6 ms·

FBI Director: Sony’s ‘Sloppy’ North Korean Hackers Revealed Their IP Addresses

73 points by headcanon 12y ago

ddod 12y ago
Could someone explain how they would know that the IP "used exclusively" by NK wasn't a proxied IP but in fact the "real" source IP? Personally, I think just mentioning that part of the evidence came from the Behavioral Analysis Unit proves that NK's ties to this are definitely shaky.
- Alupis 12y ago
  Not to mention it's also easy to spoof your IP address if you are traversing out of a DC or node that does not do egress filtering (meaning you don't even have to proxy through the proper IP/country... you just make it up). Shaky evidence? You bet ya. (and it seems this is the only evidence offered as an explanation so far) Also, if N. Korea really was behind this "attack" of a private company with no US Gov't ties, why would they not claim responsibility and tout their "Cyber Attack" skills? They do for just about everything else (even failed missile launch attempts). Fear of retribution? No way, this is/was a private company... the US Gov't could not respond with any kinetic weaponry attack and look good on a geopolitical scale. N. Korea also offered to send personnel to help the FBI in the attack investigation, which is extremely uncharacteristic of N. Korea to say the least... normally they'd just praise the attack flatout.
  - happyscrappy 12y ago
    It is quite interesting how so many are hoping against hope that it was not North Korea. I don't really see why they are emotionally attached.
    - Alupis 12y ago
      There's no emotions involved -- just like there's no evidence involved. It's flat out wrong to blame some small and non-credible-threat country for something they likely had nothing to do with just to advance a political agenda. North Korea is not a great country... but that doesn't mean a "global leader" like the USA can just pin something on them with zero evidence.
      - davidw 12y ago
        Non-credible-threat? North Korea? I'm not a fan of the US' foreign policy in some ways, and certainly place no blind faith in the declarations of the government, but, that doesn't exactly make North Korea the 'good guys'... http://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?NewsID=14255&LangID=E http://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?Ne... http://en.wikipedia.org/wiki/North_Korea_and_weapons_of_mass_destruction http://en.wikipedia.org/wiki/North_Korea_and_weapons_of_mass...
        Alupis 12y ago
        > Non-credible-threat? North Korea? Their nuclear program claims it has a range of 4,000KM, but to reach the USA it would take about 10,000KM. Not to mention their last missile launch test could not even escape their border. That's what I mean when I say non-credible threat; they are incapable of inflicting meaningful harm to the USA. They are really all bark and no bite... > oesn't exactly make North Korea the 'good guys'. Of course not. Nobody said they are -- they just simply aren't the "bad guys" we are looking for in this specific case.
        davidw 12y ago
        > they just simply aren't the "bad guys" we are looking for in this specific case. You seem to be awfully certain. Frankly, I have no idea and am quite skeptical of people who profess such certainty in the face of so few facts. Seems to be the kind of thinking where you have a conclusion and look around for facts to support it.
        Alupis 12y ago
        > You seem to be awfully certain Perhaps I overspoke a tad. I'm awfully skeptical is better put. We're largely a scientific community here at HN. Something is False until proven True. You may have a hypothesis, but it's just that, an educated guess as-to the result. To prove something True you must present overwhelming evidence. We have none of that here... What we do have is a hypothesis being perpetuated as fact in the face of almost zero concrete evidence. The FBI first says "there is zero evidence to suggest North Korea has anything to do with the hack". Then some "high level anonymous White House official" "leaks" to the NY Times that they believe it's North Korea, and it takes the FBI 3 full days to change their public announcement, yet present zero concrete evidence. This was a rudimentary hack against a private company, there's nothing that would be classified or kept top secret here. Sony should do a full disclosure. Until then, we can not be certain of anything.
    - mijoharas 12y ago
      I wouldn't say it is being emotionally attached to be sceptical of something that is presented without solid evidence.
  - billions 12y ago
    Fully agree with your technical AND political analysis. I commented along the same lines when the attacks were first announced and got downvoted. When a way of thinking is too far ahead of the crowd, the HN algorithm fails.
  - neilwillgettoit 12y ago
    It could be as simple as they saw a bunch of UDP traffic with a spoofed src that was a dprk ip block.
  - rgbrenner 12y ago
