4 ms·

And mirai was the russians! (Sarcasm,it's not). I'm not saying it's not NK,just that there are plenty of well funded large scale advanced blackhat organization

And mirai was the russians! (Sarcasm,it's not). I'm not saying it's not NK,just that there are plenty of well funded large scale advanced blackhat organizations (e.g. - Dridex). It's also known that NK has foreign offices in China and elsewhere. Russians recruit hackers for their APT work and in exchange let the hackers do whatever they want,why not NK hackers? If you were a NK hacker in china,wouldn't it cross your mind to weaponize a treasure trove of NSA tools into a profitable ransomware? Code similarities with lazarus group tools can be explained by this and other similar plausible theories. NK is low on cash so it could have been a pyongyang directive. But the whole operation lacks a lot of the operational and organizational details a typical APT operation would exhibit. A kill switch but no whitelist to avoid annoying allies. when kill switch was discovered I would expect a nation state operation to quickly adopt. Nation states love hoarding strategic compromises (typically websites,botnets,etc...) As far as I know,no pre-existing botnet or compromised sites took part in catalyzing the worm. Again,not saying it's not NK,I'm just saying a few too many things seem off, I take this attribution with a few grains of salt.

wybiral 9y ago
I doubt WannaCry or the Shadow Brokers leaks were meant to actually make money. They seem more like they were executed to make NSA look worse than it already does. Most of the recent sensationalized leaks have seemed to fit that bill. But you're right, attribution here is dangerous unless they have some solid evidence.
- sitkack 9y ago
  Every byte is placed with purpose.
StanislavPetrov 9y ago
As always, the issue is credibility. Among the small group of reality-based people in the US, the government has absolutely no credibility. Unless and until independently verifiable proof of their assertion is released, nobody with a shred of intelligence or critical thinking skills should believe anything they say. This is especially true when they want to slaughter countless numbers of people based on an unsupported assertion.
zitterbewegung 9y ago
As I see all of these US blames North Korea and or Russia half of me thinks that it's a PR organization that tells them who to blame.
paulie_a 9y ago
Not to be a dick but you space bar is broken when it comes to commas.
nyolfen 9y ago
>But the whole operation lacks a lot of the operational and organizational details a typical APT operation would exhibit. A kill switch but no whitelist to avoid annoying allies. nobody ever accused nk of being elite. it would be frankly much more surprising if their cyber programs were on par with china or russia.
- badrabbit 9y ago
  It's not a question of being "elite" although based on known intel I think they are, But a question of organization and resources government backed teams exhibit. Even a team of noobs if backed by a government can at least rent botnets and have backup plans to adopt to quickly.
btown 9y ago
For those unfamiliar with the APT acronym: https://blog.malwarebytes.com/cybercrime/malware/2016/07/explained-advanced-persistent-threat-apt/ https://blog.malwarebytes.com/cybercrime/malware/2016/07/exp...
mc32 9y ago
Kind of tangential, but what how did we retaliate against NK last time it was "asserted" that NK was behind cyberattacks --i.e. "Sony hack" IIRC, Obama said we'd respond appropriately at a time of our choosing, or words to that effect.
- Kadin 9y ago
  Difficult to say with certainty; it's not like the DPRK is going to put out a press release that they've been hacked, if they were hacked. All in all a pretty good response on Obama's part; it didn't demand immediate visible action but preserved freedom of maneuver; later, if a US cyberattack had come to light, it would have been a sort of chit that could have been redeemed by way of justification.

wybiral 9y ago

I doubt WannaCry or the Shadow Brokers leaks were meant to actually make money. They seem more like they were executed to make NSA look worse than it already does. Most of the recent sensationalized leaks have seemed to fit that bill. But you're right, attribution here is dangerous unless they have some solid evidence.

sitkack 9y ago
Every byte is placed with purpose.

StanislavPetrov 9y ago

As always, the issue is credibility. Among the small group of reality-based people in the US, the government has absolutely no credibility. Unless and until independently verifiable proof of their assertion is released, nobody with a shred of intelligence or critical thinking skills should believe anything they say. This is especially true when they want to slaughter countless numbers of people based on an unsupported assertion.

zitterbewegung 9y ago

As I see all of these US blames North Korea and or Russia half of me thinks that it's a PR organization that tells them who to blame.

paulie_a 9y ago

Not to be a dick but you space bar is broken when it comes to commas.

nyolfen 9y ago

>But the whole operation lacks a lot of the operational and organizational details a typical APT operation would exhibit. A kill switch but no whitelist to avoid annoying allies. nobody ever accused nk of being elite. it would be frankly much more surprising if their cyber programs were on par with china or russia.

badrabbit 9y ago
It's not a question of being "elite" although based on known intel I think they are, But a question of organization and resources government backed teams exhibit. Even a team of noobs if backed by a government can at least rent botnets and have backup plans to adopt to quickly.

btown 9y ago

For those unfamiliar with the APT acronym: https://blog.malwarebytes.com/cybercrime/malware/2016/07/explained-advanced-persistent-threat-apt/ https://blog.malwarebytes.com/cybercrime/malware/2016/07/exp...

mc32 9y ago

Kind of tangential, but what how did we retaliate against NK last time it was "asserted" that NK was behind cyberattacks --i.e. "Sony hack" IIRC, Obama said we'd respond appropriately at a time of our choosing, or words to that effect.

Kadin 9y ago
Difficult to say with certainty; it's not like the DPRK is going to put out a press release that they've been hacked, if they were hacked. All in all a pretty good response on Obama's part; it didn't demand immediate visible action but preserved freedom of maneuver; later, if a US cyberattack had come to light, it would have been a sort of chit that could have been redeemed by way of justification.