7 ms·

Attribution in cyberwarfare is infamously difficult. However, there is an age old equation that works fairly well for attribution: opportunity + motive + evide

Attribution in cyberwarfare is infamously difficult. However, there is an age old equation that works fairly well for attribution: opportunity + motive + evidence. Opportunity in cyberwarfare is a complex item to tease out and has more to do with opportunity costs than anything else (the strategy of cyberwarfare demands owning everything immediately rather than later and the exercise becomes one of triage). In this instance we do have both a motive and some evidence that point to North Korea, and it is in line with the sort of theatrical politics NK is known for. IMHO more evidence and an analysis of opportunity cost are a must to pin NK down further, but you can be assured that (unless officials have ulterior geopolitical motives) they have a pretty good idea about the cyber capabilities and actions of other nation states - more than they are apt to release to media outlets.

TazeTSchnitzel 12y ago
By the way, it's ulterior, not alterior.
- xnull2guest 12y ago
  Thanks, fixed.
nikcub 12y ago
This is my concern - they are starting with a motive and the DPRK and then working backwards to fit the evidence in. Everybody seems to have forgotten that this started as a financial ransom demand and the attackers made no mention of the movie or the DPRK until Sony and the media did. I'm not suggesting the DPRK are not involved, but that it is a very big leap to go from media speculating about motives to the US government formally accusing them. The details leaked to the NyTimes do not substantiate this leap.
- xnull2guest 12y ago
  It's certainly true that a ransom was demanded first, giving Sony a few days to respond, and then only after the compromise was completed were demands made to remove 'The Interview'. It truly is difficult to attribute and only with more evidence and a more careful analysis of timeline, the malware, and the communications will things come into focus. One thing I have not yet been able to find are numbers for the ransom. I've seen the emails demanding ransom and the defacings demanding the same, but nowhere have I seen a number of dollars being demanded. Have you seen that anywhere?
- marincounty 12y ago
  Plus, would terrorists offer an opt out(for personal information) for rank and file Sony personnel?
  - xnull2guest 12y ago
    Whoa. Terrorists? Which terrorists? What terrorism are you talking about?
    - SEJeff 12y ago
      Thanks to our favorite president GW Bush, any computer hacking is considered "terrorism" and has similar consequences just like real terrorism such as ISIL or Al Qaida: http://www.securityfocus.com/news/257 http://www.securityfocus.com/news/257
      - xnull2guest 12y ago
        I would suggest that even ISIL isn't a terrorist group, at least in the same sense that the word terrorism has been used throughout the past 100 years. ISIL represents 30k mobilized personel, are made up of a huge number of disparate factions (some fighting for a three state solution - which would actually be a great improvement in the organization of the middle east, whose lines right now were drawn by the British and have nothing to do with historical or cultural boundaries), are fighting with traditional armies with traditional warfare weaponry and because they are fighting for political change in a state where authoritarian governments with financial and political ties to outside nations has limited how much they can represent their people. ISIL to me, if I use textbook comparisons, looks more like an grassroots insurgent army fighting for political representation. Re: computer hacking considered "terrorism" - this represents yet another way "terrorism" no longer means the despicable act it was originally associated with. And doesn't that make the "War on Terror" also a "War on Hacking"? How the hell are we going to win a war on hacking? I do hope that the OP was not using the GW Bush administration definition of terrorism...
    - deciplex 12y ago
      Any action that results in rich assholes losing a bit of money or potentially losing a bit of money falls under the umbrella of terrorism now, or 'economic terrorism' if you will. So copyright infringement and of course any form of organized protest fit the bill, along with hacking a Japanese company with offices in the US. You can try to fight the total annihilation of meaning in our language, but as you see here it is a losing battle.
marcosdumay 12y ago
One can always post-fact construct a motive for North Korea. One can certainly think about front page worth motives for Iran too if you try, and Russia, and whoever you want. Opportunity costs are exactly as low for every country that the US decided to antagonize by placing on their evil axys list, and only marginally bigger for any other actor, because nobody will catch the hacker. The only item of yours that can not point to anybody that you want is the evidence. Evidence-less finger pointing is not a sane sport.
- xnull2guest 12y ago
  Can you come up with a good motive for Iran or Russia? Opportunity costs are not exactly as low for every country, as they have different capabilities, use different tactics, have different budgets and talent pools, and have different interests. Triage is going to be different for different state actors. Pure and simple. I'm not sure that an opportunity cost analysis indicts NK - and in fact I do suggest that work needs to be done there in the original comment.
  - alttab 12y ago
    Even the motive for a lone wolf hacker with a huge botnet would make sense if they were impressing themselves with how good the hack was. If they could "trick" the US into thinking it was North Korea, the lulz from that alone would be enough to have the whole charade to take on a life of its own. That's just a good a reason as any other motive for any other suspect given that I've seen.
smtddr 12y ago
>>However, there is an age old equation that works fairly well for attribution: opportunity + motive + evidence. IMHO, SONY & USgov have more of the first 2 than N.K. and the 3rd can just be made up.
- xnull2guest 12y ago
  I agree that if you think Sony and the US government have more motive, this changes attribution (and in fact I mentioned it wrt "ulterior motive"). I'm curious about what motives you think Sony and USG have. I'm not sure what to make about the opportunity cost analysis indicting Sony or the USG - maybe you could say more about that too?
  - smtddr 12y ago
    SONY might think the movie was going to bomb anyway(I don't understand why anyone would want to watch this on xmas) and this hacking incident is probably going to cost them millions as well. Turning this likely-to-fail movie + hacking disaster into a promotional catapult generating big profits would be one option. Even I want to watch this movie now, but not on xmas. USgov., I think they will take any chance given to them to put China, Russia and N.K. in a bad light.
    - xnull2guest 12y ago
      I'm not sure what I think about the motive of Sony to turn the hacking into a promotional event or how the USG motive you suggest squares with what they've said over the past week (they have been careful not to attribute until just recently, even in spite of rumors of NK fault). The big question your analysis seems to beg is why #GOP would demand that the movie not be shown. In the scenario where Sony and the USG want to spin this as anti-NK propaganda (certainly this is not out of the USG playbook), why would #GOP play along? I don't understand #GOP's motive in your scenario.
      - smtddr 12y ago
        All this is pure speculation on my part of course, but I think the #GOP are just talented people doing it for the lulz. Note that the media mentioned North Korea first, possibly giving #GOP the idea to increase the lulz to levels previously unimagined. Bonus points - It diverts attention from the real hackers; making them less likely to be caught.
est 12y ago
> Attribution in cyberwarfare is infamously difficult. When in doubt, blame China.
- differentView 12y ago
  Wait a couple of days. Anti-China politicians will get there.
wyck 12y ago
There is an age old word too, scapegoat. It's must be easy to lay blame on something that can't be heard.

