New Study Adds to Skepticism Among Experts That North Korea Was Behind Sony Hack

http://bits.blogs.nytimes.com/2014/12/24/new-study-adds-to-skepticism-among-security-experts-that-north-korea-was-behind-sony-hack/?ref=technology&_r=0

by dnetesn • 12 years ago

46 49 12 years ago

bits.blogs.nytimes.com

lbenes• 12 years ago

Sony just had a major layoff,pointing to a possible insider.[1] Many Koreans work for Sony and they may have had a personal gripe with NK.“Guardians of Peace” comes from a quote used by former President Richard Nixon describing South Korea.[2] In this debate[3], the security expert on the side of the FBI keeps rehashing the old it's the same IP address debate. But I don't buy it. Those are open proxies.

Combine that with the fact that North Korea has a terrible education system and an entimated 1 in 10,000 people have access to the Internet in North Korea. This is not the kind of environment that fosters elite super hackers. I don't think NK did it.

[1] http://www.polygon.com/2014/9/18/6377971/sony-financial-resu...

[2] http://www.thedailybeast.com/articles/2014/12/20/sony-hacker...

[3] https://www.youtube.com/watch?v=vNCpHM4BBJQ

spcoll• 12 years ago

If DPRK has the capacity to pull this sort of hacking feat on demand, it begs the question: why aren't they doing it around the clock, to hurt their enemies that they seem to hate so much? It's just not very realistic to think that DPRK has this super secret hacker army (but not so secret that we haven't heard of it in the media) that can hack any large corporation (but can't cover its own tracks). If they did, we would see it action all year long.

This hack sounds like the work of a large, professional, well-funded organization that only uses its capabilities in a very targeted, parsimonious manner. But what would be the motive for the US govt to hack Sony and then accuse DPRK? Distract the public from the CIA torture report? Something else?

TillE• 12 years ago

the capacity to pull this sort of hacking feat on demand
that can hack any large corporation

That's not how hacking works. Even if you have a collection of zero-day exploits, it's entirely dependent on the software and configuration of a target's computer systems. Or your own luck with social engineering.

meowface5• 12 years ago

This is not a hacking feat at all. Perhaps if this was the DoD and not Sony.

Extracting and exfiltrating many TB of data would take a bit of experience, but even some experienced script kiddies could likely get a foothold on Sony's network without much difficulty.

ceejayoz4• 12 years ago

Combine that with the fact that North Korea has a terrible education system and an entimated 1 in 10,000 people have access to the Internet in North Korea. This is not the kind of environment that fosters elite super hackers. I don't think NK did it.

You could say the same for nuclear programs and rockets. People showing technical aptitude are likely singled out for special training and given perks unheard of by the general population.

Plus, from what we've heard, the Sony hack didn't require remarkable levels of skill. They were doing things like storing major account passwords in text/Excel files on a shared drive.

XorNot3• 12 years ago

The only problem being that there's a much larger population of more skilled people who would do it "for the lulz" everywhere else in the world.

GabrielF002• 12 years ago

Combine that with the fact that North Korea has a terrible education system and an entimated 1 in 10,000 people have access to the Internet in North Korea. This is not the kind of environment that fosters elite super hackers. I don't think NK did it.

Business Insider spoke to a defector about the DPRK's cyberwarface program[1]. Even if they can't develop hackers organically, they can build a small cadre by selecting some people who might be talented, hiring outside experts to train them and giving their trainee hackers certain privileges. An analogy might be that in the US, we build our olympic teams organically - athletes choose what they want to do based on personal interest and it's a good environment in which to grow as an athlete. North Korea has a terrible environment to develop athletes organically, but they can hire outside experts to train a small cadre of their own people. They win a few gold medals every summer Olympics.

http://www.businessinsider.com/north-korean-defector-jang-se...

XorNot3• 12 years ago

The only problem being that no outside expert with the right skillset would ever travel to North Korea, and them doing so would be highly suspect.

Even if NK wanted to build such a team, the reality of nation-states is that you can't make up for the complete failure of your society with just money alone. The degree to which the Soviet Union turned out to be behind the US during the Cold War speaks to that - and NK is a lot worse off then the Soviet Union.

leoc• 12 years ago

Additionally, there is an estimate (from a facially plausible source) that North Korea has as many as 10,000 people working in IT outsourcing http://cacm.acm.org/magazines/2012/8/153816-inside-the-hermi... (yes, despite the fact that the IT firms don't have full Internet access). It also has to be pointed out that Sony's famously not the hardest target in cyberwarfare.

