20 ms·

U.S. blames North Korea for 'WannaCry' cyber attack

99 points by wybiral 9y ago

fiblye 9y ago
I've got to say, I'm incredibly impressed by how a country with zero computer education or infrastructure manages to launch a successful cyber attack against the most militaristically aggressive nation on earth right as that country is trying to pin them--a country with zero conflicts in 60 years--as the world's biggest threat.
- slededit 9y ago
  They've even got their own Linux distro: https://en.wikipedia.org/wiki/Red_Star_OS https://en.wikipedia.org/wiki/Red_Star_OS
- ztratar 9y ago
  Zero conflicts in 60 years? Hah. You forget that NK is still technically at war with South Korea. It's been non-stop conflict for 60+ years.
- wybiral 9y ago
  It's not as if they don't have computers [1]. Besides, the WannaCry attack was mostly facilitated by exploits that were leaked by Shadow Brokers [2] [3]. The skills required to slap those exploits onto a basic ransomware tool weren't very demanding. [1] https://en.wikipedia.org/wiki/Bureau_121 https://en.wikipedia.org/wiki/Bureau_121 [2] https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue [3] https://en.wikipedia.org/wiki/DoublePulsar https://en.wikipedia.org/wiki/DoublePulsar
- kevin_thibedeau 9y ago
  Just like how China funnels missile technology to DPRK and then feigns shock when they have a success, I wouldn't be surprised this was a gift from Unit 61398.
- nitwit005 9y ago
  There was some kidnapping, terrorism, artillery fire and missile launches in those 60 years. Not exactly what most people would call "zero conflicts". It's not particularly hard to get some software people. You may notice they've trained and hired enough people to run their nuclear program. That's a lot harder than cobbling together some software exploits.
  - steve19 9y ago
    They will be employing black hats from around the world and paying them a lot of money. Suddam Hussain used a Canadian to build his supergun for example. https://en.m.wikipedia.org/wiki/Gerald_Bull https://en.m.wikipedia.org/wiki/Gerald_Bull
    - rdtsc 9y ago
      I remember reading about Bull, interesting stuff. > Bull then started work on the "real" PC-2 machine, a gun that was 150 meters long, weighed 2,100 tonnes, with a bore of one meter (39 inches). It was to be capable of placing a 2,000-kilogram projectile into orbit. Also noticed you were downvoted, can't figure why anyone would do that. Maybe they disagree that NK can employ black hats, but why not just comment on that in a reply...
      - jamoes 9y ago
        As far as I'm aware, a gun can't shoot a projectile into orbit - no matter how high it shoots a ballistic, the ballistic will eventually come back to earth (unless it gets captured by another body's gravitational field). In order to achieve orbit, you need to impart additional energy onto the object in order for it to get enough velocity to actually orbit.
        rdtsc 9y ago
        You are probably right, I just copied it from Wikipedia verbatim. I did have the "citation needed" label. My pedestrian take on this is if Iraq could afford to build a gun which shoots satellites into orbit, after all these years we'd have a few of those around by now. But it just highlighted the craziness and planned scale of the project. The assassination of course also adds to the intrigue.
- seanwilson 9y ago
  Why? It's not like you have to invest in expensive equipment and enrol into some kind of specialist training programme that only some countries have access to. You just need a computer, access to material online and determination. Plenty of hacks and viruses are done by independent individuals and small groups not linked to the government.
  - mbesto 9y ago
    Ya, but you need enable actors to learn. This is the dichotomy I too don't understand about NK - how do you presumably give software engineers access to the internet, while still restricting them to your firewall and still be able to create sophisticated malware. At some point those engineers will "stumble" on information that says "you're not free in your country...get out"...no?
    - wybiral 9y ago
      There have been defectors.
    - freedomben 9y ago
      Simply hearing the message "you're not free in your country...get out" is far from enough for the average person. They are completely inundated from birth with worship of the Great Leader. There's an awesome book called "Mig Pilot" by John Barron that details the story of a Soviet defector in the 80s. He talks about how he believed everything from the US was actually propaganda. He didn't even believe the grocery stores were real. It's a fascinating read.
      - marcoperaza 9y ago
        North Korea punishes your whole family if you misbehave. If you're a North Korean hacker, you're probably living better than 95% of the country. You and your family probably get to live in Pyongyang and get good food, housing, healthcare, opportunities for your children, and so forth. Why would you risk that? What could you, as one person, possibly do that would have any chance of success in fixing your country? The only thing you would get is your whole family thrown into a labor camp for the rest of your lives.
- meowface 9y ago
  Considering their likely military budget, it's not hard to imagine they could train a small percentage of the military in cyberespionage. Or they could outsource it to other nation-states or organizations. It isn't that difficult to find talented, (ostensibly) nationalistic kids, train them for years, and have them conduct operations like this.
- marcoperaza 9y ago
  >right as that country is trying to pin them--a country with zero conflicts in 60 years--as the world's biggest threat. What's the implication here? That the US is somehow unjustified in being alarmed by NK becoming a full nuclear power, soon with worldwide ICBM range? Think about the situation in that country. A small cabal of crooks lives like kings while the rest of the country suffers a never ending reign of terror, involving public executions in school yards, horrific labor camps, total surveillance, punishment of whole families, etc. The guy in charge is a sicko who executed his uncle with an anti-aircraft gun, and probably had a good laugh throughout the whole thing. The previous leader, his father, did such things as kidnap South Korean actors to force them to put on shows for him. These are deeply deranged people. Now imagine that regime on the verge of collapse, for one of the many possible reasons that could happen. The cabal of crooks know that they will all be executed by the North Korean people for their crimes. How sure are you that, when that moment comes, the regime won't launch nukes against all of their longtime enemies, just for the hell of it as a parting fuck you to the world?
  - fiblye 9y ago
