5 ms·

Just earlier today I had a client asking me about the Sony breach, and I laid out all the reasons I didn't think North Korea was actually behind it -- nor did S

Just earlier today I had a client asking me about the Sony breach, and I laid out all the reasons I didn't think North Korea was actually behind it -- nor did Schneier. Then just a few hours later the New York Times came out with an article claiming that they have information from some Washington sources that it has been confirmed to be North Korea. I checked the author bylines, because Judith Miller and the NYTimes, and David E Sanger I could see being politically motivated to make a case like that on some pretty flimsy evidence, but Nicole Perlroth has good tech journalist creds. So, I dunno. Looks like it might be North Korea after all. At the moment, I figure there are three scenarios, and none of them are really wonderful to think about: 1. It's China, working through or with North Korea. They certainly have the ability (and in some cases, insider information), and they've been waging a network and technology-based conflict around the world for years now. But, in the past, they've been carefully diplomatic about managing relations between North Korea and the rest of the world; it doesn't make sense for them to suddenly paint a huge target on NK's back, and China's past exploits have been kept pretty quiet. I don't understand why they'd want this one to be big and public. 2. It actually is North Korea. We've been led to believe that they exist in a technological dark ages of sorts, with most of their infrastructure relying on technology that would horrify the average HN user. They're certainly belligerent enough, but now suddenly we find that they have not just the technology to pull it off, but also the talent? How does that kind of talent even develop under a strictly regimented government like North Korea's? What kind of ability do they actually have? 3. It's neither North Korea nor China. This is the most disturbing one to think about; now that the NYTimes and Washington are involved, it smells a bit like the kind of political maneuver with propaganda that we saw in the run-up to the Iraq war. At the moment, this is still really feasible, and it makes me wonder what Washington's motives might be. Only time will tell for sure, I guess. Whoever is actually behind this, they won't be able to stay quiet forever.

