6 ms·

There's some fairly extensive information publicly available in support of the NK connection. I'll point to https://www.operationblockbuster.com/wp-content/uplo

There's some fairly extensive information publicly available in support of the NK connection. I'll point to https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf https://www.operationblockbuster.com/wp-content/uploads/2016... (disclaimer: I worked with the team that wrote that report, though not on Operation Blockbuster itself). That information shows that the group behind the Sony Hack were a previously unknown APT group. Analysis of malware used, C&C servers, and even re-used certificates connect this group to a variety of other attacks in the years prior, all targeting various South Korean entertainment and financial institutions. The report I linked to provides more information.

akhilcacharya 8y ago
I've never understood the knee-jerk skepticism to the IC consensus despite no countervailing evidence to these foreign hacks. I'm really concerned we're going to be caught flat-footed to significantly more severe attacks from foreign powers if 40-50% of the population denies that they happened.
- lovich 8y ago
  It's because institutions everywhere have been caught lieing repeatedly and maliciously. Public trust in institutions has been seriously eroded because those institutions have not been acting in a trustworthy manner. People are being trained to not believe data from any organized group
rando444 8y ago
As someone else that's spent a large amount of time looking into this, I'd like to offer a dissenting opinion. I agree with the analysis linking the groups.. however, the final conclusion is because the other attacks were attributed to NK, then we must also attribute these attacks to NK. I think these assumptions need to be questioned. The sophistication of the attacks is so out of proportion with North Koreas abilities, it almost reaches the point of absurdity. I mean we're talking about an entire country full of people that are denied access to the internet, most do not have computers, and many don't even have the electricity to run them. We're talking about a country where refrigerators are luxury and purchased by the middle class to store books since they don't have steady electricity that would allow them to keep food cold. When you look at the sophistication of the attacks, it's an amazing leap to assign such sophisticated cyber attacks to a country that runs it's entire computer infrastructure as an government controlled Intranet that people still access over dial-up modem. I mean even just using Occams razor on the South Korean bank attacks... You're going to require extremely educated people, who have the requisite hacking skill and mindsets, which often require unfettered access to information that is denied to most everyone, and small details like the fact that the attackers also are knowledgeable in multiple spoken languages and other things that are so out of the ordinary for NK. What is more likely.. that all of these sophisticated attacks are being done by a country that can barely keep the power on, or that they are done by someone pretending to be North Korea and using them as a scapegoat? Personally I think it's the latter.
- TACIXAT 8y ago
  My understanding is that NK works out of a Chinese city Shenyang. [1] Their lack of internet infrastructure does not really matter in that case. As well, if they are working out of China you have to assume they are exchanging information with China. China has some pretty top tier security experts. I do not think it is unreasonable at all for someone in NK to be trained up in how to write ransomware or a wiper. 1. https://www.businessinsider.com/north-korean-hackers-working-in-china-2015-1 https://www.businessinsider.com/north-korean-hackers-working...
- openasocket 8y ago
  I disagree with the idea that the DPRK is not capable of such attacks. They've demonstrated they are capable of creating nuclear weapons and ICBMs, I don't think it's such a stretch to say they are capable of APT attacks. Especially when you consider that the DPRK gets a lot of support from China, which also engages in cyber attacks. It wouldn't be difficult to send DPRK citizens to China to be educated and instructed in computer technology. More difficult, but still possible, is covertly sending north koreans to various western institutions to receive an education in cyber security. Recall that Kim Jung Un himself was educated in Switzerland. There's also the possibility that the APT group is partially or completely composed of foreigners hired to engage in these attacks on behalf of the DPRK. I know one of the people on Operation Blockbuster believed that this was "contracted out" to some clandestine group. This would explain the attackers being multi-lingual. It would also explain why many of their attacks focus on financial institutions and theft. This focus has been proposed as a way for the DPRK to get international currency to make purchases and evade sanctions, but it would also make sense for a group that is in it for the money.
  - jessaustin 8y ago
    Can we get an estimate of how much money was stolen/earned/misplaced/whatever in this hack?
    - openasocket 8y ago
      In the Sony hack? None. But many of the Lazarus group's other attacks have resulted in getting significant amounts of money. There was the theft with the Bangladesh bank a few years ago, where they got away with around $100M US. There were some other, smaller incidents involving banks in Vietnam and Taiwan. And the Lazarus group is believed to be behind the WannaCry randsomware, idk how much they got from that.