    >What's the implication here? That North Korea is justified in building up their arsenal to protect themselves from a country that has actively sought to topple other governments it simply just doesn't like. That vast majority of threats North Korea makes are "If America does this, we will retaliate." Meanwhile, American politicians endlessly call for preemptive strikes on Iran and North Korea because they've allegedly been on the verge of wiping out humanity for decades now. I've stopped buying the bullshit, but the "Kim Jong Un got gout from cheese and died but only before killing his uncle with an antiaircraft gun" headlines keep rolling.
    - SubiculumCode 9y ago
      If only for how they have oppressed their poor people, the NK regime deserves annihilation.
      - fiblye 9y ago
        If there's one thing America has mastered, it's the art of starting conflicts with "good intentions" like this and causing more harm than their enemy. See: Libya, Vietnam, Iraq. Every few years Americans say "never again", until the media sells the same lies as before and people forget.
- foobaw 9y ago
  They don't have zero computer education or infrastructure though. Although the details will never be known, they've been known to have a pretty strong education system. I know this example can be considered moot, but their IMO (International Math Olympiad) performance has been stellar, so if they can apply the same methodology to Computer Science and Education, it's possible that they have some skilled "hackers."
  - freeflight 9y ago
    They pretty much have their own Linux distro [0], which imho is a very smart thing to do for a nation-state, at least if it's done properly. [0] https://media.ccc.de/v/32c3-7174-lifting_the_fog_on_red_star_os https://media.ccc.de/v/32c3-7174-lifting_the_fog_on_red_star...
- toomanybeersies 9y ago
  > a country with zero conflicts in 60 years https://en.wikipedia.org/wiki/List_of_border_incidents_involving_North_and_South_Korea https://en.wikipedia.org/wiki/List_of_border_incidents_invol... Incidents ranging all the way up to shelling South Korea and torpedoing their ships. The country has literally been at war since 1950.
- malloryerik 9y ago
  Lol. They have a determined crew of 6,000 hackers. [0] They stole $100 million from the Bank of Bangladesh in a Dridex attack, and nearly made off with another billion dollars or so. Now, stealing from a needy country like Bangladesh, that's despicable. [1] They also have perhaps the most controlling state in history and they are disciplined, if poor. In fact, according to a holocaust survivor who was subsequently a judge at the International Court of Justice at The Hague, North Korea's political prison system is as bad as or worse than the Nazis'. [2] They have zero human rights, no real justice system, gays and lesbians are put to death, mixed-blood children are murdered by the state (the government is openly and bone-chillingly racist). As for "zero conflicts" you can thank geography and Pax Americana for that as there has been no one for the North Koreans' to attack, though have been constant int'l abductions and assassinations (incl an attempt on the South Korean president), the destruction of a passenger jet, the torpedoing of a South Korean navy vessel, the shelling of a South Korean island, constant drug sales and arms sales by the government including the sale and construction of a nuclear plant to and for Syria, the sale of chemical weapons (those kids killed in gas attacks in Syria, yep, North Korean gas), the overseas sale of hard drugs by the government to raise foreign revenue, and most important and egregious, the wholesale murder and enslavement of their own citizens, if the word "citizen" can be used. In the 1990's during the "Arduous March" the government allowed up to a million people, 5% or the population, to starve unnecessarily while food aid was diverted to the military and funds were used to build up their nuclear program. Malnutrition was the norm. Since being established by the Soviet Union, the DPRK (Democratic People's Republic of Korea -- and the only honest word that name is "Korea") have consistently threatened their neighbors, once invading South Korea with full force after receiving Stalin's approval (a fact which can be read in the Soviet archives). If they haven't attacked again, it's purely because they don't have the means. Oh yes, and they have been hacking, and are considered one of the world's seven cyberpowers along with the U.S., Russia, China, the U.K., Iran, and France. [3] I don't mean to say that nobody ever has a happy life in North Korea. And I don't have time to go on and on about North Korea, but to pretend that they are mere victims is ludicrous. They inherit some of the worst aspects of the old Joseon Dynasty, the Japanese Empire, and Stalin-era Soviet Union, and manage to add to that. This isn't to say that the U.S. is without significant blame, of course not. For example the U.S. punished and traumatize North Koreans with an unbelievably destructive wartime bombing campaign after the North invaded the South. But despite serious mistakes the overall aim of the U.S. has been to create a world of growth and stability. During this Pax Americana, with and because of the help from allies and the creation of a global community of states, the world has indeed grown faster than ever before, despite everything that's gone wrong, and there has been less violence. [0] https://news.ycombinator.com/item?id=15480571 https://news.ycombinator.com/item?id=15480571 [1] https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery [2] https://www.huffingtonpost.com/entry/north-korean-prisons-nazi-camps_us_5a2fad6ce4b0461754330e3d https://www.huffingtonpost.com/entry/north-korean-prisons-na... [3] https://www.vox.com/world/2017/10/13/16465882/north-korea-cyber-attack-capability-us-military https://www.vox.com/world/2017/10/13/16465882/north-korea-cy...
forapurpose 9y ago
It's essential to remember that many wars begin with errors of attribution, and many of those errors are intentional or at least reflect a strong bias in the accusers. Examples off the top of my head: * 'Remember the Maine' instigated the Spanish-American War, but much evidence says the Maine was destroyed by accident. William Randolph Hearst, a leading publisher of yellow journalism, famously promised a compatriot: "You furnish the pictures and I'll furnish the war". * The Gulf of Tonkin incident instigated American involvment in the Vietnam War. * Iraq's weapons of mass destruction program, which didn't exist, instigated the Iraq War. In today's case, I trust the source much less than many of those who have made prior errors. I also note that it was a the head of Homeland Security, a political appointee, who made the accusation. It was not the head of the FBI or an intelligence agency; it is not represented, at least in the reporting I've seen, as a consensus of the US intelligence community; I also note that the White House has left some distance between itself and the accusation - it's not made by the President or his National Security Advisor, for example. Also, the very serious accusation rings of hype. North Korea has acted especially badly, largely unchecked, for more than a decade, which is false and a political swipe at the prior President. If that part of the accusation is exaggerated and political, I wonder about the other parts, and I wonder about the accusers ability or willingness to separate politics from very serious policy.