justicezyx 12y ago
Nice analysis. But fk, can you stop blaming China and NK for these thing and put some facts to back up your claims?
brenschluss 12y ago
> 2. It actually is North Korea. We've been led to believe that they exist in a technological dark ages of sorts, with most of their infrastructure relying on technology that would horrify the average HN user. They're certainly belligerent enough, but now suddenly we find that they have not just the technology to pull it off, but also the talent? How does that kind of talent even develop under a strictly regimented government like North Korea's? What kind of ability do they actually have? See, this really isn't the case, and why most people believe this is beyond me, when a google search would suffice. I'm not criticizing you, actually, just pointing out that there's an incredible amount of misinformation out there about North Korea. Look at these photographs of a technology trade fair in Pyongyang this summer, for example: http://www.northkoreatech.org/2014/06/23/another-look-at-the-spring-trade-fair/ http://www.northkoreatech.org/2014/06/23/another-look-at-the... Most telling, IMO, is that a 32G usb is being sold for USD20, where at the time of writing, the same product was nearly USD16 on Amazon US. That's a remarkably low markup for a product, especially for one in North Korea. Also considering that it's a high volume, low price product with so little of a markup makes me think that other technologies must be very available and accessible, and that NK is hardly the technological dark ages that popular discussion has us think it is. Of course, this all isn't to say that NK performed the hack, but I hardly think that a lack of infrastructure would really be the barrier if North Korea really wanted to train a cadre of hackers.
- CamperBob2 12y ago
  The amount of $20 isn't relevant. What's relevant is how hard it is to come by $20 in the DPRK.
  - senand 12y ago
    Indeed. Don't forget the currency is the won, not US dollars. Foreign currency in a communist country is most likely very hard to get (at least in East Germany it was).
  - brenschluss 12y ago
    Clearly not very hard, if the entire trade show is conducted in RMB, euros, and usd.
rjvir 12y ago
What about a slight variation of #1: North Korea massively funding a Chinese hacker group to carry out the attack.
- deleted 12y ago
  [deleted]
throwaway5752 12y ago
"We've been led to believe that they exist in a technological dark ages of sorts" They have very publicly show capability to launch long to medium range ballistic missiles and they have an active nuclear weapons program. I'm not directing this at your entirely, but I'm surprised how many people thing don't believe they lack the technical capacity for computer warfare.
- Rapzid 12y ago
  I don't think anyone believes North Korea lacks the capability to execute on information freely available from the internet, or to launch Russian missiles for that matter. What they do lack, apparently, is the ability to run a country that's not an oppressive shit hole.
dagw 12y ago
As to point 2, here[1] is a fairly complete report musing on the technological and cyber warfare capabilities of the North Korean Military. Not that I think they did it, but they certainly might be capable. [1] http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-software-security-blog/388/2/HPSR%20SecurityBriefing_Episode16_NorthKorea.pdf http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-so...
tmsh 12y ago
Nicole Perlroth has good tech journalist creds. Why do you think that? I don't see any reason to believe that based on my albeit superficial search so far.. In fact though, I see oddly coincidental and potentially biased 'creds' in her LinkedIn profile, etc. ('Her 2014 Times profile of security blogger Brian Krebs has been optioned by Sony Pictures.' https://www.linkedin.com/in/nicoleperlroth https://www.linkedin.com/in/nicoleperlroth ). Genuinely curious though if she is unbiased or if maybe she should be checked against.
- thaumaturgy 12y ago
  Well, I did pretty much the same thing, but ignored LinkedIn -- she did an interview with Krebs, but I also saw a series of other tech-related articles with a security focus. At the least, I didn't see an obvious political bias. I also try to be careful not to dig too deeply into the backgrounds of people writing articles I disagree with. Seems like a dishonest thing to do.
  - slayed0 12y ago
    Looking at a page that was intentionally made public by the author for the purpose of displaying non-sensitive/work related information (linkedin) is in no way "digging too deeply"
- jessaustin 12y ago
  I wouldn't have been disappointed to see a mention of the business she has with Sony Pictures in the article she wrote about Sony Pictures, in the interests of full disclosure.
sd8f9iu 12y ago
This is an article reporting on government officials' claims that the attack comes from NK. The credentials of the reporters (especially their "tech journalist" credentials) hardly matter. The NYTimes isn't endorsing this position, it's just reporting that government officials say it, and it'd be pretty stupid of the NYTimes to just make it up. I don't understand why you suspect a conspiracy, especially based on such little info. With regard to point 2, remember that this is the country that built a nuclear weapon and launched an object into orbit (with some dramatic difficulties on the way). If the NK government wants to get something done, especially something militaristically, they do it.
swombat 12y ago
One possibility I've heard aired on Twitter, which I find somewhat disturbing (it's telling of my current distrust of state actors that I even consider this highly paranoid scenario a possibility), is that this will be used as a sort of digital Pearl Harbour to justify hardening laws against hackers, security researchers, etc. Of course, the two aren't really related, and in fact security researchers and hackers increase the security of the US against such things, but that hasn't stopped the lawmakers before.
- davidw 12y ago
  > justify hardening laws against hackers Seems far fetched as North Korean hackers are about as far away as you can get from US influence and power.
  - dspillett 12y ago
    > > justify hardening laws against hackers > Seems far fetched as North Korean hackers are about as far away as you can get from US influence and power. The concern that they'd state would be local hackers working for or with those elsewhere for what-ever reason (payment, disenfranchisement with local policies, ...) or just doing it "for the lols". The potential knee-jerk hardening of laws in response to this sort of thing is not specific to this case: it could equally happen in response to any other very public exploit. The same for the more insidious "we've been waiting for an excuse to..." hardening of laws, for a more paranoid view.
- logn 12y ago
  This is hardly paranoid. That's the type of thing neo-cons publicly wrote about before the Bush/Cheney presidency: https://en.wikipedia.org/wiki/Project_for_the_New_American_Century#.22New_Pearl_Harbor.22 https://en.wikipedia.org/wiki/Project_for_the_New_American_C... Also note that CISPA passed the House this summer but failed in the Senate. Guess who takes over the Senate next year?
- andygates 12y ago
  That's just chatter. It's the digital equivalent of "they're coming to take away our guns!" after every mass shooting.
nikatwork 12y ago
According to the military community, NK/China relations are strained at the moment. In that case I would be surprised if they worked together on such a high-profile hack. "North Korea is even angrier, and very shaken that a retired Chinese general said publically that China would not come to the aid of the current North Korean government if the government collapses or starts a war. China often makes official announcements via public 'comments' by retired senior government or military officials. This makes it easier to, if need be, back off from the new policy. China has not backed off this one. China is telling North Korea to do what China wants or else. China wants work on North Korean nuclear weapons stopped. China apparently promised to be useful in the UN if North Korea resumed the six nation talks over North Korean nuclear weapons." http://strategypage.com/qnd/korea/articles/20141216.aspx http://strategypage.com/qnd/korea/articles/20141216.aspx