TazeTSchnitzel 12y ago

By the way, it's ulterior, not alterior.

xnull2guest 12y ago
Thanks, fixed.

nikcub 12y ago

This is my concern - they are starting with a motive and the DPRK and then working backwards to fit the evidence in. Everybody seems to have forgotten that this started as a financial ransom demand and the attackers made no mention of the movie or the DPRK until Sony and the media did. I'm not suggesting the DPRK are not involved, but that it is a very big leap to go from media speculating about motives to the US government formally accusing them. The details leaked to the NyTimes do not substantiate this leap.

xnull2guest 12y ago
It's certainly true that a ransom was demanded first, giving Sony a few days to respond, and then only after the compromise was completed were demands made to remove 'The Interview'. It truly is difficult to attribute and only with more evidence and a more careful analysis of timeline, the malware, and the communications will things come into focus. One thing I have not yet been able to find are numbers for the ransom. I've seen the emails demanding ransom and the defacings demanding the same, but nowhere have I seen a number of dollars being demanded. Have you seen that anywhere?
marincounty 12y ago
Plus, would terrorists offer an opt out(for personal information) for rank and file Sony personnel?
- xnull2guest 12y ago
  Whoa. Terrorists? Which terrorists? What terrorism are you talking about?
  - SEJeff 12y ago
    Thanks to our favorite president GW Bush, any computer hacking is considered "terrorism" and has similar consequences just like real terrorism such as ISIL or Al Qaida: http://www.securityfocus.com/news/257 http://www.securityfocus.com/news/257
    - xnull2guest 12y ago
      I would suggest that even ISIL isn't a terrorist group, at least in the same sense that the word terrorism has been used throughout the past 100 years. ISIL represents 30k mobilized personel, are made up of a huge number of disparate factions (some fighting for a three state solution - which would actually be a great improvement in the organization of the middle east, whose lines right now were drawn by the British and have nothing to do with historical or cultural boundaries), are fighting with traditional armies with traditional warfare weaponry and because they are fighting for political change in a state where authoritarian governments with financial and political ties to outside nations has limited how much they can represent their people. ISIL to me, if I use textbook comparisons, looks more like an grassroots insurgent army fighting for political representation. Re: computer hacking considered "terrorism" - this represents yet another way "terrorism" no longer means the despicable act it was originally associated with. And doesn't that make the "War on Terror" also a "War on Hacking"? How the hell are we going to win a war on hacking? I do hope that the OP was not using the GW Bush administration definition of terrorism...
  - deciplex 12y ago
    Any action that results in rich assholes losing a bit of money or potentially losing a bit of money falls under the umbrella of terrorism now, or 'economic terrorism' if you will. So copyright infringement and of course any form of organized protest fit the bill, along with hacking a Japanese company with offices in the US. You can try to fight the total annihilation of meaning in our language, but as you see here it is a losing battle.