- wybiral 9y ago
  > North Korea has acted especially badly, largely unchecked, for more than a decade, which is false and a political swipe at the prior President. How is that false? PS: The US government isn't the only group pointing the finger in the direction of NK here [1] [2]. [1] http://www.bbc.com/news/technology-40297493 http://www.bbc.com/news/technology-40297493 [2] https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group https://www.symantec.com/connect/blogs/wannacry-ransomware-a...
- astebbin 9y ago
  Despite the truth of your historical timeline, 'WannaCry' does neatly fit the profile of Room 39, a department of the North Korean government which raises foreign currency through cybercrime and other criminal activities [0][1]. They have been implicated in past hacks by non-U.S. groups as well, including Kaspersky Labs [2]. [0] https://www.washingtonpost.com/world/asia_pacific/he-ran-north-koreas-secret-money-making-operation-now-he-lives-in-virginia/2017/07/12/4cb9a590-6584-11e7-94ab-5b1f0ff459df_story.html https://www.washingtonpost.com/world/asia_pacific/he-ran-nor... [1] https://en.wikipedia.org/wiki/Room_39#Purpose_and_activities https://en.wikipedia.org/wiki/Room_39#Purpose_and_activities [2]http://money.cnn.com/2017/04/05/news/economy/north-korea-economy-china-trump-xi/index.html http://money.cnn.com/2017/04/05/news/economy/north-korea-eco...
jakenberg 9y ago
While the DPRK cultivates their talent, we indict ours: https://www.theguardian.com/technology/2017/aug/03/researcher-who-stopped-wannacry-ransomware-detained-in-us https://www.theguardian.com/technology/2017/aug/03/researche.... As someone else here has noted, it is impressive what DPRK has put together with comparatively limited resources. It makes me wonder what the cyber-landscape is going to look like in the coming years as the U.S. continues to ostracize the already scarce few who actually know how to reverse engineer malware, AND have the ethics to properly report it.
- deleted 9y ago
  [deleted]
- kchoudhu 9y ago
  Does cultivation of tech talent matter when the chance of execution by mortar shell is present? http://www.telegraph.co.uk/news/worldnews/asia/northkorea/9630509/North-Korean-army-minister-executed-with-mortar-round.html http://www.telegraph.co.uk/news/worldnews/asia/northkorea/96...
badrabbit 9y ago
And mirai was the russians! (Sarcasm,it's not). I'm not saying it's not NK,just that there are plenty of well funded large scale advanced blackhat organizations (e.g. - Dridex). It's also known that NK has foreign offices in China and elsewhere. Russians recruit hackers for their APT work and in exchange let the hackers do whatever they want,why not NK hackers? If you were a NK hacker in china,wouldn't it cross your mind to weaponize a treasure trove of NSA tools into a profitable ransomware? Code similarities with lazarus group tools can be explained by this and other similar plausible theories. NK is low on cash so it could have been a pyongyang directive. But the whole operation lacks a lot of the operational and organizational details a typical APT operation would exhibit. A kill switch but no whitelist to avoid annoying allies. when kill switch was discovered I would expect a nation state operation to quickly adopt. Nation states love hoarding strategic compromises (typically websites,botnets,etc...) As far as I know,no pre-existing botnet or compromised sites took part in catalyzing the worm. Again,not saying it's not NK,I'm just saying a few too many things seem off, I take this attribution with a few grains of salt.
- wybiral 9y ago
  I doubt WannaCry or the Shadow Brokers leaks were meant to actually make money. They seem more like they were executed to make NSA look worse than it already does. Most of the recent sensationalized leaks have seemed to fit that bill. But you're right, attribution here is dangerous unless they have some solid evidence.
  - sitkack 9y ago
    Every byte is placed with purpose.
- StanislavPetrov 9y ago
  As always, the issue is credibility. Among the small group of reality-based people in the US, the government has absolutely no credibility. Unless and until independently verifiable proof of their assertion is released, nobody with a shred of intelligence or critical thinking skills should believe anything they say. This is especially true when they want to slaughter countless numbers of people based on an unsupported assertion.
grondilu 9y ago
I was about to write "I'm not sure pointing fingers like that is the best diplomatic attitude there is", but then I thought I should read the article first. Amusingly enough, when the page showed up, I saw the accompanying video thumbnail which was precisely a hand with a pointing finger.
kakarot 9y ago
If you don't like what's being said, change the conversation... North Korea has no place in this discussion. The entity responsible for the WannaCry debacle is a US-based spy organization we all know and love.
- Alex3917 9y ago
  > If you don't like what's being said, change the conversation... Maybe. There's probably also a lot of countries who would love nothing more than to grab some popcorn and watch the U.S. and North Korea start nuking each other, much the same way that the U.S. 'manages' the Middle East and South America by getting random countries to start genociding each other.
  - kakarot 9y ago
    That isn't the point. The exploits WannaCry abused were known by this organization and not made known to Microsoft so that they could be exploited and not patched. Since many of these machines ran critical services, this was a hostile act against the general public of the United States and all blame falls on them.
    - willstrafach 9y ago
      > not made known to Microsoft so that they could be exploited and not patched. They did make Microsoft aware, and a patch was pushed out. Those affected had not patched their systems, unfortunately a bit common in some enterprises. So giving Microsoft a heads up has little to do with it.
  - StanislavPetrov 9y ago
    There are also a lot of authoritarians in the US and globally who thirst for war as a vehicle to consolidate their own power.
    - mirimir 9y ago
      And indeed, perhaps they have manipulated NK to become just the threat that they need. Scary enough, but not very dangerous. Except to SK and Japan. And to China, which may in fact be the primary target.
pwdisswordfish2 9y ago
I blame Microsoft. Honestly. They are the root cause. It does not matter who conducts the attack. It matters that the attack is possible. It is possible because of the software. Microsoft wrote that software and released it to the public. Upgrade is not a substitute for recall. Selling defective software should be no different than selling a defective automobile. Users of defective products cannot be blamed for the defects.
pinkskip 9y ago
sure, what else? who else? it's very rich coming from a country who facilitates (cough!! NSA) warrantless surveillance on it's own citizens.