justicezyx 12y ago

Nice analysis. But fk, can you stop blaming China and NK for these thing and put some facts to back up your claims?

brenschluss 12y ago

> 2. It actually is North Korea. We've been led to believe that they exist in a technological dark ages of sorts, with most of their infrastructure relying on technology that would horrify the average HN user. They're certainly belligerent enough, but now suddenly we find that they have not just the technology to pull it off, but also the talent? How does that kind of talent even develop under a strictly regimented government like North Korea's? What kind of ability do they actually have? See, this really isn't the case, and why most people believe this is beyond me, when a google search would suffice. I'm not criticizing you, actually, just pointing out that there's an incredible amount of misinformation out there about North Korea. Look at these photographs of a technology trade fair in Pyongyang this summer, for example: http://www.northkoreatech.org/2014/06/23/another-look-at-the-spring-trade-fair/ http://www.northkoreatech.org/2014/06/23/another-look-at-the... Most telling, IMO, is that a 32G usb is being sold for USD20, where at the time of writing, the same product was nearly USD16 on Amazon US. That's a remarkably low markup for a product, especially for one in North Korea. Also considering that it's a high volume, low price product with so little of a markup makes me think that other technologies must be very available and accessible, and that NK is hardly the technological dark ages that popular discussion has us think it is. Of course, this all isn't to say that NK performed the hack, but I hardly think that a lack of infrastructure would really be the barrier if North Korea really wanted to train a cadre of hackers.

CamperBob2 12y ago
The amount of $20 isn't relevant. What's relevant is how hard it is to come by $20 in the DPRK.
- senand 12y ago
  Indeed. Don't forget the currency is the won, not US dollars. Foreign currency in a communist country is most likely very hard to get (at least in East Germany it was).
- brenschluss 12y ago
  Clearly not very hard, if the entire trade show is conducted in RMB, euros, and usd.

rjvir 12y ago

What about a slight variation of #1: North Korea massively funding a Chinese hacker group to carry out the attack.

deleted 12y ago
[deleted]

throwaway5752 12y ago

"We've been led to believe that they exist in a technological dark ages of sorts" They have very publicly show capability to launch long to medium range ballistic missiles and they have an active nuclear weapons program. I'm not directing this at your entirely, but I'm surprised how many people thing don't believe they lack the technical capacity for computer warfare.

Rapzid 12y ago
I don't think anyone believes North Korea lacks the capability to execute on information freely available from the internet, or to launch Russian missiles for that matter. What they do lack, apparently, is the ability to run a country that's not an oppressive shit hole.

dagw 12y ago

As to point 2, here[1] is a fairly complete report musing on the technological and cyber warfare capabilities of the North Korean Military. Not that I think they did it, but they certainly might be capable. [1] http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-software-security-blog/388/2/HPSR%20SecurityBriefing_Episode16_NorthKorea.pdf http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-so...

