9 ms·

I disagree with the idea that the DPRK is not capable of such attacks. They've demonstrated they are capable of creating nuclear weapons and ICBMs, I don't thin

I disagree with the idea that the DPRK is not capable of such attacks. They've demonstrated they are capable of creating nuclear weapons and ICBMs, I don't think it's such a stretch to say they are capable of APT attacks. Especially when you consider that the DPRK gets a lot of support from China, which also engages in cyber attacks. It wouldn't be difficult to send DPRK citizens to China to be educated and instructed in computer technology. More difficult, but still possible, is covertly sending north koreans to various western institutions to receive an education in cyber security. Recall that Kim Jung Un himself was educated in Switzerland. There's also the possibility that the APT group is partially or completely composed of foreigners hired to engage in these attacks on behalf of the DPRK. I know one of the people on Operation Blockbuster believed that this was "contracted out" to some clandestine group. This would explain the attackers being multi-lingual. It would also explain why many of their attacks focus on financial institutions and theft. This focus has been proposed as a way for the DPRK to get international currency to make purchases and evade sanctions, but it would also make sense for a group that is in it for the money.

jessaustin 8y ago
Can we get an estimate of how much money was stolen/earned/misplaced/whatever in this hack?
- openasocket 8y ago
  In the Sony hack? None. But many of the Lazarus group's other attacks have resulted in getting significant amounts of money. There was the theft with the Bangladesh bank a few years ago, where they got away with around $100M US. There were some other, smaller incidents involving banks in Vietnam and Taiwan. And the Lazarus group is believed to be behind the WannaCry randsomware, idk how much they got from that.
  - jessaustin 8y ago
    This undercuts either the APT classification or the identification of the APT with DPRK. It's not as though Sony doesn't have any money; a group that steals money would have stolen some. In that case there would have been some sort of credible trail to follow. Actually the whole "we don't like movies about Dear Leader" supposed motivation is only superficially reasonable. From the leaked email it's clear that this was a chaotic capricious organization that wouldn't have hesitated to fire embittered IT (or simply IT-aware) staff, who would then have been well-placed to do everything that was done to Sony. (I especially liked the unencrypted Word docs they had of nothing but hundreds of passwords. Passwords don't belong in Word docs!) "Guardians of Peace" had a special hatred for Sony execs, while e.g. Rogen and Franco were afterthoughts.
    - openasocket 8y ago
      Some of their attacks involve stealing money, but not all of them. Regardless, that argument is circumstantial at best. Look at the report https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf https://www.operationblockbuster.com/wp-content/uploads/2016... . There was re-use of malware, C&C infrastructure, and RSA certificates, that is hard evidence.

jessaustin 8y ago

Can we get an estimate of how much money was stolen/earned/misplaced/whatever in this hack?

openasocket 8y ago
In the Sony hack? None. But many of the Lazarus group's other attacks have resulted in getting significant amounts of money. There was the theft with the Bangladesh bank a few years ago, where they got away with around $100M US. There were some other, smaller incidents involving banks in Vietnam and Taiwan. And the Lazarus group is believed to be behind the WannaCry randsomware, idk how much they got from that.
- jessaustin 8y ago
  This undercuts either the APT classification or the identification of the APT with DPRK. It's not as though Sony doesn't have any money; a group that steals money would have stolen some. In that case there would have been some sort of credible trail to follow. Actually the whole "we don't like movies about Dear Leader" supposed motivation is only superficially reasonable. From the leaked email it's clear that this was a chaotic capricious organization that wouldn't have hesitated to fire embittered IT (or simply IT-aware) staff, who would then have been well-placed to do everything that was done to Sony. (I especially liked the unencrypted Word docs they had of nothing but hundreds of passwords. Passwords don't belong in Word docs!) "Guardians of Peace" had a special hatred for Sony execs, while e.g. Rogen and Franco were afterthoughts.
  - openasocket 8y ago
    Some of their attacks involve stealing money, but not all of them. Regardless, that argument is circumstantial at best. Look at the report https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf https://www.operationblockbuster.com/wp-content/uploads/2016... . There was re-use of malware, C&C infrastructure, and RSA certificates, that is hard evidence.