- averagewall 9y ago
  That's not as important as the fact that it spies on foreigners and hacks their computers. Americans somehow decided spying and hacking is OK as long as it's being done to others, not themselves. They shouldn't be surprised that other countries hold the reciprocal views.
  - jcoffland 9y ago
    > Americans somehow decided spying and hacking is OK I'm still trying to remember when I was asked of this would be OK.
  - Retra 9y ago
    Other countries will hold reciprocal views regardless of American sentiments on the issue. Nations are not people and hypocrisy doesn't matter on an international scale. Any student of history would see this.
NightlyDev 9y ago
I find it intriguing that people somehow seems to know who's behind stuff. It's not exactly hard to hide all traces, so I find it hard to believe that a state would fail doing so. The US is clearly the one to blame for WannaCry. If it wasn't for the NSA leaking and not reporting vurnerabilities this would probably never have happened.
- phaus 9y ago
  Perfect operational security is insanely hard, especially once an organization grows beyond a few people. Theorizing about the ways one might perfectly cover all traces of an attack is quite a bit different from executing an attack against a large organization, moving through their systems and networks to look for sensitive data, exfiltrating the data, and then repeating this process for dozens of targets, year after year, without ever being detected or ever leaving a trace of anything.
- pwaai 9y ago
  More intriguing to me is how some people here are trying to claim this isn't North Korea, where it has all the markings of past North Korean cyberattacks and consistent with published findings about their specific departments tasked with the goal of raising money for Kim's private fund. https://en.wikipedia.org/wiki/Room_39 https://en.wikipedia.org/wiki/Room_39
  - NightlyDev 9y ago
    My guess is that it's most likely just a kid somewhere who had some fun. Considering the kill switch the person behind this clearly didn't have much experience, so I find it very very hard to belive that some other state than the US was involved in this.
    - pwaai 9y ago
      Your guess is as good as redditor
pepsi 9y ago
Is this official level blame just another checklist item towards justifying the US doing a "military action" on NK?
- trynumber9 9y ago
  No, because not even Americans are stupid enough to believe the US will do a "military action" on a nuclear power. Fewer still see malware as casus belli.
  - JumpCrisscross 9y ago
    We have "render safe" procedures for e.g. a collapse of the Pakistani government. We likely have similar plans for North Korea. In any case, the nukes aren't the insurmountable problem. It's the volumes of hidden artillery trained on Seoul that are problematic.
    - trynumber9 9y ago
      I see some difference between a checklist for starting a nuclear (or as you pointed out, shrapnel) holocaust and contingency planning.
    - deleted 9y ago
      [deleted]
    - deleted 9y ago
      [deleted]
  - StanislavPetrov 9y ago
    A very optimistic assessment.
    - deleted 9y ago
      [deleted]
- jonathanmarvens 9y ago
  Yes, precisely.
craigc 9y ago
The earliest reports I can find claiming that North Korea may have been involved were from the middle of May: https://www.theverge.com/2017/5/15/15643226/wannacry-ransomware-north-korea-attribution-wannacrypt https://www.theverge.com/2017/5/15/15643226/wannacry-ransomw... https://www.theguardian.com/technology/2017/may/15/wannacry-ransomware-north-korea-lazarus-group https://www.theguardian.com/technology/2017/may/15/wannacry-... There is nothing conclusive there though If this is not the most convenient way to justify going to war with North Korea then I don’t know what is. It is almost as if the hackers WANTED to get caught by reusing code that was previously used in an attack initiated by North Korea. Also we shouldn’t forget that it was an exploit developed by the NSA to begin with. Weapons of Mass Destruction anyone?
- pulisse 9y ago
  In October, Microsoft officially blamed North Korea[1], as did the UK government[2], neither of whom is trying to lay the groundwork for war. [1] http://www.itv.com/news/2017-10-13/hacking-threat-is-as-serious-as-terrorism-says-microsoft-boss http://www.itv.com/news/2017-10-13/hacking-threat-is-as-seri... [2] https://www.cnbc.com/2017/10/27/uk-north-korea-behind-wannacry-cyber-attack-that-crippled-nhs.html https://www.cnbc.com/2017/10/27/uk-north-korea-behind-wannac...
  - jacquesm 9y ago
    In the run-up to the Iraq war there was this group of UN weapons inspectors that had concluded based on the available evidence that Saddam did not have WMD. That did not stop the UK from going ahead with their bit in the Gulf War. If a war is to be had evidence doesn't really matter. It could be fabricated far easier than you could have real evidence, history has quite a few examples. Given the current political climate in the UK I would not put it past them to start making stuff up, a distraction from internal strife is always a good reason to start a war. Microsoft - I hope - is another matter. The reason why - at least, to me - there is little point to either the UK or the US wanting to start a war with NK is that unlike Iraq NK actually has a good chance of inflicting massive damage on an ally. Plus the lottery ticket of Kim being able to lob a nuke halfway across the globe and make it stick even if attacked might be another item that gives pause to the powers that be. So, whether NK is behind these attacks or not is absent very solid proof an open question, whether or not the government is laying the grounds for war hardly matters, those are not necessarily connected, though they could be it would be a first to go to a shooting war with a nation state over a cyber attack.
alhafizco 9y ago
https://www.youtube.com/watch?v=6GTqoiH3FUk&feature=youtu.be https://www.youtube.com/watch?v=6GTqoiH3FUk&feature=youtu.be
mmaunder 9y ago
I'd like to see the attribution data. Don't hold your breath.
eksemplar 9y ago
You should really distinguish between "the US" and "the Trump admin". This may be a little hard, but the latter has no credibility internationally. The Trump administration is clearly pushing for a stronger take on North Korea and its had no problems lying in the past. Sure North Korea might be behind this, but at this point Trumps credibility is so low they might as well be blaming unicorns.
- RickS 9y ago
  > You should really distinguish between "the US" and "the Trump admin". Is this a thing that is possible to do? Given that the trump admin is literally the highest office in the US, and it's common for the lower orgs to parrot things from the top, it seems very difficult to make this distinction.
- legacynl 9y ago
  For everyone outside the US; the Trump administration IS the US.
deleted 9y ago
[deleted]
pettersolberg 9y ago
So the blaming starts... And like the Electric Six were chanting "... let's start a war, a nuclear war..."

