8 ms·
> The attacks at Sony were routed from command and control centers across the world, including a convention center in Singapore and a computer at Thammasat Univ
by nikcub 12y ago
> The attacks at Sony were routed from command and control centers across the world, including a convention center in Singapore and a computer at Thammasat University in Thailand. But one of those command and control servers, a computer in Bolivia, had been used before, in a limited set of cyberattacks on South Korean targets two years ago.
The evidence has to be better than this to make an accusation against a state. Botnets overlap a lot because the way they are built is with automated scanners that take advantage of common vulnerabilities. It isn't uncommon to find a botnet client that has been hacked a half-dozen other times and has had rootkits installed each time. A large part of sophisticated botnet droppers is removing all the previously installed botnets on a server where a vulnerability has been found.
Having one client in common with another attack network is a low or insignificant figure.
Similar applies to common modules found in other malware. Authors reverse engineer and re-appropriate techniques or libraries from other successful malware all the time. That is also not evidence of a link to North Korea.
- webkike 12y agoDid you read the sentence literally right after your quoted text? > That suggests, but does not prove that that the same group or individuals may have been behind both attacks.
- 001sky 12y agoThat's obvious boilerplate, tho
- webkike 12y agoA concession to uncertainty is the difference between a religion and a science.
- 001sky 12y agoWikipedia now has an article on this https://en.wikipedia.org/wiki/Cover_your_ass https://en.wikipedia.org/wiki/Cover_your_ass
- 001sky 12y ago"Intelligence officials believe with “99 percent certainty” that hackers working for the North Korean government carried out the attack, said one individual who was briefed on the investigation and spoke on condition of anonymity." --Washington Post
- nikcub 12y agoYes, and i'm saying that sharing a single IP in a botnet suggests nothing.
- webkike 12y agoHow do you know it's a botnet? For all we know the attackers have list of compromised servers that they use. I know the distinction is thin, but it still exists.
- rnovak 12y agoI don't know that I would take the Time's reporting on the investigation to be the end-all-be-all of what evidence there is. Like you say, accusing a Nation State probably requires a decent amount of evidence, and I doubt they would release it all to the NY Times. The article even says > It is not clear how the United States came to its determination that the North Korean regime played a central role in the Sony attacks To me, that sounds like they aren't privy to the reasoning used.
- hugi 12y agoYes, accusing a nation state requires a decent amount of evidence - however the US has a track record of lying about and and manufacturing evidence when required. Or how's that whole "chemical weapons in Iraq"-thing going? If the US has better evidence, why not show it? I'm not saying NK didn't conduct those attacks, I'm just saying the US government isn't really a reliable source about anything.
- notjackma 12y agoThe headlines go around the world and people will just accept it as the truth. If there is a retraction it will be in a year's time and buried under an ad for washing powder on page 17. You simply don't need evidence anymore when the media, unwittingly perhaps, construct the narrative for you. Why is the New York Times held in such high esteem? Was there a period of time when it truly was a paper of record? These days it seems like the name Pravda on the Hudson is well deserved.
- xnull2guest 12y agoAttribution in cyberwarfare is infamously difficult. However, there is an age old equation that works fairly well for attribution: opportunity + motive + evidence. Opportunity in cyberwarfare is a complex item to tease out and has more to do with opportunity costs than anything else (the strategy of cyberwarfare demands owning everything immediately rather than later and the exercise becomes one of triage). In this instance we do have both a motive and some evidence that point to North Korea, and it is in line with the sort of theatrical politics NK is known for. IMHO more evidence and an analysis of opportunity cost are a must to pin NK down further, but you can be assured that (unless officials have ulterior geopolitical motives) they have a pretty good idea about the cyber capabilities and actions of other nation states - more than they are apt to release to media outlets.
- TazeTSchnitzel 12y agoBy the way, it's ulterior, not alterior.
- xnull2guest 12y agoThanks, fixed.
- nikcub 12y agoThis is my concern - they are starting with a motive and the DPRK and then working backwards to fit the evidence in. Everybody seems to have forgotten that this started as a financial ransom demand and the attackers made no mention of the movie or the DPRK until Sony and the media did. I'm not suggesting the DPRK are not involved, but that it is a very big leap to go from media speculating about motives to the US government formally accusing them. The details leaked to the NyTimes do not substantiate this leap.
- xnull2guest 12y agoIt's certainly true that a ransom was demanded first, giving Sony a few days to respond, and then only after the compromise was completed were demands made to remove 'The Interview'. It truly is difficult to attribute and only with more evidence and a more careful analysis of timeline, the malware, and the communications will things come into focus. One thing I have not yet been able to find are numbers for the ransom. I've seen the emails demanding ransom and the defacings demanding the same, but nowhere have I seen a number of dollars being demanded. Have you seen that anywhere?
- forrestthewoods 12y agoBehavior of all involved parties is highly indicative that they at least believe the threats of violence to be real. Body guards, cancelled media appearances, unprecedented cancellation of a theatrical release, jumpy reactions in public, and more. Internet death threats are nothing special. They happen all day every day. Especially for celebrities. Hacks aren't an every day occurrence but we hear about them regularly. That doesn't mean the threats are legitimate. Or that North Korea is involved. But the actions of folks involved do give serious weight to such an accusation.
- onewaystreet 12y agoThe US government is never going to release all of the evidence it has because they don't want to explain how they obtained it, which would be the inevitable follow-up question.
- deciplex 12y agoThen we should never believe a single word they say, especially considering their track record.
- meowface 12y agoI agree, but I'm pretty sure the FBI and NSA have more info than just that which they can tie back.
- eli 12y agoThe Post says the malware itself contains sections in Korean and is similar to code found on South Korean networks. But like you, I still remain skeptical
- remarkEon 12y agoWould it be easy to replicate that, though? I share your skepticism.