3 ms·
As someone else that's spent a large amount of time looking into this, I'd like to offer a dissenting opinion. I agree with the analysis linking the groups.. h
by rando444 8y ago
As someone else that's spent a large amount of time looking into this, I'd like to offer a dissenting opinion.
I agree with the analysis linking the groups.. however, the final conclusion is because the other attacks were attributed to NK, then we must also attribute these attacks to NK.
I think these assumptions need to be questioned.
The sophistication of the attacks is so out of proportion with North Koreas abilities, it almost reaches the point of absurdity.
I mean we're talking about an entire country full of people that are denied access to the internet, most do not have computers, and many don't even have the electricity to run them. We're talking about a country where refrigerators are luxury and purchased by the middle class to store books since they don't have steady electricity that would allow them to keep food cold.
When you look at the sophistication of the attacks, it's an amazing leap to assign such sophisticated cyber attacks to a country that runs it's entire computer infrastructure as an government controlled Intranet that people still access over dial-up modem.
I mean even just using Occams razor on the South Korean bank attacks...
You're going to require extremely educated people, who have the requisite hacking skill and mindsets, which often require unfettered access to information that is denied to most everyone, and small details like the fact that the attackers also are knowledgeable in multiple spoken languages and other things that are so out of the ordinary for NK.
What is more likely.. that all of these sophisticated attacks are being done by a country that can barely keep the power on, or that they are done by someone pretending to be North Korea and using them as a scapegoat?
Personally I think it's the latter.
- TACIXAT 8y agoMy understanding is that NK works out of a Chinese city Shenyang. [1] Their lack of internet infrastructure does not really matter in that case. As well, if they are working out of China you have to assume they are exchanging information with China. China has some pretty top tier security experts. I do not think it is unreasonable at all for someone in NK to be trained up in how to write ransomware or a wiper. 1. https://www.businessinsider.com/north-korean-hackers-working-in-china-2015-1 https://www.businessinsider.com/north-korean-hackers-working...
- openasocket 8y agoI disagree with the idea that the DPRK is not capable of such attacks. They've demonstrated they are capable of creating nuclear weapons and ICBMs, I don't think it's such a stretch to say they are capable of APT attacks. Especially when you consider that the DPRK gets a lot of support from China, which also engages in cyber attacks. It wouldn't be difficult to send DPRK citizens to China to be educated and instructed in computer technology. More difficult, but still possible, is covertly sending north koreans to various western institutions to receive an education in cyber security. Recall that Kim Jung Un himself was educated in Switzerland. There's also the possibility that the APT group is partially or completely composed of foreigners hired to engage in these attacks on behalf of the DPRK. I know one of the people on Operation Blockbuster believed that this was "contracted out" to some clandestine group. This would explain the attackers being multi-lingual. It would also explain why many of their attacks focus on financial institutions and theft. This focus has been proposed as a way for the DPRK to get international currency to make purchases and evade sanctions, but it would also make sense for a group that is in it for the money.
- jessaustin 8y agoCan we get an estimate of how much money was stolen/earned/misplaced/whatever in this hack?
- openasocket 8y agoIn the Sony hack? None. But many of the Lazarus group's other attacks have resulted in getting significant amounts of money. There was the theft with the Bangladesh bank a few years ago, where they got away with around $100M US. There were some other, smaller incidents involving banks in Vietnam and Taiwan. And the Lazarus group is believed to be behind the WannaCry randsomware, idk how much they got from that.
- jessaustin 8y agoThis undercuts either the APT classification or the identification of the APT with DPRK. It's not as though Sony doesn't have any money; a group that steals money would have stolen some. In that case there would have been some sort of credible trail to follow. Actually the whole "we don't like movies about Dear Leader" supposed motivation is only superficially reasonable. From the leaked email it's clear that this was a chaotic capricious organization that wouldn't have hesitated to fire embittered IT (or simply IT-aware) staff, who would then have been well-placed to do everything that was done to Sony. (I especially liked the unencrypted Word docs they had of nothing but hundreds of passwords. Passwords don't belong in Word docs!) "Guardians of Peace" had a special hatred for Sony execs, while e.g. Rogen and Franco were afterthoughts.
- CamperBob2 8y agoWhat's harder, building nukes or hacking Windows? Why should I expect that an entity capable of the first is not capable of the second?