99 points by wybiral 9y ago

I've got to say, I'm incredibly impressed by how a country with zero computer education or infrastructure manages to launch a successful cyber attack against the most militaristically aggressive nation on earth right as that country is trying to pin them--a country with zero conflicts in 60 years--as the world's biggest threat.

slededit 9y ago
They've even got their own Linux distro: https://en.wikipedia.org/wiki/Red_Star_OS https://en.wikipedia.org/wiki/Red_Star_OS
ztratar 9y ago
Zero conflicts in 60 years? Hah. You forget that NK is still technically at war with South Korea. It's been non-stop conflict for 60+ years.
wybiral 9y ago
It's not as if they don't have computers [1]. Besides, the WannaCry attack was mostly facilitated by exploits that were leaked by Shadow Brokers [2] [3]. The skills required to slap those exploits onto a basic ransomware tool weren't very demanding. [1] https://en.wikipedia.org/wiki/Bureau_121 https://en.wikipedia.org/wiki/Bureau_121 [2] https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue [3] https://en.wikipedia.org/wiki/DoublePulsar https://en.wikipedia.org/wiki/DoublePulsar
kevin_thibedeau 9y ago
Just like how China funnels missile technology to DPRK and then feigns shock when they have a success, I wouldn't be surprised this was a gift from Unit 61398.
nitwit005 9y ago
There was some kidnapping, terrorism, artillery fire and missile launches in those 60 years. Not exactly what most people would call "zero conflicts". It's not particularly hard to get some software people. You may notice they've trained and hired enough people to run their nuclear program. That's a lot harder than cobbling together some software exploits.
- steve19 9y ago
  They will be employing black hats from around the world and paying them a lot of money. Suddam Hussain used a Canadian to build his supergun for example. https://en.m.wikipedia.org/wiki/Gerald_Bull https://en.m.wikipedia.org/wiki/Gerald_Bull
  - rdtsc 9y ago
    I remember reading about Bull, interesting stuff. > Bull then started work on the "real" PC-2 machine, a gun that was 150 meters long, weighed 2,100 tonnes, with a bore of one meter (39 inches). It was to be capable of placing a 2,000-kilogram projectile into orbit. Also noticed you were downvoted, can't figure why anyone would do that. Maybe they disagree that NK can employ black hats, but why not just comment on that in a reply...
    - jamoes 9y ago
      As far as I'm aware, a gun can't shoot a projectile into orbit - no matter how high it shoots a ballistic, the ballistic will eventually come back to earth (unless it gets captured by another body's gravitational field). In order to achieve orbit, you need to impart additional energy onto the object in order for it to get enough velocity to actually orbit.
      - rdtsc 9y ago
        You are probably right, I just copied it from Wikipedia verbatim. I did have the "citation needed" label. My pedestrian take on this is if Iraq could afford to build a gun which shoots satellites into orbit, after all these years we'd have a few of those around by now. But it just highlighted the craziness and planned scale of the project. The assassination of course also adds to the intrigue.
seanwilson 9y ago
Why? It's not like you have to invest in expensive equipment and enrol into some kind of specialist training programme that only some countries have access to. You just need a computer, access to material online and determination. Plenty of hacks and viruses are done by independent individuals and small groups not linked to the government.
- mbesto 9y ago
  Ya, but you need enable actors to learn. This is the dichotomy I too don't understand about NK - how do you presumably give software engineers access to the internet, while still restricting them to your firewall and still be able to create sophisticated malware. At some point those engineers will "stumble" on information that says "you're not free in your country...get out"...no?
  - wybiral 9y ago
    There have been defectors.
  - freedomben 9y ago
    Simply hearing the message "you're not free in your country...get out" is far from enough for the average person. They are completely inundated from birth with worship of the Great Leader. There's an awesome book called "Mig Pilot" by John Barron that details the story of a Soviet defector in the 80s. He talks about how he believed everything from the US was actually propaganda. He didn't even believe the grocery stores were real. It's a fascinating read.
    - marcoperaza 9y ago
      North Korea punishes your whole family if you misbehave. If you're a North Korean hacker, you're probably living better than 95% of the country. You and your family probably get to live in Pyongyang and get good food, housing, healthcare, opportunities for your children, and so forth. Why would you risk that? What could you, as one person, possibly do that would have any chance of success in fixing your country? The only thing you would get is your whole family thrown into a labor camp for the rest of your lives.
meowface 9y ago
Considering their likely military budget, it's not hard to imagine they could train a small percentage of the military in cyberespionage. Or they could outsource it to other nation-states or organizations. It isn't that difficult to find talented, (ostensibly) nationalistic kids, train them for years, and have them conduct operations like this.
marcoperaza 9y ago
>right as that country is trying to pin them--a country with zero conflicts in 60 years--as the world's biggest threat. What's the implication here? That the US is somehow unjustified in being alarmed by NK becoming a full nuclear power, soon with worldwide ICBM range? Think about the situation in that country. A small cabal of crooks lives like kings while the rest of the country suffers a never ending reign of terror, involving public executions in school yards, horrific labor camps, total surveillance, punishment of whole families, etc. The guy in charge is a sicko who executed his uncle with an anti-aircraft gun, and probably had a good laugh throughout the whole thing. The previous leader, his father, did such things as kidnap South Korean actors to force them to put on shows for him. These are deeply deranged people. Now imagine that regime on the verge of collapse, for one of the many possible reasons that could happen. The cabal of crooks know that they will all be executed by the North Korean people for their crimes. How sure are you that, when that moment comes, the regime won't launch nukes against all of their longtime enemies, just for the hell of it as a parting fuck you to the world?
