7 ms·
Analysis of some of the IP addresses in the Sony hack
- fpp 12y agoHave all of those IP addresses published as related to the hack been marked as dirty by Spamhaus e.a. before or after the hack - dates shown in the post are 20-Dec etc - after the hack was published.
- DangerousPie 12y agoThis is a very good point. It looks like all of these were only listed after they became public as part of the attack. So it's not like they were known bad IPs before. As an example, here is the Spamhaus entry for one of the IPs. Notice the references to articles about the Sony hack: http://www.spamhaus.org/sbl/query/SBL242808 http://www.spamhaus.org/sbl/query/SBL242808
- emcrazyone 12y agoEveryone seems too focused on source IP address which any solid IT person can tell you can be hijacked. Even the phone home IPs can be obfuscated but it seems awfully suspicious they all belong to net blocks going to NK if I'm understanding things.
- jamesbrownuhh 12y agoBut according to this, all the phone home addresses are generic open proxies that have been well publicised across the Internet and already abused for quite some time. None of the proxies listed appear to be in NK, and (to date) no evidence that NK IP addresses were on the other end of those proxies at the time. It's a bit like saying "the attackers used malware which made DNS queries via the IP address 8.8.8.8, which has been used by NK in the past" - if anyone were really building a case on that key evidence, they should prepare to be laughed at.
- emcrazyone 12y agoThanks @jamesbrownuhh where did you get that detail about the phone home proxies?
- NietTim 12y agoSo, so far we've seen 0 actual proof that NK is behind the Sony hack, big allegations from the US government, NK which wants to be included in the investigation and the US which doesn't want NK included in the investigation. I'm having this strange feeling of déjàvu....
- higherpurpose 12y agoNK isn't the most reliable entity, but it's at least strange that NK would go "come here and see if we did it", and US is like "Uh no, we already know you did it!" when its evidence doesn't look so solid.
- NietTim 12y agoExactly, and that is the reason why I don't trust the US. Why not be 100% transparent in the investigation? What is there to lose?
- hackerblues 12y agoI of course have no idea what the real answer is, but if you play out the hypothetical this is hardly a paradox. NK hacks Sony. US uses technique x to attribute the attack to NK. In the course of a shared investigation NK learns what technique x is. NK changes their future operations to counter technique x. The US loses the ability to use technique x to attribute attacks.
- deleted 12y ago[deleted]
- brazzy 12y agoAllowed? By whom?
- pdabbadabba 12y agoIt's not that they're not allowed to use the technique. We just wouldn't want to help them do it.
- scardine 12y agoMy lame cartoon about this affair: https://github.com/scardine/random-writings/blob/master/text3452.png https://github.com/scardine/random-writings/blob/master/text...
- thret 12y agoI have many fond memories of the BOFH.
- darkhorn 12y agoThe USA is very corrupt. Operation Northwoods, 9/11, this.
- ikt 12y ago"Kennedy personally rejected the Northwoods proposal" So you've got: 1) something that was proposed but never happened 2) Al-Qaeda attacking the US 3) this ? How you made a leap from terrorists attacked the US therefore the US is very corrupt I have no idea, complete non-sequitur.
- nkozyra 12y agoA non-sequitur for sure, but the volume of - often declassified - such acts from the U.S. government often makes it hard to dismiss conspiracies out of hand. Operation Northwoods is often cited because of how impossibly evil it is - that it was dismissed by the president should be noteworthy less for its dismissal and more for the fact that it made it to the president's desk. There are obviously others, like the Tuskegee syphilis experiment, for example, that demonstrate that large agencies sometimes work outside the boundaries of logical, empathetic human response.
- Guthur 12y agoI will not comment on the latter 2, but operation Northwoods is a reasonably scary precedent. The important fact is not that Kennedy rejected the proposal but rather that it made it through the higher levels of command at all. What happens when the US has a president that is not so adverse to carrying out false flag attacks on it's own and other neutral actor's citizens.
- throwaway751822 12y agoMany people around the world believe 9/11 was an inside job, and even that Al-Quaeda, as an organization, was essentially manufactured through the CIA through its control of the American media, as a false-flag pretense for war. Presumably, the Sony hack is the beginning of another such false-flag pretense. North Korea is part of the "Axis of Evil," which is essentially nothing more than the US' own kill list for sovereign nations it doesn't like. One must assume that some sort of war with Iran and North Korea are inevitable, so long as the US has the power to do so. It's only a non-sequitur if you don't believe the CIA has orchestrated, either directly or indirectly, most major political events around the world in the last 20 years, and nearly every, if not every, war since Desert Storm. Otherwise, the connections are obvious, especially after Snowden.
- 0942v8653 12y agoI really do hope that the FBI's "secret" evidence was quite a bit more substantial than this. I'd like to know what it was—it's really irrational to accuse someone, especially the North Korean government, and with no one to verify their claim, the FBI does not seem smart. Of course they may have no secret evidence at all and are making this up which is much, much, worse.
