5 ms·

Hackers who broke into Sony Corp. (6758)’s Hollywood unit probably spent months collecting passwords and mapping the network before they committed a last act of

by revscat 12y ago

Hackers who broke into Sony Corp. (6758)’s Hollywood unit probably spent months collecting passwords and mapping the network before they committed a last act of vandalism, setting off a virus that wiped out data and crashed the system in 10 minutes. Trend Micro Inc. (4704) arrived at these conclusions after running simulations on a copy of the virus that struck Sony Pictures Entertainment’s computers. The Tokyo-based developer of security software declined to reveal where it got the malware. I am so far unconvinced that this was the work of a foreign government rather than an insider, and this article does little to make the case for DPRK involvement. The US government is heavily implying that they are to blame, but as yet have not given specifics as to why they think so. This article provides little new information in this regard. In fact, if anything, the following quote indicates an insider is just as likely to be the source: While it’s unclear how the hackers got access to Sony’s network, the virus they used to destroy it is available on the black market and can be used without a high level of technical sophistication, according to Someya. It was customized for the company, embedding in the program account names and passwords and targeting the security software, he said.

personZ 12y ago
In fact, if anything, the following quote indicates an insider is just as likely to be the source The common narrative in discounting any involvement of North Korea is that they're too famished and uneducated to perform such an operation. Your angle is that the attack isn't sophisticated enough? The evolving story is that a single IT worker with significant right grants was targeted by the group, and once that single user was exploited, their privileges were used to compromise the network. If you have the privileges of a superuser, your attack doesn't need to be sophisticated. And ultimately this is exactly how I would expect these sort of attacks to go, especially when hitting targets in free and open nations. Why go through the trouble and effort of trying to winnow in from the outside when you can just exploit the kink or vulnerabilities of individual people -- who you can now discover via LinkedIn -- and then work your magic from the "inside". Sending out a group policy to disable all security software is a couple of lines. This "virus" seemed to be a simple efficiency measure, as with those rights they could do pretty much everything, though mass malice would probably be too labor intensive minus some helpful tools. The defense against this is of course that even admins should have limits on their access and flags on their activities. Of course, the admins are the ones who normally implement this, so...
- Reebles 12y ago
  Most people I've seen question the North Korea angle absolutely acknowledge that they have the capability to do things like this. They usually argue that this does not fit the style and MO of a state sponsored attack, that The Interview was never mentioned by the hackers until after the media starting running with the story, and that there simply isn't enough public evidence to justifiably attribute it yet, among other things.
  - personZ 12y ago
    There is no MO regarding an attack from a country like North Korea. That country says bombastic things with regularity, and has seemingly little concern for blowback. How a country like Israel or the United States might do an attack like this has no relevance to what North Korea might do, whether directly or through a hired proxy. The Interview was never mentioned by the hackers until after the media starting running with the story North Korea threatened war over this movie - http://www.bbc.com/news/world-asia-28014069 http://www.bbc.com/news/world-asia-28014069 Now again, North Korea's words are kind of cheap, but they were talking about as big as you can get before this hack, and then specifically warned Sony to "obey" them. We have absolutely no idea what communications happened between the group and Sony and then law enforcement, so the whole what the media reported angle seems rather spurious. Sony/Law Enforcement, people who know more than us, seem to believe it was related to the movie.
    - eli 12y ago
      That's a fair point, but how many times a year does North Korea threaten war over something or other? A dozen?
    - revscat 12y ago
      There is no MO regarding an attack from a country like North Korea. Actually, there is. They tend to huff and puff about American military exercises that occur in cooperation with the Japanese or the South Koreans, or to complain to the UN about various things (e.g.: the CIA torturing people). But their MO, such as it is, is to complain and threaten, almost exclusively. Occasionally they will perform a missile test that causes concern, but those missiles land in the Sea of Japan or some other body of water, not anywhere that causes actual harm. No, this goes against the DPRK's MO up until now. If they are responsible then it is a shift in their tactics from "loud and threatening, but basically harmless to other nations", to "actively and publicly committing acts of economic espionage." That would be quite a departure for them.
berberous 12y ago
An insider strikes me as extremely unlikely. You would need to have someone that is normal and skilled enough to be hired at Sony (presumably in IT), but malicious or wronged enough to attempt to destroy the entire company, including wronging all of your co-workers and risking serious risk of prosecution from the U.S. government. Also, you would presumably be skilled enough to evade the FBI, but still somehow be stuck in some mid-tier Sony IT gig. On the other hand, this strikes me as totally within the realm of possibility for North Korea. They have the skills, they don't really give a shit about pissing off Sony or the FBI, and they have motive.
- wpietri 12y ago
  I think that's too narrow. You need one person with access to feel wronged, and you also need strong black-hat skills, but they don't have to be the same person. Hollywood is famous for screwing people over, so I doubt there is a deficiency in people with grudges. Suppose one of those people were willing to spend $50k on this? Suppose they had a friend or a second cousin with a connection to some people with skills and a taste for large-scale lulz?
  - berberous 12y ago
    These people literally threatened another 9/11, the FBI is involved, and the White House is apparently seriously considering responding in some manner. I think any regular black hat or American would rightly be pissing themselves and disappearing if this were just for the lulz or revenge. The risk is just too disproportionate to the 'gain.' Unless you are a nation state that already has no qualms about hacking others, and is immune from prosecution and knows that the U.S. is not going to go to war over this.
    - Nacraile 12y ago
      You're assuming basic rationality of people, which unfortunately isn't universally valid (I have the same intuitive tendency, which I've learned to be aware of and compensate for). Disgruntled (usually ex-) employees have been known to do some pretty insane, destructive things, without appropriate regard for personal consequences. What was the name of that guy who locked his ex-employer out of their infrastructure and caused a big rumpus a few years ago, again? More to the point - we know that there exist people who are capable of walking into their workplace with an assault rifle; the existence of a person inclined to execute the attack on Sony should not be surprising.
nether 12y ago
Just... stop. This is sounding close to Reddit's moonbattery over the Boston marathon bombing being an inside job.