- fiblye 9y ago
  >What's the implication here? That North Korea is justified in building up their arsenal to protect themselves from a country that has actively sought to topple other governments it simply just doesn't like. That vast majority of threats North Korea makes are "If America does this, we will retaliate." Meanwhile, American politicians endlessly call for preemptive strikes on Iran and North Korea because they've allegedly been on the verge of wiping out humanity for decades now. I've stopped buying the bullshit, but the "Kim Jong Un got gout from cheese and died but only before killing his uncle with an antiaircraft gun" headlines keep rolling.
  - SubiculumCode 9y ago
    If only for how they have oppressed their poor people, the NK regime deserves annihilation.
    - fiblye 9y ago
      If there's one thing America has mastered, it's the art of starting conflicts with "good intentions" like this and causing more harm than their enemy. See: Libya, Vietnam, Iraq. Every few years Americans say "never again", until the media sells the same lies as before and people forget.
foobaw 9y ago
They don't have zero computer education or infrastructure though. Although the details will never be known, they've been known to have a pretty strong education system. I know this example can be considered moot, but their IMO (International Math Olympiad) performance has been stellar, so if they can apply the same methodology to Computer Science and Education, it's possible that they have some skilled "hackers."
- freeflight 9y ago
  They pretty much have their own Linux distro [0], which imho is a very smart thing to do for a nation-state, at least if it's done properly. [0] https://media.ccc.de/v/32c3-7174-lifting_the_fog_on_red_star_os https://media.ccc.de/v/32c3-7174-lifting_the_fog_on_red_star...
toomanybeersies 9y ago
> a country with zero conflicts in 60 years https://en.wikipedia.org/wiki/List_of_border_incidents_involving_North_and_South_Korea https://en.wikipedia.org/wiki/List_of_border_incidents_invol... Incidents ranging all the way up to shelling South Korea and torpedoing their ships. The country has literally been at war since 1950.
malloryerik 9y ago
Lol. They have a determined crew of 6,000 hackers. [0] They stole $100 million from the Bank of Bangladesh in a Dridex attack, and nearly made off with another billion dollars or so. Now, stealing from a needy country like Bangladesh, that's despicable. [1] They also have perhaps the most controlling state in history and they are disciplined, if poor. In fact, according to a holocaust survivor who was subsequently a judge at the International Court of Justice at The Hague, North Korea's political prison system is as bad as or worse than the Nazis'. [2] They have zero human rights, no real justice system, gays and lesbians are put to death, mixed-blood children are murdered by the state (the government is openly and bone-chillingly racist). As for "zero conflicts" you can thank geography and Pax Americana for that as there has been no one for the North Koreans' to attack, though have been constant int'l abductions and assassinations (incl an attempt on the South Korean president), the destruction of a passenger jet, the torpedoing of a South Korean navy vessel, the shelling of a South Korean island, constant drug sales and arms sales by the government including the sale and construction of a nuclear plant to and for Syria, the sale of chemical weapons (those kids killed in gas attacks in Syria, yep, North Korean gas), the overseas sale of hard drugs by the government to raise foreign revenue, and most important and egregious, the wholesale murder and enslavement of their own citizens, if the word "citizen" can be used. In the 1990's during the "Arduous March" the government allowed up to a million people, 5% or the population, to starve unnecessarily while food aid was diverted to the military and funds were used to build up their nuclear program. Malnutrition was the norm. Since being established by the Soviet Union, the DPRK (Democratic People's Republic of Korea -- and the only honest word that name is "Korea") have consistently threatened their neighbors, once invading South Korea with full force after receiving Stalin's approval (a fact which can be read in the Soviet archives). If they haven't attacked again, it's purely because they don't have the means. Oh yes, and they have been hacking, and are considered one of the world's seven cyberpowers along with the U.S., Russia, China, the U.K., Iran, and France. [3] I don't mean to say that nobody ever has a happy life in North Korea. And I don't have time to go on and on about North Korea, but to pretend that they are mere victims is ludicrous. They inherit some of the worst aspects of the old Joseon Dynasty, the Japanese Empire, and Stalin-era Soviet Union, and manage to add to that. This isn't to say that the U.S. is without significant blame, of course not. For example the U.S. punished and traumatize North Koreans with an unbelievably destructive wartime bombing campaign after the North invaded the South. But despite serious mistakes the overall aim of the U.S. has been to create a world of growth and stability. During this Pax Americana, with and because of the help from allies and the creation of a global community of states, the world has indeed grown faster than ever before, despite everything that's gone wrong, and there has been less violence. [0] https://news.ycombinator.com/item?id=15480571 https://news.ycombinator.com/item?id=15480571 [1] https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery [2] https://www.huffingtonpost.com/entry/north-korean-prisons-nazi-camps_us_5a2fad6ce4b0461754330e3d https://www.huffingtonpost.com/entry/north-korean-prisons-na... [3] https://www.vox.com/world/2017/10/13/16465882/north-korea-cyber-attack-capability-us-military https://www.vox.com/world/2017/10/13/16465882/north-korea-cy...

