4 ms·

The FBI and NSA are two very different entities. The investigation goes to the FBI because it is essentially an "in the USA crime". While FBI and NSA may both b

by rilita 12y ago

The FBI and NSA are two very different entities. The investigation goes to the FBI because it is essentially an "in the USA crime". While FBI and NSA may both be looking into it, they don't share all of their data. Also, from my experience, the FBI is quite incompetent. The 'evidence' so far is, as others are pointing out, that people in NK wrote similar malware and some of the components used. Trend Micro says that the malware used is available on the black market. This points to my previous conclusion that this is being paid for. Whether NK government is involved in funding this particular hack is the real question. I don't think NK has direct control over the hackers at this time, because as others have pointed out, it is not in NK best interest for this to continue. It is easy to pin the blame on NK, and I think that is exactly what the hackers want to happen. Personally I think Sony simply pissed off too many people and this is the inevitable result.

at-fates-hands 12y ago
>>> While FBI and NSA may both be looking into it, they don't share all of their data. The irony of this statement is this is one of the primary reasons the department of homeland security was established, so sharing of information between these very offices would enable them to be more on top of stuff like this.
- dragonwriter 12y ago
  > The irony of this statement is this is one of the primary reasons the department of homeland security was established, so sharing of information between these very offices would enable them to be more on top of stuff like this. No, it wasn't. Which is evidenced by the fact that neither of these entities were among those moved from other Departments into the new Department of Homeland Security. Improved information sharing among the parts of the intelligence community that were not consolidated into the DHS is the reason that various changes in the laws governing information sharing in the IC were changed, and that the office of the Director of National Intelligence was created to separate the head of the IC from the Director of a particular agency (the CIA) in that community.
pdabbadabba 12y ago
> The 'evidence' so far is, as others are pointing out, that people in NK wrote similar malware and some of the components used. I had written a lengthy post pointing out the many pieces of evidence you're ignoring, but I think the FBI release does the job just as well. I find the infrastructure evidence as interesting, if not more interesting than the similar code: > Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks. > The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack. >Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea. This also does not mention that some of the code was compiled on a machine configured with Korean language settings. This doesn't establish definitively that North Korea was behind this, but it is consistent with that conclusion. There is also classified evidence. You may choose to ignore it, but I find the claim deserving of some (though not decisive) weight, and certainly worthy of mention.
- rilita 12y ago
  Sure there are things pointing to NK; but I believe this is intentional. Using an IP in NK, or one "associated with NK actors" doesn't prove it is NK. Consider all the discussion for piracy. IP doesn't prove anything. I don't think the action was directed clearly by high level NK officials. Consider; what if the hackers had said "We are NK, war on USA" from the very start. Would that change anything? Nope. Just because something appears to be something doesn't mean it is. Also; why is the evidence classified? The public already has the leaked data in immense amounts... many groups already have the malware itself that was used... How about they actually show the evidence instead of just pointing fingers. Anyone can go "yeah it's NK; they do this sort of thing".
- basch 12y ago

by rilita 12y ago

at-fates-hands 12y ago

>>> While FBI and NSA may both be looking into it, they don't share all of their data. The irony of this statement is this is one of the primary reasons the department of homeland security was established, so sharing of information between these very offices would enable them to be more on top of stuff like this.

dragonwriter 12y ago
> The irony of this statement is this is one of the primary reasons the department of homeland security was established, so sharing of information between these very offices would enable them to be more on top of stuff like this. No, it wasn't. Which is evidenced by the fact that neither of these entities were among those moved from other Departments into the new Department of Homeland Security. Improved information sharing among the parts of the intelligence community that were not consolidated into the DHS is the reason that various changes in the laws governing information sharing in the IC were changed, and that the office of the Director of National Intelligence was created to separate the head of the IC from the Director of a particular agency (the CIA) in that community.

pdabbadabba 12y ago

> The 'evidence' so far is, as others are pointing out, that people in NK wrote similar malware and some of the components used. I had written a lengthy post pointing out the many pieces of evidence you're ignoring, but I think the FBI release does the job just as well. I find the infrastructure evidence as interesting, if not more interesting than the similar code: > Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks. > The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack. >Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea. This also does not mention that some of the code was compiled on a machine configured with Korean language settings. This doesn't establish definitively that North Korea was behind this, but it is consistent with that conclusion. There is also classified evidence. You may choose to ignore it, but I find the claim deserving of some (though not decisive) weight, and certainly worthy of mention.

rilita 12y ago
Sure there are things pointing to NK; but I believe this is intentional. Using an IP in NK, or one "associated with NK actors" doesn't prove it is NK. Consider all the discussion for piracy. IP doesn't prove anything. I don't think the action was directed clearly by high level NK officials. Consider; what if the hackers had said "We are NK, war on USA" from the very start. Would that change anything? Nope. Just because something appears to be something doesn't mean it is. Also; why is the evidence classified? The public already has the leaked data in immense amounts... many groups already have the malware itself that was used... How about they actually show the evidence instead of just pointing fingers. Anyone can go "yeah it's NK; they do this sort of thing".
basch 12y ago