- LunaSea 12y agoApparently they have weapons of mass destruction too. /s
- thret 12y agoWell, yes, they do: http://en.wikipedia.org/wiki/North_Korea_and_weapons_of_mass_destruction http://en.wikipedia.org/wiki/North_Korea_and_weapons_of_mass...
- fpp 12y agosaid the Kuwaiti nurse https://www.youtube.com/watch?v=LmfVs3WaE9Y https://www.youtube.com/watch?v=LmfVs3WaE9Y
- brazzy 12y agoUm, nope. https://www.youtube.com/watch?v=vC4m6BB2gZ4 https://www.youtube.com/watch?v=vC4m6BB2gZ4
- classicsnoot 12y agoImplying no agreement or dissent, can you give another source besides RT? This station is dubious at best...
- mikeyouse 12y agoIt's pretty well known that NK is testing nuclear weapons: http://en.wikipedia.org/wiki/2013_North_Korean_nuclear_test http://en.wikipedia.org/wiki/2013_North_Korean_nuclear_test (Unless I misunderstood your question)
- nhebb 12y ago> For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack. The biggest surprise was the IP address traced to NY. Why wouldn't the FBI seize this system?
- mox1 12y agoIf some unwitting 3rd party was hacked and used in a crime, you can't just go over to their house or business and "seize" their property. When the criminals on cops run through your back yard, do the cops turn the inside of your house into a crime zone? Obviously, no. Even if the bad guy runs inside your garage, they are not confiscating your car, lawn mower, etc. Contrary to popular belief on HN here, police / FBI don't just seize everything whenever they want. It requires warrants and probable cause. Good luck getting a judge to sign a warrant to seize a victims computer...not going to happen.
- palmer_eldritch 12y agoAn IP address associated with a cyber attack, is more like someone stealing your car and using it to hit a bank than someone running through your backyard to escape the cops. And if someone went through your backyard or your garage while trying to escape from the police, the cops might want to look in your backyard or garage to see if the 2 Kg of heroin he was supposed to carry or the gun he used to shoot at them while fleeing didn't end up there.
- kbart 12y agoOh, really? Tell that to Microsoft. /s
- Coincoin 12y agoMaybe they already did and are using it as a honey pot. Maybe that's part of their secret evidence.
- junto 12y agoI seem to remember rumours of huge put options placed against airlines shortly before 9/11. The FBI should be looking at similar events for Sony. Greed is always something that you can count on.
- MichaelRender 12y agoHere are Sony's options on Nov 3, 2014 Open Interest for Puts is in Magenta Note that the $17 Strike for January has an Open Interest of 17.6K http://i.imgur.com/OmglyLl.png http://i.imgur.com/OmglyLl.png Here are Sony's Options on Nov 25, 2014, the day after the hack. Note the same $17 put has actually lost a little Open Interest. No conspiracy here. http://i.imgur.com/dCRcvX9.png http://i.imgur.com/dCRcvX9.png Caveats: This was done with the US traded instrument (SNE). I don't have access to the Japanese exchange. Open Interest is reported after the day it is generated and reflects the secondary market of the previous day.
- mikeyouse 12y agoThose rumors were all BS.. http://www.snopes.com/rumors/putcall.asp http://www.snopes.com/rumors/putcall.asp Tl;dr -- A US institutional investor bought 95% of the suspect puts at the same time they bought 115,000 shares in a very standard hedging strategy.
- mootothemax 12y agoSee now all of these IP’s could be used by just about anyone Doesn't that indicate that they're perfect for (ab)use by anyone, since they're not linked directly to a single entity? I don't see why it's outside the realms of possibility that e.g. North Korea always uses the same pool of "dirty" servers to launch their attacks.
- clockworkelf 12y agoSo NOBODY here believes that FBI statements can be politically motivated? “You cannot wake up someone who is only pretending to be asleep” -- Navajo Proverb
- pdabbadabba 12y agoThe analysis is interesting, but I don't understand how it undermines the FBI's claims. He looks at each IP and exclaims, "This could have been used by anyone!" But we already knew that, didn't we? The claim is not that these IPs are used exclusively by North Korea. The claim is that there is a suspicious overlap between the IPs used in this attack, and others used by North Korea in the past. If these were the only bad actor/compromised IPs out there, then maybe this would not be so surprising. But there are many many of them, so it would be coincidental, to say the least, if this attack and prior North Korean attacks just happened to use the same IPs, if North Korea is not involved (or, another possible explanation, if the same tool is not involved as in prior attacks by North Korea).
- jamesbrownuhh 12y agoThe nature of the Internet is that many resources will be used globally. It should not be surprising that a few well-known open proxies would be used by bad actors of any nationality - the fact that (Nation State X) was accused of using (globally accessible resource Y) in the past does not in any way mean that resource Y is used ONLY by State X, so the use of resource Y is quite, quite unsuitable as a means of identifying anyone.