    N. Korea also offered to send personnel to help the FBI in the attack investigation, which is extremely uncharacteristic of N. Korea to say the least They offered to help investigate the Cheonan after they sunk it. So it's really not uncharacteristic. And why do you have attack in quotes? Do you believe Sony wasn't actually attacked?
    - Alupis 12y ago
      > And why do you have attack in quotes? Do you believe Sony wasn't actually attacked? No, I think it's plenty clear that they were. It's just that "attack" has a certain stigma to it, and what happened to Sony was not some grand attack, but rather a run-of-the-mill hack against a company with extremely poor security.
  - irq 12y ago
    It is _not_ easy, or even possible, to "make up" an IP address that works for receiving data across the public Internet. The responses to packets you send from such an address will not come back to you. This doesn't thwart all attacks (DNS query amplification, general flooding, etc), but their hack involved transmitting AND receiving data (ssh, http, etc). What is _easy_, however, is determining which country is using a given IP address. Particularly when the searching party is a superpower and the country they're investigating is known for having very few links to the Internet. And what connections they do have are severely restricted. I imagine it would be very difficult to find a reliable, exploitable proxy server inside North Korea that is accessible across the public Internet.
    - emn13 12y ago
      You may not need the responses to come to you, particularly if (as is suggested) this is a tiny minority of traffic. Sending something to some /dev/null address in NK? Why not?
- drzaiusapelord 12y ago
  Funny, when the IP addresses weren't NKorea, as earlier highly voted HN articles have told us, it was proof that it wasn't NKorea. Now that they do, its somehow further proof that it wasn't N Korea. I understand knee-jerk anti-US comments are karma gold here, but I don't think you guys realize how ridiculous you sound to the rest of us. I think its pretty difficult to arm-chair analyze this stuff and come out with a definitive answer, especially considering a lot of this stuff will never be declassified, but the Alex Jones-like conspiracy thinking here really brings the discourse down to a reddit-like level. Purely from an Occam's razor perspective, the country that attacked this film and warned of consequences if released-- consequences that actually happened, is probably at fault here. This analysis of how it must have been anyone but NKorea, especially considering NKorea's reputation, is highly questionable to the unbiased observer.
  - davidw 12y ago
    > the Alex Jones-like conspiracy thinking here really brings the discourse down to a reddit-like level. That's where political discussions inevitably and invariably end up. Probably best to just flag these articles.
  - indlebe 12y ago
    I would disagree on your point that "knee-jerk anti-US comments are karma gold here" on 2 notes, 1 that being anti-US-administration is not being anti-US, and 2 that most unsubstantiated comments that are critical of government actions almost always get down voted to oblivion. Everyone knew that North Korea had it out for Sony, what's to stop a network security enthusiast from stirring the pot by performing the attack and planting "evidence" that it was coming from North Korea. I don't think it's far fetched to think that many young security enthusiasts would get excited to think about causing such a stir.
  - deleted 12y ago
    [deleted]
  - siegecraft 12y ago
    Who is saying this is proof that it wasn't NKorea? Straw man. People on HN are just more likely to believe Schneier or other respectable security people, and not government agencies who by their very nature are going to have their own agenda and not be 100% honest. As far as consequences that actually happened -- Do you mean to say that theaters that showed the film were bombed? Or are you referring to embarassing email leaks which would have no doubt been released anyway?
- philip1209 12y ago
  If somebody were to want to frame the North Koreans, what would stop a motivated attacker (perhaps a nationstate) from just abusing BGP to spoof source IPs? How hard would that be to detect, particularly if you controlled direct peers?
  - SwellJoe 12y ago
    As I understand it, China would be able to do so easily and convincingly, since most (all?) of NK's traffic passes through China. That may even be a good theory. China might not want to directly attack US industry in this way, but might "assist" North Korea in doing so.
    - dpeck 12y ago
      all, or at least all that anyone knows about. NK has a single path/peer.
  - mox1 12y ago
    IF someone "route flapped" the entire North Korean IP space for any amount of time, one of the 10+ organizations who monitor BGP would have noticed and commented on that already....... If Russia et al had the ability to covertly do that...why attack Sony....why not big financial institutions or other such high profile targets....
    - emn13 12y ago
      No need to route flap if the route's already going through you.