forapurpose 9y ago

It's essential to remember that many wars begin with errors of attribution, and many of those errors are intentional or at least reflect a strong bias in the accusers. Examples off the top of my head: * 'Remember the Maine' instigated the Spanish-American War, but much evidence says the Maine was destroyed by accident. William Randolph Hearst, a leading publisher of yellow journalism, famously promised a compatriot: "You furnish the pictures and I'll furnish the war". * The Gulf of Tonkin incident instigated American involvment in the Vietnam War. * Iraq's weapons of mass destruction program, which didn't exist, instigated the Iraq War. In today's case, I trust the source much less than many of those who have made prior errors. I also note that it was a the head of Homeland Security, a political appointee, who made the accusation. It was not the head of the FBI or an intelligence agency; it is not represented, at least in the reporting I've seen, as a consensus of the US intelligence community; I also note that the White House has left some distance between itself and the accusation - it's not made by the President or his National Security Advisor, for example. Also, the very serious accusation rings of hype. North Korea has acted especially badly, largely unchecked, for more than a decade, which is false and a political swipe at the prior President. If that part of the accusation is exaggerated and political, I wonder about the other parts, and I wonder about the accusers ability or willingness to separate politics from very serious policy.

wybiral 9y ago
> North Korea has acted especially badly, largely unchecked, for more than a decade, which is false and a political swipe at the prior President. How is that false? PS: The US government isn't the only group pointing the finger in the direction of NK here [1] [2]. [1] http://www.bbc.com/news/technology-40297493 http://www.bbc.com/news/technology-40297493 [2] https://www.symantec.com/connect/blogs/wannacry-ransomware-attacks-show-strong-links-lazarus-group https://www.symantec.com/connect/blogs/wannacry-ransomware-a...
astebbin 9y ago
Despite the truth of your historical timeline, 'WannaCry' does neatly fit the profile of Room 39, a department of the North Korean government which raises foreign currency through cybercrime and other criminal activities [0][1]. They have been implicated in past hacks by non-U.S. groups as well, including Kaspersky Labs [2]. [0] https://www.washingtonpost.com/world/asia_pacific/he-ran-north-koreas-secret-money-making-operation-now-he-lives-in-virginia/2017/07/12/4cb9a590-6584-11e7-94ab-5b1f0ff459df_story.html https://www.washingtonpost.com/world/asia_pacific/he-ran-nor... [1] https://en.wikipedia.org/wiki/Room_39#Purpose_and_activities https://en.wikipedia.org/wiki/Room_39#Purpose_and_activities [2]http://money.cnn.com/2017/04/05/news/economy/north-korea-economy-china-trump-xi/index.html http://money.cnn.com/2017/04/05/news/economy/north-korea-eco...

jakenberg 9y ago

While the DPRK cultivates their talent, we indict ours: https://www.theguardian.com/technology/2017/aug/03/researcher-who-stopped-wannacry-ransomware-detained-in-us https://www.theguardian.com/technology/2017/aug/03/researche.... As someone else here has noted, it is impressive what DPRK has put together with comparatively limited resources. It makes me wonder what the cyber-landscape is going to look like in the coming years as the U.S. continues to ostracize the already scarce few who actually know how to reverse engineer malware, AND have the ethics to properly report it.

deleted 9y ago
[deleted]
kchoudhu 9y ago
Does cultivation of tech talent matter when the chance of execution by mortar shell is present? http://www.telegraph.co.uk/news/worldnews/asia/northkorea/9630509/North-Korean-army-minister-executed-with-mortar-round.html http://www.telegraph.co.uk/news/worldnews/asia/northkorea/96...

badrabbit 9y ago

And mirai was the russians! (Sarcasm,it's not). I'm not saying it's not NK,just that there are plenty of well funded large scale advanced blackhat organizations (e.g. - Dridex). It's also known that NK has foreign offices in China and elsewhere. Russians recruit hackers for their APT work and in exchange let the hackers do whatever they want,why not NK hackers? If you were a NK hacker in china,wouldn't it cross your mind to weaponize a treasure trove of NSA tools into a profitable ransomware? Code similarities with lazarus group tools can be explained by this and other similar plausible theories. NK is low on cash so it could have been a pyongyang directive. But the whole operation lacks a lot of the operational and organizational details a typical APT operation would exhibit. A kill switch but no whitelist to avoid annoying allies. when kill switch was discovered I would expect a nation state operation to quickly adopt. Nation states love hoarding strategic compromises (typically websites,botnets,etc...) As far as I know,no pre-existing botnet or compromised sites took part in catalyzing the worm. Again,not saying it's not NK,I'm just saying a few too many things seem off, I take this attribution with a few grains of salt.

wybiral 9y ago
I doubt WannaCry or the Shadow Brokers leaks were meant to actually make money. They seem more like they were executed to make NSA look worse than it already does. Most of the recent sensationalized leaks have seemed to fit that bill. But you're right, attribution here is dangerous unless they have some solid evidence.
- sitkack 9y ago
  Every byte is placed with purpose.
StanislavPetrov 9y ago
As always, the issue is credibility. Among the small group of reality-based people in the US, the government has absolutely no credibility. Unless and until independently verifiable proof of their assertion is released, nobody with a shred of intelligence or critical thinking skills should believe anything they say. This is especially true when they want to slaughter countless numbers of people based on an unsupported assertion.

grondilu 9y ago

I was about to write "I'm not sure pointing fingers like that is the best diplomatic attitude there is", but then I thought I should read the article first. Amusingly enough, when the page showed up, I saw the accompanying video thumbnail which was precisely a hand with a pointing finger.

kakarot 9y ago

If you don't like what's being said, change the conversation... North Korea has no place in this discussion. The entity responsible for the WannaCry debacle is a US-based spy organization we all know and love.

Alex3917 9y ago
> If you don't like what's being said, change the conversation... Maybe. There's probably also a lot of countries who would love nothing more than to grab some popcorn and watch the U.S. and North Korea start nuking each other, much the same way that the U.S. 'manages' the Middle East and South America by getting random countries to start genociding each other.
- kakarot 9y ago
  That isn't the point. The exploits WannaCry abused were known by this organization and not made known to Microsoft so that they could be exploited and not patched. Since many of these machines ran critical services, this was a hostile act against the general public of the United States and all blame falls on them.
  - willstrafach 9y ago
    > not made known to Microsoft so that they could be exploited and not patched. They did make Microsoft aware, and a patch was pushed out. Those affected had not patched their systems, unfortunately a bit common in some enterprises. So giving Microsoft a heads up has little to do with it.
- StanislavPetrov 9y ago
  There are also a lot of authoritarians in the US and globally who thirst for war as a vehicle to consolidate their own power.
  - mirimir 9y ago
    And indeed, perhaps they have manipulated NK to become just the threat that they need. Scary enough, but not very dangerous. Except to SK and Japan. And to China, which may in fact be the primary target.

pwdisswordfish2 9y ago

I blame Microsoft. Honestly. They are the root cause. It does not matter who conducts the attack. It matters that the attack is possible. It is possible because of the software. Microsoft wrote that software and released it to the public. Upgrade is not a substitute for recall. Selling defective software should be no different than selling a defective automobile. Users of defective products cannot be blamed for the defects.

pinkskip 9y ago

sure, what else? who else? it's very rich coming from a country who facilitates (cough!! NSA) warrantless surveillance on it's own citizens.

averagewall 9y ago
That's not as important as the fact that it spies on foreigners and hacks their computers. Americans somehow decided spying and hacking is OK as long as it's being done to others, not themselves. They shouldn't be surprised that other countries hold the reciprocal views.
- jcoffland 9y ago
  > Americans somehow decided spying and hacking is OK I'm still trying to remember when I was asked of this would be OK.
- Retra 9y ago
  Other countries will hold reciprocal views regardless of American sentiments on the issue. Nations are not people and hypocrisy doesn't matter on an international scale. Any student of history would see this.