- pdabbadabba 12y agoI think what we would need to know, in order to determine the strength of this evidence, is how many total IPs North Korea is known to have used in previous attacks, and how many total were used in this one. I.e., how closely correlated is prior NK use with an IPs use in this case. If only a handful were used on both occasions, and the overlap is significant, then we have some fairly interesting evidence. But if, on one of more occasions NK used hundreds of IPs, and there are a handful in common between those two sets, then there's really nothing to see. I've had the impression it was the former, but perhaps I'm mistaken. Does anyone have an answer?
- qyv 12y agoIt is even more than that, the FBI PR quote that this is based on is the following: "For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack." Firstly, this isn't a statement of evidence, it is an generalized example of the type of evidence the FBI apparently has. Given the lack of any further clarifications on this statement, I don't see how you can make and presumptions as to what the actual evidence is. there just is not enough data here. Secondly, the statement is carefully worded to say that the C&C IP's have communicated with known NK infrastructure. This is massively different than saying that the C&C IP's are associated with NK infrastructure. What the FBI is saying is that they have been able to apparently collect evidence that shows NK was communicating with the C&C IP's, presumably while the attacks were going on. With what we know about the state of internet surveillance, is it really that unrealistic to think that US SIGINT is collecting every single packet that transits known KN networks? Seems right in their wheelhouse. Point is, the FBI aint telling us squat about what evidence they may or may not really have. Maybe this is because they are making the whole thing up, or maybe it is because they just don't want to tell us how much evidence they got, and how they got it.
- jamesbrownuhh 12y agoWhat's the betting that the FBI's "similarities in specific lines of code" is similarly weak and so generic as to be rather less than the smoking gun that they seem to think it is?
- ck2 12y agoIf it really was North Korea, wouldn't they need a shedload of help from China? I mean it is inexpensive to develop an exploit hacking team but they would need training and the only two obvious sources would be China and South Korea and I cannot imagine south korea doing it willingly. This all reminds me of how in 1993 that TV show seaquest was predicting countries assassinating other "elite hacking teams" - seemed crazy then.
- classicsnoot 12y agoI am fairly certain this will raise the ire of many people, but as i am stuck watching TV news [1/10 do not recommend] i feel it must be discussed. The discussion in the mainstream appears to have moved past the 'if/maybe' stage and plowed directly into the 'wail/punish' stage. I am growing slowly yet certainly more livid as i a watch a lawyer for Sony laud the FBI's technical acuity as he states declaratively that this is a de facto assault on the US Gov't., the Economy, and the American way of life. I thought Sony was a Nipponese Corporation. I thought private property was the responsibility of the party that owns it. I am not trying to sound like a Truther loud mouth, but tis whole thing just screams False Flag. The way the US Govt is acting, you would think the power grid had been seriously compromised. Who, specifically has been harmed by this intrusion, and to what extent were they harmed?
- hnnewguy 12y ago>but tis whole thing just screams False Flag When you're a hammer, everything looks like a nail. Sony is trying to blame others for their security incompetence. The US is posturing with "We don't tolerate this." Nobody really cares and nobody is going to war because Sony had their emails and some media stolen.
- yourad_io 12y agoI agree with all the points regarding the evidence-less-ness of the IPs used, and I'd even take it further than that. From the article: > Like I said on Twitter last night, I can see my way to saying that DPRK was behind this. I can use Occams Razor to apply the logic of who had motive, look at their actions on the face of it, and say “most likely” it is them. I don't know if my brain is stuck on some self-reinforcing loop with this, and feel free to call me Mr. Pedantic here, but I don't think Occam's Razor can take you that far. The simplest-explanation buck stops at "someone who really wanted to hurt Sony"[1]. Given that tons of groups would have axes to grind with Sony (anti-piracy, losing customer data regularly, general "Golliath" image & behaviour), you'd need to have a reason why the simplest choice is NK in particular. I may have missed something, but I just don't see it. * Would you have needed super-l33t 0-day APT ninja bullfrogs (that only a state actor could have afforded?) No, the reports make it seem that Sony's networks were (still!) much akin to a merry-go-round[2]. So, from a "capabilities" perspective, I don't see a state actor as a more obvious choice than a disgruntled ex-sysadmin + his friends. * Would NK have any motive to deny involvement? By my read of their past PR patterns, they'd own it loud and clear ("we own you with nuclear, we own you with cyber! fear us, fear us"). [1] Could still be someone counting on one of the side-effects of this FUD shitstorm. That's what our favourite razor "rejects". [2] "But it is moving! Nobody will be able to get on or off while it is moving. It have perfect securities."
- overgard 12y agoI can see that there would be other groups that don't like Sony, and would be interested in hacking them, but why would any of them (other than NK) target "The Interview" in particular? Maybe that was a smoke screen, but that seems elaborate. Unless you're Kim Jong-un, the subject matter is pretty tame. (IE: not likely to rile up other domestic groups of crazy). I agree the evidence is weak, though. Probably not smart of the US government to publicly point fingers at this stage.
- makomk 12y agoFrom what I recall, the hackers first claimed to be going after The Interview well after Sony and most of the press announced it as a possible motive.