- roywiggins 12y ago
  If the NSA has taps sitting on all the routers that are a hop away from NK, they can probably nail it down just from timing, right? If the packets were being proxied through an NK IP, I would think it would be easy to tell the difference (if you're the NSA, anyway).
  - Alupis 12y ago
    Would be a hugely missed opportunity for the NSA to tout their currently controversial programs if true.
- deleted 12y ago
  [deleted]
- rilita 12y ago
  Timing correlation. If you are monitoring traffic in/out of NK, you can correlate traffic by similar sequence of sized packets going into one IP and then coming out of another. This is the "secret sauce" that the FBI says they cannot tell anyone imo. Doing this is nothing new and I am sure they've been doing it for ages though. The problem is that if you assume the FBI is doing this ( which any skilled hacker would assume ) then you can easily get around it by sending a sequence of instructions ahead of time, and then having them playback at what seems like a reasonable rate at a later time. ( making it seems as if you are on site and didn't set it up ahead of time )
kjs3 12y ago
"Terrorist attack" straw-man used to justify attacking an unrelated state target we happen not to like. Government officials appearing on complacent media outlets to beat the drums and persuade the populace that "they have conclusive evidence" and "retaliation is required to protect the country". This ended so well last time we did it.
- wyager 12y ago
  Yes, it's funny how it's a "terrorist attack" when a country we don't like does the same things we do. The most prominent recent example of the US (and Israel) carrying out an attack like this is Stuxnet.
  - mason240 12y ago
    One targeted a civilian organization, the other targeted a government installation (one could even make the case it was a military target). It's not hard to understand why some people would give one a "terrorist" label but not the other.
    - deleted 12y ago
      [deleted]
    - mobiplayer 12y ago
      One inflicted economic damage to a private company, but Stuxnet put several lives at risk. Saying the former is a terrorist attack means that the attacks to Target et al were terrorist attacks, too.
    - xnull1guest 12y ago
      Haven't private corporations been hacked by the US also (Brazilian PETROBRAS)? https://firstlook.org/theintercept/2014/09/05/us-governments-plans-use-economic-espionage-benefit-american-corporations/ https://firstlook.org/theintercept/2014/09/05/us-governments... Given the first Geneva article placing private targets within international convention if they are of military interest (including media and broadcast services), and SONY's cooperation with the State Department in producing "The Interview", might SONY then qualify under international law? http://en.wikipedia.org/wiki/Legitimate_military_target http://en.wikipedia.org/wiki/Legitimate_military_target
stealthlogic 12y ago
The FBI is full of crap.
nick2021 12y ago
I thought we determined that it was an inside job and not North Korea at all? And that the FBI was lying about everything.
Zigurd 12y ago
Well that would make it a slam dunk.
SwellJoe 12y ago
I want to believe. But, there's such a history of deceit from our government, when there is a political motivation. I honestly don't understand why they'd be lying in this case...but, well, Iraq and years of torture at Guantanamo didn't really make sense to me, either. I don't think there is anyone gunning for war with North Korea (well, Northrup Grumman and Halliburton probably are, but I don't believe our state is entirely owned by the defense industry anymore, as it was during the Bush years). So, what's the motivation, if the FBI is misleading people? The thing is, I'm entirely willing to believe North Korea would like to have this kind of capability, and if they do have this kind of capability (which they might), I'm entirely willing to believe that they would use it broadly and aggressively. North Korea is led by angry, crazy, people. But, the early communication about the attack does not match that of a nation state, and there's no reason for them to have tried to pretend to be a random blackmail organization that I can imagine. In short, an IP is not a smoking gun. I worry that the FBI is taking advantage of people's lack of understanding of technology in order to push a story that is politically convenient, but factually shaky. I mean, I hope they aren't intentionally misleading people, I just don't necessarily trust that they wouldn't if there were motivation to do otherwise.
- zachrose 12y ago
  This is firmly in conspiracy theory territory, but didn't the U.S. government accuse North Korea on the exact same day (December 17, 2014) that Obama announced a thaw with Cuba?
  - headShrinker 12y ago
    We were in the misted of a deep conversation on US torture and all of the sudden, 3.2.1 it's gone. Sony gets hacked.
- Rooster61 12y ago