by revscat 12y ago

personZ 12y ago

In fact, if anything, the following quote indicates an insider is just as likely to be the source The common narrative in discounting any involvement of North Korea is that they're too famished and uneducated to perform such an operation. Your angle is that the attack isn't sophisticated enough? The evolving story is that a single IT worker with significant right grants was targeted by the group, and once that single user was exploited, their privileges were used to compromise the network. If you have the privileges of a superuser, your attack doesn't need to be sophisticated. And ultimately this is exactly how I would expect these sort of attacks to go, especially when hitting targets in free and open nations. Why go through the trouble and effort of trying to winnow in from the outside when you can just exploit the kink or vulnerabilities of individual people -- who you can now discover via LinkedIn -- and then work your magic from the "inside". Sending out a group policy to disable all security software is a couple of lines. This "virus" seemed to be a simple efficiency measure, as with those rights they could do pretty much everything, though mass malice would probably be too labor intensive minus some helpful tools. The defense against this is of course that even admins should have limits on their access and flags on their activities. Of course, the admins are the ones who normally implement this, so...

Reebles 12y ago
Most people I've seen question the North Korea angle absolutely acknowledge that they have the capability to do things like this. They usually argue that this does not fit the style and MO of a state sponsored attack, that The Interview was never mentioned by the hackers until after the media starting running with the story, and that there simply isn't enough public evidence to justifiably attribute it yet, among other things.
- personZ 12y ago
  There is no MO regarding an attack from a country like North Korea. That country says bombastic things with regularity, and has seemingly little concern for blowback. How a country like Israel or the United States might do an attack like this has no relevance to what North Korea might do, whether directly or through a hired proxy. The Interview was never mentioned by the hackers until after the media starting running with the story North Korea threatened war over this movie - http://www.bbc.com/news/world-asia-28014069 http://www.bbc.com/news/world-asia-28014069 Now again, North Korea's words are kind of cheap, but they were talking about as big as you can get before this hack, and then specifically warned Sony to "obey" them. We have absolutely no idea what communications happened between the group and Sony and then law enforcement, so the whole what the media reported angle seems rather spurious. Sony/Law Enforcement, people who know more than us, seem to believe it was related to the movie.
  - eli 12y ago
    That's a fair point, but how many times a year does North Korea threaten war over something or other? A dozen?
  - revscat 12y ago
    There is no MO regarding an attack from a country like North Korea. Actually, there is. They tend to huff and puff about American military exercises that occur in cooperation with the Japanese or the South Koreans, or to complain to the UN about various things (e.g.: the CIA torturing people). But their MO, such as it is, is to complain and threaten, almost exclusively. Occasionally they will perform a missile test that causes concern, but those missiles land in the Sea of Japan or some other body of water, not anywhere that causes actual harm. No, this goes against the DPRK's MO up until now. If they are responsible then it is a shift in their tactics from "loud and threatening, but basically harmless to other nations", to "actively and publicly committing acts of economic espionage." That would be quite a departure for them.

berberous 12y ago

An insider strikes me as extremely unlikely. You would need to have someone that is normal and skilled enough to be hired at Sony (presumably in IT), but malicious or wronged enough to attempt to destroy the entire company, including wronging all of your co-workers and risking serious risk of prosecution from the U.S. government. Also, you would presumably be skilled enough to evade the FBI, but still somehow be stuck in some mid-tier Sony IT gig. On the other hand, this strikes me as totally within the realm of possibility for North Korea. They have the skills, they don't really give a shit about pissing off Sony or the FBI, and they have motive.

wpietri 12y ago
I think that's too narrow. You need one person with access to feel wronged, and you also need strong black-hat skills, but they don't have to be the same person. Hollywood is famous for screwing people over, so I doubt there is a deficiency in people with grudges. Suppose one of those people were willing to spend $50k on this? Suppose they had a friend or a second cousin with a connection to some people with skills and a taste for large-scale lulz?
- berberous 12y ago
  These people literally threatened another 9/11, the FBI is involved, and the White House is apparently seriously considering responding in some manner. I think any regular black hat or American would rightly be pissing themselves and disappearing if this were just for the lulz or revenge. The risk is just too disproportionate to the 'gain.' Unless you are a nation state that already has no qualms about hacking others, and is immune from prosecution and knows that the U.S. is not going to go to war over this.
  - Nacraile 12y ago
    You're assuming basic rationality of people, which unfortunately isn't universally valid (I have the same intuitive tendency, which I've learned to be aware of and compensate for). Disgruntled (usually ex-) employees have been known to do some pretty insane, destructive things, without appropriate regard for personal consequences. What was the name of that guy who locked his ex-employer out of their infrastructure and caused a big rumpus a few years ago, again? More to the point - we know that there exist people who are capable of walking into their workplace with an assault rifle; the existence of a person inclined to execute the attack on Sony should not be surprising.

nether 12y ago

Just... stop. This is sounding close to Reddit's moonbattery over the Boston marathon bombing being an inside job.