NightlyDev 9y ago

I find it intriguing that people somehow seems to know who's behind stuff. It's not exactly hard to hide all traces, so I find it hard to believe that a state would fail doing so. The US is clearly the one to blame for WannaCry. If it wasn't for the NSA leaking and not reporting vurnerabilities this would probably never have happened.

phaus 9y ago
Perfect operational security is insanely hard, especially once an organization grows beyond a few people. Theorizing about the ways one might perfectly cover all traces of an attack is quite a bit different from executing an attack against a large organization, moving through their systems and networks to look for sensitive data, exfiltrating the data, and then repeating this process for dozens of targets, year after year, without ever being detected or ever leaving a trace of anything.
pwaai 9y ago
More intriguing to me is how some people here are trying to claim this isn't North Korea, where it has all the markings of past North Korean cyberattacks and consistent with published findings about their specific departments tasked with the goal of raising money for Kim's private fund. https://en.wikipedia.org/wiki/Room_39 https://en.wikipedia.org/wiki/Room_39
- NightlyDev 9y ago
  My guess is that it's most likely just a kid somewhere who had some fun. Considering the kill switch the person behind this clearly didn't have much experience, so I find it very very hard to belive that some other state than the US was involved in this.
  - pwaai 9y ago
    Your guess is as good as redditor

pepsi 9y ago

Is this official level blame just another checklist item towards justifying the US doing a "military action" on NK?

trynumber9 9y ago
No, because not even Americans are stupid enough to believe the US will do a "military action" on a nuclear power. Fewer still see malware as casus belli.
- JumpCrisscross 9y ago
  We have "render safe" procedures for e.g. a collapse of the Pakistani government. We likely have similar plans for North Korea. In any case, the nukes aren't the insurmountable problem. It's the volumes of hidden artillery trained on Seoul that are problematic.
  - trynumber9 9y ago
    I see some difference between a checklist for starting a nuclear (or as you pointed out, shrapnel) holocaust and contingency planning.
  - deleted 9y ago
    [deleted]
  - deleted 9y ago
    [deleted]
- StanislavPetrov 9y ago
  A very optimistic assessment.
  - deleted 9y ago
    [deleted]
jonathanmarvens 9y ago
Yes, precisely.

craigc 9y ago

The earliest reports I can find claiming that North Korea may have been involved were from the middle of May: https://www.theverge.com/2017/5/15/15643226/wannacry-ransomware-north-korea-attribution-wannacrypt https://www.theverge.com/2017/5/15/15643226/wannacry-ransomw... https://www.theguardian.com/technology/2017/may/15/wannacry-ransomware-north-korea-lazarus-group https://www.theguardian.com/technology/2017/may/15/wannacry-... There is nothing conclusive there though If this is not the most convenient way to justify going to war with North Korea then I don’t know what is. It is almost as if the hackers WANTED to get caught by reusing code that was previously used in an attack initiated by North Korea. Also we shouldn’t forget that it was an exploit developed by the NSA to begin with. Weapons of Mass Destruction anyone?

pulisse 9y ago
In October, Microsoft officially blamed North Korea[1], as did the UK government[2], neither of whom is trying to lay the groundwork for war. [1] http://www.itv.com/news/2017-10-13/hacking-threat-is-as-serious-as-terrorism-says-microsoft-boss http://www.itv.com/news/2017-10-13/hacking-threat-is-as-seri... [2] https://www.cnbc.com/2017/10/27/uk-north-korea-behind-wannacry-cyber-attack-that-crippled-nhs.html https://www.cnbc.com/2017/10/27/uk-north-korea-behind-wannac...
- jacquesm 9y ago
  In the run-up to the Iraq war there was this group of UN weapons inspectors that had concluded based on the available evidence that Saddam did not have WMD. That did not stop the UK from going ahead with their bit in the Gulf War. If a war is to be had evidence doesn't really matter. It could be fabricated far easier than you could have real evidence, history has quite a few examples. Given the current political climate in the UK I would not put it past them to start making stuff up, a distraction from internal strife is always a good reason to start a war. Microsoft - I hope - is another matter. The reason why - at least, to me - there is little point to either the UK or the US wanting to start a war with NK is that unlike Iraq NK actually has a good chance of inflicting massive damage on an ally. Plus the lottery ticket of Kim being able to lob a nuke halfway across the globe and make it stick even if attacked might be another item that gives pause to the powers that be. So, whether NK is behind these attacks or not is absent very solid proof an open question, whether or not the government is laying the grounds for war hardly matters, those are not necessarily connected, though they could be it would be a first to go to a shooting war with a nation state over a cyber attack.

alhafizco 9y ago

https://www.youtube.com/watch?v=6GTqoiH3FUk&feature=youtu.be https://www.youtube.com/watch?v=6GTqoiH3FUk&feature=youtu.be

mmaunder 9y ago

I'd like to see the attribution data. Don't hold your breath.

eksemplar 9y ago

You should really distinguish between "the US" and "the Trump admin". This may be a little hard, but the latter has no credibility internationally. The Trump administration is clearly pushing for a stronger take on North Korea and its had no problems lying in the past. Sure North Korea might be behind this, but at this point Trumps credibility is so low they might as well be blaming unicorns.

RickS 9y ago
> You should really distinguish between "the US" and "the Trump admin". Is this a thing that is possible to do? Given that the trump admin is literally the highest office in the US, and it's common for the lower orgs to parrot things from the top, it seems very difficult to make this distinction.
legacynl 9y ago
For everyone outside the US; the Trump administration IS the US.

deleted 9y ago

[deleted]

pettersolberg 9y ago

So the blaming starts... And like the Electric Six were chanting "... let's start a war, a nuclear war..."