  I don't think the motive would be to start a war with DPRK. What I am afraid of is the use of this incident as "evidence" that our nation needs more "cybersecurity". This could help pass legislation previously blocked by congress due to insufficient evidence. There isn't much of a leap from declaring war on terrorism to declaring war on cyberterrorism, and we all know how that went. I know my tin foil hat is showing, but it's a creepy possibility nonetheless, and is in no way distant from Washington's past antics.
roywiggins 12y ago
I assume they're this confident because the NSA is snaffling up every 1 and 0 that comes in and out of NK. It would explain both their confidence and reticence to explain why.
- esmi 12y ago
  There are also nontechnical ways to attribute the attack to North Korea. For example a human informant inside North Korea which they did not want to reveal could provide quite solid information. But it appears we will never know the source of their confidence.
jdalgetty 12y ago
Do we believe this?
AlyssaRowan 12y ago
I've said my piece about attribution already. There's no new evidence I've seen (and there is not likely to be). I remain sceptical: Comey and especially Clapper aren't exactly what I'd call reliable sources. But they seem to have made their minds up, and that argument just goes round in circles. (The amused may wish to check out http://sony.attributed.to/ http://sony.attributed.to/ and reload the page a few times.) I'm concerned about where this rhetoric is heading, for several reasons. One reason is that I know this evidence absolutely can be faked: one particularly good tool to fake it is called QUANTUMSQUIRREL. They aren't the only people who can build tools like that: doesn't even take a high budget. And the same people who built QSQRL, have built other systems which automatically respond with high-budget malware when they think they're being attacked. I think we all know what happens in that endgame: the only winning move is not to play. But numerous countries, and non-state actors, are already playing it - if the FBI is to be believed, even psychotic despotic ones with relatively small budgets. I want to get off Mr Comey's wild ride; but how? Technically, we can build stronger network protocols, write bug-free software... every bit as hard as it sounds, but we can try our best. What can we do politically? Given how incredibly dangerous this could get, perhaps a treaty banning 'cyberwar' or 'cyberespionage' would be a good idea. (While we're at it, can we ban the use of 'cyber'? It sounds utterly ridiculous.) But the intelligence and law enforcement agencies already doing this would get very pouty at the prospect of their toys being taken away. It's all very disappointing. Anyone got any bright ideas?
- tmzt 12y ago
  There have been discussions of treaties banning "cyberwar" already. It seems counterproductive. I assume it would be preferable to someone in Seoul that they were attacked through digital means than with conventional weapons. They might lose access to their bank accounts for a while, but they won't have their homes destroyed or family killed. Asymmetric warfare of all kinds has two sides to it, it's part of the definition of asymmetric. The low capability party has to attack asymmetrically, but the high capability party can respond with much greater and effective force. In most cases, we are the high capability party. This "new" concept of cyber-warfare is really a way of saying conflict through the use of digital networks, but in a way that is distinguishable from network-centric or electronic warfare which are two different things. It is also asymmetric in the sense that it enables a low capability party to attack a high capability party with a much small investment than a strategic attack through other means would require. (Leaving out "terrorist-style" attacks using small arms or devices for the moment, which are not usually strategic.) It also means that a high capability party may not have an adequate defense against this type of attack, no matter how much they might invest in passive/defensive security. One weakness in enough systems is enough to massively increase the effectiveness of the overall attack. To respond to your second point, the overuse of "cyber-" is nauseating, and I personally restrict it to the use I mentioned earlier which is a means of differentiating it with network-centric or electronic warfare. A financial institution issuing press releases talking up their "cyber-security" means as little their marketing copy mentioning their use of "industry-grade SSL encryption." A proper disclosure would get into password policies for internal systems as well as customer accounts, what hashing algorithm they use to protect customer account passwords in their system, and other details that would give testimony to their capabilities in securing their own systems. This is somewhere where Google and Chrome can do a lot of good, giving us more than EV certificates and use of higher bit and stronger hash algorithms on CA certs as feedback in the browser. The next step could be a (cryptographically) signed affidavit of the internal security measures in place, which could be scored and used as a part of the determination of what feedback to show in the browser UI. It might also make sense for Chrome to conduct a rudimentary scan of the home router for these kind of obvious issues, or maybe for Google or someone else to offer an inexpensive secure router, though too many of these are provided by the ISPs now. Anyway, I'll leave it the cyberexperts to share their cyberknowledge about cyberwarfare and cybersecurity about how to prevent cyberviruses and other malware to those of us who are less cybersavvy, or, in the words of more than one newscaster, barely know how to turn on their computer.