HillRat• 12 years ago

North Korea has a terrible education system and an entimated 1 in 10,000 people have access to the Internet in North Korea. This is not the kind of environment that fosters elite super hackers.

It's also not the kind of environment that fosters high-energy physicists, but we're talking about a regime that has indigenously developed nuclear weapons.

The NK government already has an "official" Linux distro, "Red Star OS," indicating at least some level of technical ... well, let's not say prowess, let's say comprehension. (Likewise, the proliferation of cheap high-tech goods smuggled over the Chinese border has forced the NK government to announce its own smartphone, though few people believe the factory to be anything other than a Potemkin fab, with the actual phones shipped over from China.)

You have to assume that a nation state, even one as impoverished as NK, can mobilize the kind of cash necessary to train a few hundred (at most) hackers, using Chinese or Russian instructors. It's much cheaper than hiring Makeyev OKB to design another ballistic missile system, and, unlike nuclear and missile tests, the international community doesn't have a unified playbook for dealing with target hacks, particularly against non-governmental systems. No one's going to war for Sony, but if NK is behind (or believed to be behind) the attack, you can bet that the USG has found Sony's experience to be rather bracing.

Having said that, I agree that the evidence favoring NK as the culprit is circumstantial and hazy at best. Even the best evidence they're provided is dependent on a chain of assumptions that I think haven't been properly validated.

This isn't a "WMD in Iraq" situation, because the USG would have loved for the Sony hack to be a bunch of anons doing it for the lulz (though now that the government has committed to the NK story, it's hard to backtrack). After all, we couldn't do much over NK's nuclear program, which is a crisis many, many orders of magnitude more serious than the Sony hack; calling out NK for this just underscores the fact that we don't have many levers to move against Pyongyang.

hasslein• 12 years ago

It's also not the kind of environment that fosters high-energy physicists, but we're talking about a regime that has indigenously developed nuclear weapons.

A minor quibble, but North Korea did not indigenously develop nuclear weapons - they acquired most of their knowledge and capabilities from Pakistan via the Khan network. They most certainly spent a great deal of effort internally to convert said knowledge into functional nuclear devices, but by no means did they develop everything internally.

sroerick• 12 years ago

I challenge your source for [2].

I looked for the name Guardians of Peace prior to that meme starting, and after the George Clooney article came out, I looked again. While Nixon did use the phrase Guardians of Peace a number of times, I was unable to find it in conjunction with Korea. As far as I can tell, the only source saying Guardians of Peace is a SK reference is George Clooney.

Frankly this backs up what you are saying.

Given this fact: http://iowa.barstoolsports.com/random-thoughts/sony-paid-kev... I'm not willing to trust George Clooney at his word.

snarfy• 12 years ago

So is the US government lying, or incompetent?

squozzer3• 12 years ago

I'll go with lying. Blaming NK serves their political agenda for now. It's still not outside the bounds of reason to believe Sony Pictures did it themselves.

EpicEng• 12 years ago

I'm curious as to what exactly that agenda would be. Also, I think it is very much outside the realm of reason to think that Sony did this as a PR stunt. If they did... Well, Sony legal is probably not having a great Christmas.

GabrielF002• 12 years ago

It really doesn't make any sense to me that blaming North Korea serves a political agenda for the administration. They have a limited time left in office and they're trying to use it to accomplish something in foreign policy (so far, Cuba, a climate deal with China). This is particularly important since the President's domestic influence will be limited. This business with North Korea seems like a distraction. It's not serious enough that it's going to change anything in the relationship between the US and the DPRK. The DPRK is so unpredictable that starting a beef with them unnecessarily seems like a terrible idea. It's another item on the agenda with China, and I'm sure that there are a lot of other things that we would rather be discussing with the Chinese.

dba7dba5• 12 years ago

What political agenda? No one is FORCING NK to threaten war against SK and US. All NK has to do is shut itself up but it can't do that.

squozzer3• 12 years ago

It's called distraction. You should look up the word sometime.

squozzer3• 12 years ago

Please pardon my cynicism. Maybe Saddam Hussein had WMDs after all, and the Spanish sank the Maine.

uniformlyrandom3• 12 years ago

Both. They are not competent enough to figure out who really did what, but they are using the opportunity for political impact.

