shelved. Why would North Korea be threatening to release more information if their goals were already met?

Ignoring the rhetoric, the actions here looks much more like garden-variety data-ransom. If "their demands" were "x-million USD, don't contact the feds", then everything makes sense. Wiping the data. Only mentioning THE INTERVIEW after the press seized on it (misdirection and increased pressure on Sony). Actively promoting the tastiest bits of leaked data to the press. Releasing more as further deadlines pass without some unnamed capitulation (that's larger/different than simply shelving THE INTERVIEW). Having The Big Bad Deadline for a large future release.

That the US Government is publicly on-board with the DPRK theory also doesn't fit an actual "hack by North Korea" situation. The US Government gains nothing by naming perps, which is why they almost never do it, not even after the consensus opinion of third-party researchers makes an inescapable conclusion. If the perpetrators actually were North Korea, the US government would stand to lose more than most times, as we're currently trying to lure the DPRK back to the six-party talks. (A subject much larger than Sony Entertainment.)

That attribution would make perfect sense if the government is coordinating with Sony, but has to try to convince the hackers they aren't involved/competent/two-hops-away, etc. Given how cozy the US press is with the US government, I wouldn't be surprised if they were knowingly pushing the "it's totally North Korea" angle in the service of the investigation.

revscat4• 12 years ago

Sociopaths exist. If this was an insider, possibly an administrator, all they would need to do would be to execute the equivalent of "select * from \\windows_domain", put the results in a torrent, and call it a day. From all reports the internal information security procedures at Sony Pictures were not rigorous, which implies such a thing could happen without detection.

I'm not saying that the DPRK couldn't do it, only that no proof has been offered that they did. Given the lack of proof, assigning blame to anyone is premature.

Parenthetically, it is amusing to me that the accepted narrative has so quickly become that NK definitely did it.

sschueller• 12 years ago

Sony laid off quite a few people this year including an entire division. Plenty of people who could be disgruntled.

http://variety.com/2014/biz/news/sony-cuts-over-70-jobs-more...

apetresc• 12 years ago

Your argument applies equally well to just about ANY high-profile inside job, and those are incredibly common. Obviously that segment exists. Why couldn't it exist for Sony?

_cipher_• 12 years ago

[..]and skilled enough to be hired at Sony (presumably in IT)[..]

As I see it, after the three (if Im not mistaken) last successful attacks at Sony, I wouldn't say they're skilled _enough_. Not even skilled basically.

Again, as I see it, it's Sony's fault: after the first attack at playstation network, the least they could do is stop using plaintext files to store passwords.

But no. Second attack with the same results and now a third.

So no. They're not even close to be characterized as skilled (and that goes especially for the managers/whoever did not decide to leave the I-store-passwords-as-plaintext practice).

nether• 12 years ago

Just... stop. This is sounding close to Reddit's moonbattery over the Boston marathon bombing being an inside job.

easytiger• 12 years ago

In my experience it is worth ignoring anything said by anyone selling security software in matters of security.

drcongo2• 12 years ago

Not being fluent in American English, does that headline make any sense at all? Because it sure doesn't in English English.

corin_• 12 years ago

To me it makes sense but doesn't parse nicely at all (also British here) - i.e. doesn't confuse me, but I absolutely would re-write it if I was the editor.

sp3322• 12 years ago

Nope, not even American Headlinese where you can get away with "Infant Pulled from Wrecked Car Involved in Short Police Pursuit". https://en.wikipedia.org/wiki/Syntactic_ambiguity#In_headlin...

alistairSH• 12 years ago

While it might be technically correct, it's extremely awkward, doesn't roll off the tongue at all, and I had to read it several times.

daledavies• 12 years ago

I don't think anybody actually saw anyone doing anything did they?! I can see what they were trying to say, but certainly wouldn't have written it like that.

camperman• 12 years ago

It's grammatically incorrect. English pluperfect tense should be used like so:

Sony Hackers Seen Snooping for Months, Planting Bomb

The actions of snooping and planting the bomb are in the past but before the implied event of discovery which is also in the past so it must be pluperfect. The form "Having Snooped" can only be used in a pluperfect inversion such as:

Having snooped around for months, the hackers planted a bomb.

drcongo2• 12 years ago

Thank you!

junto2• 12 years ago

Ah, so it seems to be confirms that North Korea are definitely behind the Sony hack. Thank you Bloomberg security consultant.

quahog• 12 years ago

I think the truth could run in one of two directions. Todays news implied that Iran, China and North Korea were in cahoots and aggressively attacked Sony for months and finally penetrated their bastion. Sony was helpless to defend. That is what the press and FBI seem to be saying.

The facts seem to say that Sony was incredibly incompetent and had all sorts of sensitive files sitting on servers with no access protection. Sr. staff never deleted emails and made newsworthy statements in their emails, especially ones that attacked celebrities and even the President. With this juicy material, including unreleased movies, all free for the taking, the hackers used well known standard techniques to penetrate. Then they leisurely sucked down a lot of information and no one noticed the traffic.

While there is no excuse for theft, if I have shoddy locks, no lights, no alarms, on my home I may be at more risk than if I had solid locks, security systems, lights, etc. Whether it was North Korea or the next door neighbor, it was not a particularly difficult crime to pull off.

connie_lingus• 12 years ago

this narrative just seems way to neat and prepackaged and allows under-informed US citizens to consume it and still feel safe and make sense of the connected world we all swim in every day.

i agree it's being spoonfed via media and politicians, but to me, that's all the more reason to be highly suspect of it.

this event is becoming the ultimate nail to everyone's hammer.

towelguy• 12 years ago

hackers

Sometimes I wonder if I should keep wasting breath trying to get people to call crackers for what they actually are.

eterm• 12 years ago

You absolutely should stop wasting breath trying to define how others use language.

Hackers is clear in its meaning in this context.

cek• 12 years ago

I found the use of "minions" interesting in this article. First time I've seen it used in reference to malware or a virus.

DontBeADick• 12 years ago

That title is mildly infuriating. Using the term "bomb" to refer to software when actual bomb threats have been made is the epitome of clickbait.

faragon• 12 years ago

Why hackers attack that hard Sony and not other companies? Or they don't spend enough in securing their systems?

Sony Hackers Seen Having Snooped for Months

Related Stories