tokenadult 12y ago
I thought about prior plausibility of the statement that actors for the north Korean regime would lack technical chops, and then I remembered the first north Korean nuclear weapon test.[1] A source I remember looking up after reading a Hacker News comment a year or two ago points out that the explosive yield from that test was very small, and I see that the Wikipedia article on the topic[2] reports the issue that way. Sometimes the north Korean regime intends to do something skillfully but screws up. I sure wouldn't want to be a smart person living under that regime, and there may be either intentional sabotage of some of their efforts (this has happened in plenty of other dictatorships before, by deeds of dissenters) or the best people they can find to carry out their hacks are not very 1337 hax0rs. [1] http://www.nti.org/country-profiles/north-korea/ http://www.nti.org/country-profiles/north-korea/ http://www.nytimes.com/2006/10/09/world/asia/09korea.html http://www.nytimes.com/2006/10/09/world/asia/09korea.html http://www.theguardian.com/world/2006/oct/09/northkorea http://www.theguardian.com/world/2006/oct/09/northkorea [2] https://en.wikipedia.org/wiki/2006_North_Korean_nuclear_test https://en.wikipedia.org/wiki/2006_North_Korean_nuclear_test
rilita 12y ago
"They revealed their IP address" How many technical experts do we need to explain that IP address is not proof, especially when many random IPs and proxies are involved. Suppose I am a hacker who wants it to seem like NK did it. I use a bunch of random proxies, and I use a couple machines IN NK that I previously hacked into. ( adding time delays to all commands I send to these ) I do stuff through these machines a bunch, making sure to connect to them and setup all the seeming commands ahead of time, and I let it happen. -wham- "proof" that I'm from NK and am an idiot suddenly realizing I forgot to use the proxy. I agree with the hackers. FBI are idiots. ( not the first time I've noticed they are idiots either; they also were very stupid when dealing with myself as a hacker imo )
- cpeterso 12y ago
  Exactly. How does the FBI distinguish between a hacker in NK and a hacker going through a proxy in NK?
xnull1guest 12y ago
Regardless of whether FBI is lying (I believe they are telling the truth in broad strokes) here are reasons to implicate NK (when both Russian and Iranian signatures were present the malware): - Instability in NK means instability in China - NK is a nuclear power and rapidly rising as a country on the world stage (according to CIA director Panetta) - Russia's sharing of hypersonic missile technology with North Korea heightens already mounting global nuclear tensions - Temporary division of Korea was set up by US and allies as a result of WWII - it was slotted for reintegration within a few years but Cold War tensions blocked cooperation between the nations required to achieve this; meaning: a.) North Korea has never been recognized by the US as a 'legitimate' state to begin with b.) The Korean War was fought for and activity in the area continues to be of proxy interest to greater geopolitical goals - Cooperation between SONY, RAND corporation and the State Department on the development of "The Interview" (and the gutting of the Smith-Mundt Act at the time this cooperation began) lends favor to the narrative that the film is a "Diplomacy Product" of the US State Department and that North Korea was the target to begin with - The United States is engaging in a mammoth amount of effort to establish international norms for cyberattacks and needs to show proactivity in this area
- tmzt 12y ago
  I'm not sure whether that statement came from DCI Panetta or the illustrious KCNA, but "rising on the world stage" sure sounds closer to the latter.
timebomb 12y ago
The FBI has already made it quite clear that they're trying to use these accusations as evidence that the US needs to be afraid of cyber attacks. I've seen a lot of people wonder this, but they flat out state in in an official statement on their website: "Further, North Korea’s attack on SPE reaffirms that cyber threats pose one of the gravest national security dangers to the United States." http://www.fbi.gov/news/pressrel/press-releases/update-on-sony-investigation http://www.fbi.gov/news/pressrel/press-releases/update-on-so... Second to last paragraph, second sentence.