Same as with Iraq's WMDs, or Syria's chemical weapons.

sonoffett• 12 years ago

From the latest reports it seems that the advanced torture, cough ahem enhanced interrogation, techniques were designed and used partially to craft evidence to support an Iraq invasion [1], which seems even more sinister than what you had mentioned.

[1] http://www.democracynow.org/2014/12/23/ex_bush_official_us_t...

tim333• 12 years ago

Potentially interestingly, a guy from Norse security figures:

data is pointing towards a woman who calls herself "Lena" [...] someone who worked at Sony in Los Angeles for ten years until leaving the company this past May.

So we may actually get a proper answer as to who did it. Maybe.

http://www.cbsnews.com/news/did-the-fbi-get-it-wrong-on-nort...

nostromo• 12 years ago

It's worth noting that the original demand of the hackers was for money from Sony in exchange for not releasing embarrassing information. There was no mention of the movie "The Interview"

That alone really pokes a hole in the official narrative.

meowface5• 12 years ago

This isn't really true.

http://regmedia.co.uk/2014/12/08/sony_hack.jpg

http://cdn.arstechnica.net/wp-content/uploads/2014/11/sonypi...

These are the two original defaces on Sony's computer systems. Neither mention money, just vague "obey our demands or we will expose all your data". The first one explicitly mentions a "great effort to peace of the world", in line with the name "Guardians of Peace".

Why would a disgruntled insider make something up about world peace if they just wanted money?

Not saying that means it's necessarily North Korea, but I'm pretty sure the actors either had The Interview as a real motive, or used the movie as a pretext, from day 1.

dba7dba5• 12 years ago

NK IS very desperate for cash. Very very much.

uniformlyrandom3• 12 years ago

Lena

So she is Russian. How convenient. We can blame NK and Russia.

laxatives• 12 years ago

Lena is the name of one of the most common test images used in image processing. If someone involved had a degree or background in electrical engineering, they would know this name.

shadowmint• 12 years ago

I doubt anyone seriously believes NK could have manufactured the malware that was used.

...but it's plausible they may have paid other people to do it; or at least seed funded some third party (eg. russian hackers).

To be fair to the NSA; they're not retards.

Evil... maybe. But stupid? I don't think so.

If they (via the FBI) say it was NK, they probably have something to back that up (eg. intercepted communications or money trail that leads back to the NK).

Interesting point drops out of it though; I'd say it's pretty obvious the NK were never in control of the data or malware. If they paid for it, are they still to blame? Or are the people who actually did the hack to blame...?

dba7dba5• 12 years ago

I doubt many 'hackers' manufacture the malware themselves these days. Many buy/copy from others.

And we keep saying NK doesn't have enough capable human talent but they developed nukes and launched a mid range ballistic missile. Surely they can lock up some men in a building and teach how to run malwares?

IF NK paid for it, they are responsible still.

meowface5• 12 years ago

I doubt anyone seriously believes NK could have manufactured the malware that was used.

It's actually quite possible. The Shamoon/Destover family borrows a lot of code from commercial products, with some standard command & control functionality added. This is not Stuxnet style malware: Stuxnet was designed to spread perniciously and send precise commands to SCADA controllers; this malware is designed to wipe drives and capture basic information and files at the behest of an operator.

Many groups could have made this malware, nation-state or otherwise, including NK.

_almosnow• 12 years ago

Here's an idea for the government:

Detonate a nuclear device somewhere isolated where you already detonate nuclear stuff for fun. However, this time say that it wasn't planned at all.

Proceed to fabricate a story where the nuclear warheads were connected to the internet but with extremely high security measures. Why? Because, who knows, maybe the president is someday in the middle of a world crisis and the only way to launch nuclear retaliation is through some internet channel. Then proceed to say that North Korea and his world-class elite terrorist hackers (with the help of some insider scapegoat that you can take from jail) managed to HACK (it is important that you use this term) into the system and launch the nuclear device; fortunately they were programmed to strike on desolated terrain, god bless us all :'). Clearly, this is a direct attack towards american ground and it's people; without a doubt, a formal declaration of war. #KIMISBAD, #STOPNK2015, etc... ensues. Invade the country then, with the public's approval. And finally accomplish your goal: a military base in the outskirts of China.

oskarth• 12 years ago

Not to mention the higher approval ratings for NSA et al.

SixSigma• 12 years ago

Post-Watergate, post-Snowden

The only times the state has been caught lying!

New Study Adds to Skepticism Among Experts That North Korea Was Behind Sony Hack

Related Stories