3 ms·

I work as a security analyst (though not a threat researcher for any major firm or anything like that), and I agree with this completely. Starting on day 1, whe

I work as a security analyst (though not a threat researcher for any major firm or anything like that), and I agree with this completely. Starting on day 1, when possible links to NK were mentioned in the media, all of my coworkers dismissed it and I had to convince them that NK's involvement was definitely feasible. Even if one assumes that the vast majority of their whole cyberwarfare division is unskilled and incompetent, which could very well be true, you only need a core group of 5-10 good people to pull off attacks like these. It's also possible the people they're working with aren't of NK nationality or aren't living there.

AlyssaRowan 12y ago
Thanks, drewcrawford, meowface, for an interesting alternative perspective; I'm not particularly familiar with DPRK as a country. It is feasible that they could be involved in some way - some of the rhetoric sounds plausibly bizarre enough, but I just don't see much - if any - technical evidence that they actually are. I think you may be highballing a budget estimate on this particular attack. 5-10 good people could likely pull off something like this at a larger company with relatively competent security, but I reckon this could have been done by one or two moderately unskilled hackers over several months - Sony Pictures' security was just that awful, and the malware's style is remarkably amateurish - it isn't even packed, for heaven's sake. Here you'll find no 0days, no factored signing keys, no memory-resident non-persistent "CRIT" agents - compare and contrast it with, say, the so-called "DarkHotel" malware (very probably from the Republic of Korea) and it's just night and day. Literally anyone can afford that kind of budget: impoverished (or otherwise) nation-state; disgruntled employee; random hacker; or any combination thereof. I'd say many readers of this comment could feasibly have done it themselves, if they'd felt so inclined. If you find that a bit concerning, so do I, because (as I'm sure you're well aware) Sony Pictures is far from the only company in the world with dreadful security practices, and they just make movies. Imagine if it was something actually important.

AlyssaRowan 12y ago

Thanks, drewcrawford, meowface, for an interesting alternative perspective; I'm not particularly familiar with DPRK as a country. It is feasible that they could be involved in some way - some of the rhetoric sounds plausibly bizarre enough, but I just don't see much - if any - technical evidence that they actually are. I think you may be highballing a budget estimate on this particular attack. 5-10 good people could likely pull off something like this at a larger company with relatively competent security, but I reckon this could have been done by one or two moderately unskilled hackers over several months - Sony Pictures' security was just that awful, and the malware's style is remarkably amateurish - it isn't even packed, for heaven's sake. Here you'll find no 0days, no factored signing keys, no memory-resident non-persistent "CRIT" agents - compare and contrast it with, say, the so-called "DarkHotel" malware (very probably from the Republic of Korea) and it's just night and day. Literally anyone can afford that kind of budget: impoverished (or otherwise) nation-state; disgruntled employee; random hacker; or any combination thereof. I'd say many readers of this comment could feasibly have done it themselves, if they'd felt so inclined. If you find that a bit concerning, so do I, because (as I'm sure you're well aware) Sony Pictures is far from the only company in the world with dreadful security practices, and they just make movies. Imagine if it was something actually important.