akhilcacharya 8y ago

I've never understood the knee-jerk skepticism to the IC consensus despite no countervailing evidence to these foreign hacks. I'm really concerned we're going to be caught flat-footed to significantly more severe attacks from foreign powers if 40-50% of the population denies that they happened.

lovich 8y ago
It's because institutions everywhere have been caught lieing repeatedly and maliciously. Public trust in institutions has been seriously eroded because those institutions have not been acting in a trustworthy manner. People are being trained to not believe data from any organized group

rando444 8y ago

As someone else that's spent a large amount of time looking into this, I'd like to offer a dissenting opinion. I agree with the analysis linking the groups.. however, the final conclusion is because the other attacks were attributed to NK, then we must also attribute these attacks to NK. I think these assumptions need to be questioned. The sophistication of the attacks is so out of proportion with North Koreas abilities, it almost reaches the point of absurdity. I mean we're talking about an entire country full of people that are denied access to the internet, most do not have computers, and many don't even have the electricity to run them. We're talking about a country where refrigerators are luxury and purchased by the middle class to store books since they don't have steady electricity that would allow them to keep food cold. When you look at the sophistication of the attacks, it's an amazing leap to assign such sophisticated cyber attacks to a country that runs it's entire computer infrastructure as an government controlled Intranet that people still access over dial-up modem. I mean even just using Occams razor on the South Korean bank attacks... You're going to require extremely educated people, who have the requisite hacking skill and mindsets, which often require unfettered access to information that is denied to most everyone, and small details like the fact that the attackers also are knowledgeable in multiple spoken languages and other things that are so out of the ordinary for NK. What is more likely.. that all of these sophisticated attacks are being done by a country that can barely keep the power on, or that they are done by someone pretending to be North Korea and using them as a scapegoat? Personally I think it's the latter.

TACIXAT 8y ago
My understanding is that NK works out of a Chinese city Shenyang. [1] Their lack of internet infrastructure does not really matter in that case. As well, if they are working out of China you have to assume they are exchanging information with China. China has some pretty top tier security experts. I do not think it is unreasonable at all for someone in NK to be trained up in how to write ransomware or a wiper. 1. https://www.businessinsider.com/north-korean-hackers-working-in-china-2015-1 https://www.businessinsider.com/north-korean-hackers-working...
openasocket 8y ago
I disagree with the idea that the DPRK is not capable of such attacks. They've demonstrated they are capable of creating nuclear weapons and ICBMs, I don't think it's such a stretch to say they are capable of APT attacks. Especially when you consider that the DPRK gets a lot of support from China, which also engages in cyber attacks. It wouldn't be difficult to send DPRK citizens to China to be educated and instructed in computer technology. More difficult, but still possible, is covertly sending north koreans to various western institutions to receive an education in cyber security. Recall that Kim Jung Un himself was educated in Switzerland. There's also the possibility that the APT group is partially or completely composed of foreigners hired to engage in these attacks on behalf of the DPRK. I know one of the people on Operation Blockbuster believed that this was "contracted out" to some clandestine group. This would explain the attackers being multi-lingual. It would also explain why many of their attacks focus on financial institutions and theft. This focus has been proposed as a way for the DPRK to get international currency to make purchases and evade sanctions, but it would also make sense for a group that is in it for the money.
- jessaustin 8y ago
  Can we get an estimate of how much money was stolen/earned/misplaced/whatever in this hack?
  - openasocket 8y ago
    In the Sony hack? None. But many of the Lazarus group's other attacks have resulted in getting significant amounts of money. There was the theft with the Bangladesh bank a few years ago, where they got away with around $100M US. There were some other, smaller incidents involving banks in Vietnam and Taiwan. And the Lazarus group is believed to be behind the WannaCry randsomware, idk how much they got from that.