3 ms·

> It is this piece of evidence—freely available to anyone with an enquiring mind and a modicum of cyber security experience—which I believe that the FBI is so c

by azakai 12y ago

> It is this piece of evidence—freely available to anyone with an enquiring mind and a modicum of cyber security experience—which I believe that the FBI is so cryptically referring to when they talk about “additional evidence” they can’t reveal without compromising “national security”. The evidence mentioned here are the addresses of the Command and Control servers. But the author does not give any reason for why he or she thinks this is the thing the FBI is being cryptic about? First of all, there might be several things to be cryptic about. Second, the article gives nothing that I can see to connect that bit of information to being something that FBI would hold back on. Third, the author just revealed it, so if it were what the FBI was keeping secret, that seems silly. Did I miss something?

jhou2 12y ago
I believe it's implied that the FBI can trace past the proxy servers (not much of a stretch). Naturally, the FBI does not want to give up information on how it does that to avoid cybercriminals counteracting that method of tracing. Just a guess.
- azakai 12y ago
  Interesting. If so, then the FBI does have information the author lacks, and that information does sound like something which could help pinpoint the culprits.
- peterwwillis 12y ago
  The FBI doesn't have any special ability to trace connections, especially not outside the US. The NSA might, but it's questionable that they would tip their hand and release classified covert intel just because one company got hacked. China has been hacking our corporations for over a decade but you never hear this much about it in the press. Edit: then again, China doesn't threaten to bomb our theaters. Could be NK just goofed. But the whole thing is too ridiculous to be plausible.
  - uxp 12y ago
    > But the whole thing is too ridiculous to be plausible. This is my take as well. State sponsored attacks, or at least the attacks that have allegedly been state sponsored up until now, have been quiet little things that go on for months or years so far under the radar that they only get revealed months afterwards by accident. They aren't filled with green-on-black text and pixelated skeleton images. Something just doesn't feel right about blaming North Korea for this. Maybe it came from the DPRK, but if so it had about as much to do with them as 9/11 did with the Saudis. Does anyone also feel that the media is the only one that really linked the DPRK to this? I don't recall hearing about North Korea until after the "whodunnit" questions started coming out and speculation between the DPRK's denouncement months ago about The Interview and the very weak correlation between Chinese IPs being frequently involved in attacks and the DPRK's relationship with China, and the recycled malware that has some loose ties to Korea were thrown in a pot and mixed together. Once that started rolling, it seemed that the hackers started playing the Korean card, more for lulz than anything tangible. And now, long after the media has shifted from Poor Sony to Damned Korea (with even the President stepping in with his opinions), we're really heard very little from the attackers. It honestly feels like a bunch of guys in a basement collectively said to themselves "Oh shit, the President of the United States is talking about shit I did, time to cool off". From what I've read about the abysmal security at SPE, it wouldn't be surprising in the least that it didn't take a state sponsored group to do as much damage as they did. Blaming the DPRK only helps Sony sound less like a failure. The only facts I can be sure of is that Sony did everything wrong in response. Every CIO should learn from this as what _not_ to do when hacked.
s54b32dd 12y ago
>The evidence mentioned here are the addresses of the Command and Control servers. But the author does not give any reason for why he or she thinks this is the thing the FBI is being cryptic about? The fbi and several other sources publicized the select portion of the code base that linked the ips to shamoon. Presumably, the piece the fbi is being cryptic about is the servers behind the proxy, which, as mentioned, it probably isn't too much of a stretch to guess the government might be able to trace.

by azakai 12y ago

jhou2 12y ago

I believe it's implied that the FBI can trace past the proxy servers (not much of a stretch). Naturally, the FBI does not want to give up information on how it does that to avoid cybercriminals counteracting that method of tracing. Just a guess.

azakai 12y ago
Interesting. If so, then the FBI does have information the author lacks, and that information does sound like something which could help pinpoint the culprits.
peterwwillis 12y ago
The FBI doesn't have any special ability to trace connections, especially not outside the US. The NSA might, but it's questionable that they would tip their hand and release classified covert intel just because one company got hacked. China has been hacking our corporations for over a decade but you never hear this much about it in the press. Edit: then again, China doesn't threaten to bomb our theaters. Could be NK just goofed. But the whole thing is too ridiculous to be plausible.
- uxp 12y ago
  > But the whole thing is too ridiculous to be plausible. This is my take as well. State sponsored attacks, or at least the attacks that have allegedly been state sponsored up until now, have been quiet little things that go on for months or years so far under the radar that they only get revealed months afterwards by accident. They aren't filled with green-on-black text and pixelated skeleton images. Something just doesn't feel right about blaming North Korea for this. Maybe it came from the DPRK, but if so it had about as much to do with them as 9/11 did with the Saudis. Does anyone also feel that the media is the only one that really linked the DPRK to this? I don't recall hearing about North Korea until after the "whodunnit" questions started coming out and speculation between the DPRK's denouncement months ago about The Interview and the very weak correlation between Chinese IPs being frequently involved in attacks and the DPRK's relationship with China, and the recycled malware that has some loose ties to Korea were thrown in a pot and mixed together. Once that started rolling, it seemed that the hackers started playing the Korean card, more for lulz than anything tangible. And now, long after the media has shifted from Poor Sony to Damned Korea (with even the President stepping in with his opinions), we're really heard very little from the attackers. It honestly feels like a bunch of guys in a basement collectively said to themselves "Oh shit, the President of the United States is talking about shit I did, time to cool off". From what I've read about the abysmal security at SPE, it wouldn't be surprising in the least that it didn't take a state sponsored group to do as much damage as they did. Blaming the DPRK only helps Sony sound less like a failure. The only facts I can be sure of is that Sony did everything wrong in response. Every CIO should learn from this as what _not_ to do when hacked.

s54b32dd 12y ago

>The evidence mentioned here are the addresses of the Command and Control servers. But the author does not give any reason for why he or she thinks this is the thing the FBI is being cryptic about? The fbi and several other sources publicized the select portion of the code base that linked the ips to shamoon. Presumably, the piece the fbi is being cryptic about is the servers behind the proxy, which, as mentioned, it probably isn't too much of a stretch to guess the government might be able to trace.