9 ms·

North Korean Spy to Be Charged in Sony Pictures Hacking

65 points by NN88 8y ago

sillyquiet 8y ago
It kind of blows my mind that North Korea is responsible for Spider-Man joining the MCU.
- clircle 8y ago
  Care to explain? I don't know much about Spiderman and Marvel.
  - sillyquiet 8y ago
    Sorry! See chrisdsalvidar's response above, they outlined it pretty well.
- jedberg 8y ago
  I’ve heard this a few times but I’m not super familiar with the ins and outs of the MCU and who owns (owned) what. Can you connect the dots for me?
  - chrisdsaldivar 8y ago
    When Sony was hacked over The Interview a bunch of emails were leaked including some between Sony and Marvel. Apparently Spiderman was supposed to be in Captain America: Civil War but the deal fell through. When the emails leaked about it fans went nuts a pushed Sony to include Spiderman in the MCU which ended up happening. Sony still has the rights to Spiderman he's just part of the MCU now. I'd recommend reading the emails. They show just how badly Sony needed Marvel's help to make a good Spiderman. Here's my favorite http://imgur.com/XiqC6fz http://imgur.com/XiqC6fz Edit: Also Sony was trying to make their own Spiderman universe instead of being part of the Marvel Cinematic Universe.
    - laken 8y ago
      For some further background, many of the most popular Marvel characters' rights were sold off years before the MCU & Disney acquisition, such as Spiderman. Disney has tried to get back as many as they could, and are continuing to do so. Off the top of my head, Universal currently owns theme park rights to Spiderman, Avengers, X-Men, and Fantastic Four on east-coast USA. In regards to film rights, Fox owns X-Men and Fantastic Four, and Sony owns Spiderman. One of the reasons Disney is pushing hard for acquiring Fox is to get back the X-Men rights from Fox, as that's the 'easiest' way to add them into the MCU.
      - sillyquiet 8y ago
        Universal also owns Hulk and his rogue's gallery with a few exceptions.
      - sillyquiet 8y ago
        see https://imgur.com/a/0lE9s#p6kuIut https://imgur.com/a/0lE9s#p6kuIut for a diagrammatic representation of this tangled web of IP
    - sillyquiet 8y ago
      Unless things has drastically improved at Sony, this does not bode well for Venom.
    - arayh 8y ago
      Thanks for posting your favourite email leak - it made my day. I would imagine it'd be hard for a group of middle-aged adults trying to modernize Spiderman by observing their children's day-to-day activities. Conversely, I really liked how Marvel included vlogging as a narrative form, which added a good amount of humour and relatability for modern youth.
madrox 8y ago
I work in the entertainment industry for a major Sony competitor. This hack was when entertainment execs started listening to their infosec people. It wasn't just IT. Media apps also got more secure and data retention policies got much, much more disciplined. The paranoia was real. I'd dare say it's why the big social media data retention scandal came out of the election instead of Hollywood. I've always been suspicious of the touted NK connection. It seemed flimsy then, and it seems flimsy now. However, all these years later, I don't know why they'd be interested in keeping up security theater, so I assume someone closer to it than I knows all the facts.
- pokemongoaway 8y ago
  Yes, perfect scape goat... And we're never going to hear the other side of the story. When did the world become so trusting of American intelligence agencies? Is it like everyone is desperate to support their stories these days - and their combined track record is worse than any criminal living today!
- openasocket 8y ago
  There's some fairly extensive information publicly available in support of the NK connection. I'll point to https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf https://www.operationblockbuster.com/wp-content/uploads/2016... (disclaimer: I worked with the team that wrote that report, though not on Operation Blockbuster itself). That information shows that the group behind the Sony Hack were a previously unknown APT group. Analysis of malware used, C&C servers, and even re-used certificates connect this group to a variety of other attacks in the years prior, all targeting various South Korean entertainment and financial institutions. The report I linked to provides more information.
  - akhilcacharya 8y ago
    I've never understood the knee-jerk skepticism to the IC consensus despite no countervailing evidence to these foreign hacks. I'm really concerned we're going to be caught flat-footed to significantly more severe attacks from foreign powers if 40-50% of the population denies that they happened.