73 points by headcanon 12y ago

ddod 12y ago

Could someone explain how they would know that the IP "used exclusively" by NK wasn't a proxied IP but in fact the "real" source IP? Personally, I think just mentioning that part of the evidence came from the Behavioral Analysis Unit proves that NK's ties to this are definitely shaky.

Alupis 12y ago
Not to mention it's also easy to spoof your IP address if you are traversing out of a DC or node that does not do egress filtering (meaning you don't even have to proxy through the proper IP/country... you just make it up). Shaky evidence? You bet ya. (and it seems this is the only evidence offered as an explanation so far) Also, if N. Korea really was behind this "attack" of a private company with no US Gov't ties, why would they not claim responsibility and tout their "Cyber Attack" skills? They do for just about everything else (even failed missile launch attempts). Fear of retribution? No way, this is/was a private company... the US Gov't could not respond with any kinetic weaponry attack and look good on a geopolitical scale. N. Korea also offered to send personnel to help the FBI in the attack investigation, which is extremely uncharacteristic of N. Korea to say the least... normally they'd just praise the attack flatout.
- happyscrappy 12y ago
  It is quite interesting how so many are hoping against hope that it was not North Korea. I don't really see why they are emotionally attached.
  - Alupis 12y ago
    There's no emotions involved -- just like there's no evidence involved. It's flat out wrong to blame some small and non-credible-threat country for something they likely had nothing to do with just to advance a political agenda. North Korea is not a great country... but that doesn't mean a "global leader" like the USA can just pin something on them with zero evidence.
    - davidw 12y ago
      Non-credible-threat? North Korea? I'm not a fan of the US' foreign policy in some ways, and certainly place no blind faith in the declarations of the government, but, that doesn't exactly make North Korea the 'good guys'... http://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?NewsID=14255&LangID=E http://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?Ne... http://en.wikipedia.org/wiki/North_Korea_and_weapons_of_mass_destruction http://en.wikipedia.org/wiki/North_Korea_and_weapons_of_mass...
      - Alupis 12y ago
        > Non-credible-threat? North Korea? Their nuclear program claims it has a range of 4,000KM, but to reach the USA it would take about 10,000KM. Not to mention their last missile launch test could not even escape their border. That's what I mean when I say non-credible threat; they are incapable of inflicting meaningful harm to the USA. They are really all bark and no bite... > oesn't exactly make North Korea the 'good guys'. Of course not. Nobody said they are -- they just simply aren't the "bad guys" we are looking for in this specific case.
        davidw 12y ago
        > they just simply aren't the "bad guys" we are looking for in this specific case. You seem to be awfully certain. Frankly, I have no idea and am quite skeptical of people who profess such certainty in the face of so few facts. Seems to be the kind of thinking where you have a conclusion and look around for facts to support it.
        Alupis 12y ago
        > You seem to be awfully certain Perhaps I overspoke a tad. I'm awfully skeptical is better put. We're largely a scientific community here at HN. Something is False until proven True. You may have a hypothesis, but it's just that, an educated guess as-to the result. To prove something True you must present overwhelming evidence. We have none of that here... What we do have is a hypothesis being perpetuated as fact in the face of almost zero concrete evidence. The FBI first says "there is zero evidence to suggest North Korea has anything to do with the hack". Then some "high level anonymous White House official" "leaks" to the NY Times that they believe it's North Korea, and it takes the FBI 3 full days to change their public announcement, yet present zero concrete evidence. This was a rudimentary hack against a private company, there's nothing that would be classified or kept top secret here. Sony should do a full disclosure. Until then, we can not be certain of anything.
  - mijoharas 12y ago
    I wouldn't say it is being emotionally attached to be sceptical of something that is presented without solid evidence.
- billions 12y ago
  Fully agree with your technical AND political analysis. I commented along the same lines when the attacks were first announced and got downvoted. When a way of thinking is too far ahead of the crowd, the HN algorithm fails.
- neilwillgettoit 12y ago
  It could be as simple as they saw a bunch of UDP traffic with a spoofed src that was a dprk ip block.
- rgbrenner 12y ago
  N. Korea also offered to send personnel to help the FBI in the attack investigation, which is extremely uncharacteristic of N. Korea to say the least They offered to help investigate the Cheonan after they sunk it. So it's really not uncharacteristic. And why do you have attack in quotes? Do you believe Sony wasn't actually attacked?
  - Alupis 12y ago
    > And why do you have attack in quotes? Do you believe Sony wasn't actually attacked? No, I think it's plenty clear that they were. It's just that "attack" has a certain stigma to it, and what happened to Sony was not some grand attack, but rather a run-of-the-mill hack against a company with extremely poor security.
- irq 12y ago