marcosdumay 12y ago

One can always post-fact construct a motive for North Korea. One can certainly think about front page worth motives for Iran too if you try, and Russia, and whoever you want. Opportunity costs are exactly as low for every country that the US decided to antagonize by placing on their evil axys list, and only marginally bigger for any other actor, because nobody will catch the hacker. The only item of yours that can not point to anybody that you want is the evidence. Evidence-less finger pointing is not a sane sport.

xnull2guest 12y ago
Can you come up with a good motive for Iran or Russia? Opportunity costs are not exactly as low for every country, as they have different capabilities, use different tactics, have different budgets and talent pools, and have different interests. Triage is going to be different for different state actors. Pure and simple. I'm not sure that an opportunity cost analysis indicts NK - and in fact I do suggest that work needs to be done there in the original comment.
- alttab 12y ago
  Even the motive for a lone wolf hacker with a huge botnet would make sense if they were impressing themselves with how good the hack was. If they could "trick" the US into thinking it was North Korea, the lulz from that alone would be enough to have the whole charade to take on a life of its own. That's just a good a reason as any other motive for any other suspect given that I've seen.

smtddr 12y ago

>>However, there is an age old equation that works fairly well for attribution: opportunity + motive + evidence. IMHO, SONY & USgov have more of the first 2 than N.K. and the 3rd can just be made up.

xnull2guest 12y ago
I agree that if you think Sony and the US government have more motive, this changes attribution (and in fact I mentioned it wrt "ulterior motive"). I'm curious about what motives you think Sony and USG have. I'm not sure what to make about the opportunity cost analysis indicting Sony or the USG - maybe you could say more about that too?
- smtddr 12y ago
  SONY might think the movie was going to bomb anyway(I don't understand why anyone would want to watch this on xmas) and this hacking incident is probably going to cost them millions as well. Turning this likely-to-fail movie + hacking disaster into a promotional catapult generating big profits would be one option. Even I want to watch this movie now, but not on xmas. USgov., I think they will take any chance given to them to put China, Russia and N.K. in a bad light.
  - xnull2guest 12y ago
    I'm not sure what I think about the motive of Sony to turn the hacking into a promotional event or how the USG motive you suggest squares with what they've said over the past week (they have been careful not to attribute until just recently, even in spite of rumors of NK fault). The big question your analysis seems to beg is why #GOP would demand that the movie not be shown. In the scenario where Sony and the USG want to spin this as anti-NK propaganda (certainly this is not out of the USG playbook), why would #GOP play along? I don't understand #GOP's motive in your scenario.
    - smtddr 12y ago
      All this is pure speculation on my part of course, but I think the #GOP are just talented people doing it for the lulz. Note that the media mentioned North Korea first, possibly giving #GOP the idea to increase the lulz to levels previously unimagined. Bonus points - It diverts attention from the real hackers; making them less likely to be caught.

est 12y ago

> Attribution in cyberwarfare is infamously difficult. When in doubt, blame China.

differentView 12y ago
Wait a couple of days. Anti-China politicians will get there.

wyck 12y ago

There is an age old word too, scapegoat. It's must be easy to lay blame on something that can't be heard.