LinuxBender 8y ago
One person? Anyone else feel their spidey senses tingling?
jedberg 8y ago
What I really want to know is how did they learn the skills to do this? And more importantly, if they had that kind of access to outside information, how do they not know about the atrocities they are involved in? Or is it a catch 22 where if they don’t help then they become a victim?
- openasocket 8y ago
  Someone else has mentioned how they learn. As to why they do what they do, it's probably for the same reason people do most things: to get a better life for themselves and their family. I don't think they do this out of fear of becoming the victim, these are elite and well-trained operators. They volunteered to get this education, they aren't conscripts. As crazy as it sounds to you or I, I think these individuals genuinely believe in the DPRK, or at least are apathetic to it and think only in terms of their own advancement.
- microcolonel 8y ago
  > Or is it a catch 22 where if they don’t help then they become a victim? In case it wasn't obvious, this is seemingly how NK handles anyone who knows things that didn't come from the propaganda broadcasts. Your countrymen will also generally not understand or believe what you've said, and if they're the thrust of your action, you'll realize that they have very little power.
- VikingCoder 8y ago
  If they don't help, their entire family become victims. It's hard to imagine standing up to that.
- josefresco 8y ago
  Some insight into how they learn the skills... https://www.businessinsider.com/north-korean-defector-jang-se-yul-trained-with-hackers-2014-12 https://www.businessinsider.com/north-korean-defector-jang-s... "Mirim University produces most of the hackers that get placed in Bureau 121. It's a highly competitive program, with each class accepting only about 100 students out of 5,000 applicants. They take six 90-minute classes every day, learning different coding languages and operating systems, from C to Linux. Jang says a lot of time was spent dissecting Microsoft programs, like the Windows operating system, and how to attack the overall computer IT systems of enemy countries like the US or South Korea." Also https://www.nbcnews.com/news/north-korea/how-north-korea-recruits-trains-its-army-hackers-n825521 https://www.nbcnews.com/news/north-korea/how-north-korea-rec... https://www.express.co.uk/news/world/913712/North-Korea-latest-Kim-Jong-un-cyber-attack-elite-hackers-trained-in-China https://www.express.co.uk/news/world/913712/North-Korea-late...
OliverJones 8y ago
I wish someone could explain the logic of indicting foreign nationals when there's no hope of bringing them to trial. A 179-page criminal complaint must have cost a substantial sum. Justice Department could have spent that money explaining "correct horse battery staple" (https://xkcd.com/936/ https://xkcd.com/936/) to its own people, and so made us all a bit safer.
- rwallace 8y ago
  I suppose it's a way of substantiating the attribution of the crime to North Korea. When it was just someone making the allegation, they could've been doing it for any number of reasons, but now it seems the evidence has held up to some kind of scrutiny under due process.
- the_watcher 8y ago
  It substantially limits their movement, as it increases the caution needed to enter any country with which the US has an extradition treaty. As to explaining password security, the Justice Department is a law enforcement agency, not a security agency.
  - TACIXAT 8y ago
    North Koreans aren't known for their international travel.
    - b5ec5a483dfd14 8y ago
      North Korean hackers actually travel abroad to their target country for 2 years according to the business insider article someone liked to in this thread. Seems possible they may travel again.
deleted 8y ago
[deleted]
NN88 8y ago
HERES THE INDICTMENT: https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and https://www.justice.gov/opa/pr/north-korean-regime-backed-pr...
onetimemanytime 8y ago
>>Mr. Park, who also went by the alias Pak Jin Hek, is unlikely to see the inside of an American courtroom. The United States has no direct, formal relations with North Korea and did not communicate with its reclusive government ahead of the charges. And if he did find himself in a court, a couple of professors and escapees can testify that unless he did what he did, he'd be in jail, along with all his extended family. Not guilty. Now maybe he didn't have to be that successful, but we don't know all details beyond reasonable doubt.