tmsh 12y ago

Nicole Perlroth has good tech journalist creds. Why do you think that? I don't see any reason to believe that based on my albeit superficial search so far.. In fact though, I see oddly coincidental and potentially biased 'creds' in her LinkedIn profile, etc. ('Her 2014 Times profile of security blogger Brian Krebs has been optioned by Sony Pictures.' https://www.linkedin.com/in/nicoleperlroth https://www.linkedin.com/in/nicoleperlroth ). Genuinely curious though if she is unbiased or if maybe she should be checked against.

thaumaturgy 12y ago
Well, I did pretty much the same thing, but ignored LinkedIn -- she did an interview with Krebs, but I also saw a series of other tech-related articles with a security focus. At the least, I didn't see an obvious political bias. I also try to be careful not to dig too deeply into the backgrounds of people writing articles I disagree with. Seems like a dishonest thing to do.
- slayed0 12y ago
  Looking at a page that was intentionally made public by the author for the purpose of displaying non-sensitive/work related information (linkedin) is in no way "digging too deeply"
jessaustin 12y ago
I wouldn't have been disappointed to see a mention of the business she has with Sony Pictures in the article she wrote about Sony Pictures, in the interests of full disclosure.

sd8f9iu 12y ago

This is an article reporting on government officials' claims that the attack comes from NK. The credentials of the reporters (especially their "tech journalist" credentials) hardly matter. The NYTimes isn't endorsing this position, it's just reporting that government officials say it, and it'd be pretty stupid of the NYTimes to just make it up. I don't understand why you suspect a conspiracy, especially based on such little info. With regard to point 2, remember that this is the country that built a nuclear weapon and launched an object into orbit (with some dramatic difficulties on the way). If the NK government wants to get something done, especially something militaristically, they do it.

swombat 12y ago

One possibility I've heard aired on Twitter, which I find somewhat disturbing (it's telling of my current distrust of state actors that I even consider this highly paranoid scenario a possibility), is that this will be used as a sort of digital Pearl Harbour to justify hardening laws against hackers, security researchers, etc. Of course, the two aren't really related, and in fact security researchers and hackers increase the security of the US against such things, but that hasn't stopped the lawmakers before.

davidw 12y ago
> justify hardening laws against hackers Seems far fetched as North Korean hackers are about as far away as you can get from US influence and power.
- dspillett 12y ago
  > > justify hardening laws against hackers > Seems far fetched as North Korean hackers are about as far away as you can get from US influence and power. The concern that they'd state would be local hackers working for or with those elsewhere for what-ever reason (payment, disenfranchisement with local policies, ...) or just doing it "for the lols". The potential knee-jerk hardening of laws in response to this sort of thing is not specific to this case: it could equally happen in response to any other very public exploit. The same for the more insidious "we've been waiting for an excuse to..." hardening of laws, for a more paranoid view.
logn 12y ago
This is hardly paranoid. That's the type of thing neo-cons publicly wrote about before the Bush/Cheney presidency: https://en.wikipedia.org/wiki/Project_for_the_New_American_Century#.22New_Pearl_Harbor.22 https://en.wikipedia.org/wiki/Project_for_the_New_American_C... Also note that CISPA passed the House this summer but failed in the Senate. Guess who takes over the Senate next year?
andygates 12y ago
That's just chatter. It's the digital equivalent of "they're coming to take away our guns!" after every mass shooting.

nikatwork 12y ago

According to the military community, NK/China relations are strained at the moment. In that case I would be surprised if they worked together on such a high-profile hack. "North Korea is even angrier, and very shaken that a retired Chinese general said publically that China would not come to the aid of the current North Korean government if the government collapses or starts a war. China often makes official announcements via public 'comments' by retired senior government or military officials. This makes it easier to, if need be, back off from the new policy. China has not backed off this one. China is telling North Korea to do what China wants or else. China wants work on North Korean nuclear weapons stopped. China apparently promised to be useful in the UN if North Korea resumed the six nation talks over North Korean nuclear weapons." http://strategypage.com/qnd/korea/articles/20141216.aspx http://strategypage.com/qnd/korea/articles/20141216.aspx