  It is _not_ easy, or even possible, to "make up" an IP address that works for receiving data across the public Internet. The responses to packets you send from such an address will not come back to you. This doesn't thwart all attacks (DNS query amplification, general flooding, etc), but their hack involved transmitting AND receiving data (ssh, http, etc). What is _easy_, however, is determining which country is using a given IP address. Particularly when the searching party is a superpower and the country they're investigating is known for having very few links to the Internet. And what connections they do have are severely restricted. I imagine it would be very difficult to find a reliable, exploitable proxy server inside North Korea that is accessible across the public Internet.
  - emn13 12y ago
    You may not need the responses to come to you, particularly if (as is suggested) this is a tiny minority of traffic. Sending something to some /dev/null address in NK? Why not?
drzaiusapelord 12y ago
Funny, when the IP addresses weren't NKorea, as earlier highly voted HN articles have told us, it was proof that it wasn't NKorea. Now that they do, its somehow further proof that it wasn't N Korea. I understand knee-jerk anti-US comments are karma gold here, but I don't think you guys realize how ridiculous you sound to the rest of us. I think its pretty difficult to arm-chair analyze this stuff and come out with a definitive answer, especially considering a lot of this stuff will never be declassified, but the Alex Jones-like conspiracy thinking here really brings the discourse down to a reddit-like level. Purely from an Occam's razor perspective, the country that attacked this film and warned of consequences if released-- consequences that actually happened, is probably at fault here. This analysis of how it must have been anyone but NKorea, especially considering NKorea's reputation, is highly questionable to the unbiased observer.
- davidw 12y ago
  > the Alex Jones-like conspiracy thinking here really brings the discourse down to a reddit-like level. That's where political discussions inevitably and invariably end up. Probably best to just flag these articles.
- indlebe 12y ago
  I would disagree on your point that "knee-jerk anti-US comments are karma gold here" on 2 notes, 1 that being anti-US-administration is not being anti-US, and 2 that most unsubstantiated comments that are critical of government actions almost always get down voted to oblivion. Everyone knew that North Korea had it out for Sony, what's to stop a network security enthusiast from stirring the pot by performing the attack and planting "evidence" that it was coming from North Korea. I don't think it's far fetched to think that many young security enthusiasts would get excited to think about causing such a stir.
- deleted 12y ago
  [deleted]
- siegecraft 12y ago
  Who is saying this is proof that it wasn't NKorea? Straw man. People on HN are just more likely to believe Schneier or other respectable security people, and not government agencies who by their very nature are going to have their own agenda and not be 100% honest. As far as consequences that actually happened -- Do you mean to say that theaters that showed the film were bombed? Or are you referring to embarassing email leaks which would have no doubt been released anyway?
philip1209 12y ago
If somebody were to want to frame the North Koreans, what would stop a motivated attacker (perhaps a nationstate) from just abusing BGP to spoof source IPs? How hard would that be to detect, particularly if you controlled direct peers?
- SwellJoe 12y ago
  As I understand it, China would be able to do so easily and convincingly, since most (all?) of NK's traffic passes through China. That may even be a good theory. China might not want to directly attack US industry in this way, but might "assist" North Korea in doing so.
  - dpeck 12y ago
    all, or at least all that anyone knows about. NK has a single path/peer.
- mox1 12y ago
  IF someone "route flapped" the entire North Korean IP space for any amount of time, one of the 10+ organizations who monitor BGP would have noticed and commented on that already....... If Russia et al had the ability to covertly do that...why attack Sony....why not big financial institutions or other such high profile targets....
  - emn13 12y ago
    No need to route flap if the route's already going through you.
roywiggins 12y ago
If the NSA has taps sitting on all the routers that are a hop away from NK, they can probably nail it down just from timing, right? If the packets were being proxied through an NK IP, I would think it would be easy to tell the difference (if you're the NSA, anyway).
- Alupis 12y ago
  Would be a hugely missed opportunity for the NSA to tout their currently controversial programs if true.
deleted 12y ago
[deleted]
rilita 12y ago
Timing correlation. If you are monitoring traffic in/out of NK, you can correlate traffic by similar sequence of sized packets going into one IP and then coming out of another. This is the "secret sauce" that the FBI says they cannot tell anyone imo. Doing this is nothing new and I am sure they've been doing it for ages though. The problem is that if you assume the FBI is doing this ( which any skilled hacker would assume ) then you can easily get around it by sending a sequence of instructions ahead of time, and then having them playback at what seems like a reasonable rate at a later time. ( making it seems as if you are on site and didn't set it up ahead of time )