65 points by NN88 8y ago

sillyquiet 8y ago

It kind of blows my mind that North Korea is responsible for Spider-Man joining the MCU.

clircle 8y ago
Care to explain? I don't know much about Spiderman and Marvel.
- sillyquiet 8y ago
  Sorry! See chrisdsalvidar's response above, they outlined it pretty well.
jedberg 8y ago
I’ve heard this a few times but I’m not super familiar with the ins and outs of the MCU and who owns (owned) what. Can you connect the dots for me?
- chrisdsaldivar 8y ago
  When Sony was hacked over The Interview a bunch of emails were leaked including some between Sony and Marvel. Apparently Spiderman was supposed to be in Captain America: Civil War but the deal fell through. When the emails leaked about it fans went nuts a pushed Sony to include Spiderman in the MCU which ended up happening. Sony still has the rights to Spiderman he's just part of the MCU now. I'd recommend reading the emails. They show just how badly Sony needed Marvel's help to make a good Spiderman. Here's my favorite http://imgur.com/XiqC6fz http://imgur.com/XiqC6fz Edit: Also Sony was trying to make their own Spiderman universe instead of being part of the Marvel Cinematic Universe.
  - laken 8y ago
    For some further background, many of the most popular Marvel characters' rights were sold off years before the MCU & Disney acquisition, such as Spiderman. Disney has tried to get back as many as they could, and are continuing to do so. Off the top of my head, Universal currently owns theme park rights to Spiderman, Avengers, X-Men, and Fantastic Four on east-coast USA. In regards to film rights, Fox owns X-Men and Fantastic Four, and Sony owns Spiderman. One of the reasons Disney is pushing hard for acquiring Fox is to get back the X-Men rights from Fox, as that's the 'easiest' way to add them into the MCU.
    - sillyquiet 8y ago
      Universal also owns Hulk and his rogue's gallery with a few exceptions.
    - sillyquiet 8y ago
      see https://imgur.com/a/0lE9s#p6kuIut https://imgur.com/a/0lE9s#p6kuIut for a diagrammatic representation of this tangled web of IP
  - sillyquiet 8y ago
    Unless things has drastically improved at Sony, this does not bode well for Venom.
  - arayh 8y ago
    Thanks for posting your favourite email leak - it made my day. I would imagine it'd be hard for a group of middle-aged adults trying to modernize Spiderman by observing their children's day-to-day activities. Conversely, I really liked how Marvel included vlogging as a narrative form, which added a good amount of humour and relatability for modern youth.

madrox 8y ago

I work in the entertainment industry for a major Sony competitor. This hack was when entertainment execs started listening to their infosec people. It wasn't just IT. Media apps also got more secure and data retention policies got much, much more disciplined. The paranoia was real. I'd dare say it's why the big social media data retention scandal came out of the election instead of Hollywood. I've always been suspicious of the touted NK connection. It seemed flimsy then, and it seems flimsy now. However, all these years later, I don't know why they'd be interested in keeping up security theater, so I assume someone closer to it than I knows all the facts.

pokemongoaway 8y ago
Yes, perfect scape goat... And we're never going to hear the other side of the story. When did the world become so trusting of American intelligence agencies? Is it like everyone is desperate to support their stories these days - and their combined track record is worse than any criminal living today!
openasocket 8y ago
There's some fairly extensive information publicly available in support of the NK connection. I'll point to https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf https://www.operationblockbuster.com/wp-content/uploads/2016... (disclaimer: I worked with the team that wrote that report, though not on Operation Blockbuster itself). That information shows that the group behind the Sony Hack were a previously unknown APT group. Analysis of malware used, C&C servers, and even re-used certificates connect this group to a variety of other attacks in the years prior, all targeting various South Korean entertainment and financial institutions. The report I linked to provides more information.
- akhilcacharya 8y ago
  I've never understood the knee-jerk skepticism to the IC consensus despite no countervailing evidence to these foreign hacks. I'm really concerned we're going to be caught flat-footed to significantly more severe attacks from foreign powers if 40-50% of the population denies that they happened.

LinuxBender 8y ago

One person? Anyone else feel their spidey senses tingling?

jedberg 8y ago

What I really want to know is how did they learn the skills to do this? And more importantly, if they had that kind of access to outside information, how do they not know about the atrocities they are involved in? Or is it a catch 22 where if they don’t help then they become a victim?

openasocket 8y ago
Someone else has mentioned how they learn. As to why they do what they do, it's probably for the same reason people do most things: to get a better life for themselves and their family. I don't think they do this out of fear of becoming the victim, these are elite and well-trained operators. They volunteered to get this education, they aren't conscripts. As crazy as it sounds to you or I, I think these individuals genuinely believe in the DPRK, or at least are apathetic to it and think only in terms of their own advancement.
microcolonel 8y ago
> Or is it a catch 22 where if they don’t help then they become a victim? In case it wasn't obvious, this is seemingly how NK handles anyone who knows things that didn't come from the propaganda broadcasts. Your countrymen will also generally not understand or believe what you've said, and if they're the thrust of your action, you'll realize that they have very little power.
VikingCoder 8y ago
If they don't help, their entire family become victims. It's hard to imagine standing up to that.
josefresco 8y ago
Some insight into how they learn the skills... https://www.businessinsider.com/north-korean-defector-jang-se-yul-trained-with-hackers-2014-12 https://www.businessinsider.com/north-korean-defector-jang-s... "Mirim University produces most of the hackers that get placed in Bureau 121. It's a highly competitive program, with each class accepting only about 100 students out of 5,000 applicants. They take six 90-minute classes every day, learning different coding languages and operating systems, from C to Linux. Jang says a lot of time was spent dissecting Microsoft programs, like the Windows operating system, and how to attack the overall computer IT systems of enemy countries like the US or South Korea." Also https://www.nbcnews.com/news/north-korea/how-north-korea-recruits-trains-its-army-hackers-n825521 https://www.nbcnews.com/news/north-korea/how-north-korea-rec... https://www.express.co.uk/news/world/913712/North-Korea-latest-Kim-Jong-un-cyber-attack-elite-hackers-trained-in-China https://www.express.co.uk/news/world/913712/North-Korea-late...

OliverJones 8y ago

I wish someone could explain the logic of indicting foreign nationals when there's no hope of bringing them to trial. A 179-page criminal complaint must have cost a substantial sum. Justice Department could have spent that money explaining "correct horse battery staple" (https://xkcd.com/936/ https://xkcd.com/936/) to its own people, and so made us all a bit safer.

rwallace 8y ago
I suppose it's a way of substantiating the attribution of the crime to North Korea. When it was just someone making the allegation, they could've been doing it for any number of reasons, but now it seems the evidence has held up to some kind of scrutiny under due process.
the_watcher 8y ago
It substantially limits their movement, as it increases the caution needed to enter any country with which the US has an extradition treaty. As to explaining password security, the Justice Department is a law enforcement agency, not a security agency.
- TACIXAT 8y ago
  North Koreans aren't known for their international travel.
  - b5ec5a483dfd14 8y ago
    North Korean hackers actually travel abroad to their target country for 2 years according to the business insider article someone liked to in this thread. Seems possible they may travel again.

deleted 8y ago

[deleted]

NN88 8y ago

HERES THE INDICTMENT: https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and https://www.justice.gov/opa/pr/north-korean-regime-backed-pr...

onetimemanytime 8y ago

>>Mr. Park, who also went by the alias Pak Jin Hek, is unlikely to see the inside of an American courtroom. The United States has no direct, formal relations with North Korea and did not communicate with its reclusive government ahead of the charges. And if he did find himself in a court, a couple of professors and escapees can testify that unless he did what he did, he'd be in jail, along with all his extended family. Not guilty. Now maybe he didn't have to be that successful, but we don't know all details beyond reasonable doubt.