kjs3 12y ago

"Terrorist attack" straw-man used to justify attacking an unrelated state target we happen not to like. Government officials appearing on complacent media outlets to beat the drums and persuade the populace that "they have conclusive evidence" and "retaliation is required to protect the country". This ended so well last time we did it.

wyager 12y ago
Yes, it's funny how it's a "terrorist attack" when a country we don't like does the same things we do. The most prominent recent example of the US (and Israel) carrying out an attack like this is Stuxnet.
- mason240 12y ago
  One targeted a civilian organization, the other targeted a government installation (one could even make the case it was a military target). It's not hard to understand why some people would give one a "terrorist" label but not the other.
  - deleted 12y ago
    [deleted]
  - mobiplayer 12y ago
    One inflicted economic damage to a private company, but Stuxnet put several lives at risk. Saying the former is a terrorist attack means that the attacks to Target et al were terrorist attacks, too.
  - xnull1guest 12y ago
    Haven't private corporations been hacked by the US also (Brazilian PETROBRAS)? https://firstlook.org/theintercept/2014/09/05/us-governments-plans-use-economic-espionage-benefit-american-corporations/ https://firstlook.org/theintercept/2014/09/05/us-governments... Given the first Geneva article placing private targets within international convention if they are of military interest (including media and broadcast services), and SONY's cooperation with the State Department in producing "The Interview", might SONY then qualify under international law? http://en.wikipedia.org/wiki/Legitimate_military_target http://en.wikipedia.org/wiki/Legitimate_military_target

stealthlogic 12y ago

The FBI is full of crap.

nick2021 12y ago

I thought we determined that it was an inside job and not North Korea at all? And that the FBI was lying about everything.

Zigurd 12y ago

Well that would make it a slam dunk.

SwellJoe 12y ago

I want to believe. But, there's such a history of deceit from our government, when there is a political motivation. I honestly don't understand why they'd be lying in this case...but, well, Iraq and years of torture at Guantanamo didn't really make sense to me, either. I don't think there is anyone gunning for war with North Korea (well, Northrup Grumman and Halliburton probably are, but I don't believe our state is entirely owned by the defense industry anymore, as it was during the Bush years). So, what's the motivation, if the FBI is misleading people? The thing is, I'm entirely willing to believe North Korea would like to have this kind of capability, and if they do have this kind of capability (which they might), I'm entirely willing to believe that they would use it broadly and aggressively. North Korea is led by angry, crazy, people. But, the early communication about the attack does not match that of a nation state, and there's no reason for them to have tried to pretend to be a random blackmail organization that I can imagine. In short, an IP is not a smoking gun. I worry that the FBI is taking advantage of people's lack of understanding of technology in order to push a story that is politically convenient, but factually shaky. I mean, I hope they aren't intentionally misleading people, I just don't necessarily trust that they wouldn't if there were motivation to do otherwise.

zachrose 12y ago
This is firmly in conspiracy theory territory, but didn't the U.S. government accuse North Korea on the exact same day (December 17, 2014) that Obama announced a thaw with Cuba?
- headShrinker 12y ago
  We were in the misted of a deep conversation on US torture and all of the sudden, 3.2.1 it's gone. Sony gets hacked.
Rooster61 12y ago
I don't think the motive would be to start a war with DPRK. What I am afraid of is the use of this incident as "evidence" that our nation needs more "cybersecurity". This could help pass legislation previously blocked by congress due to insufficient evidence. There isn't much of a leap from declaring war on terrorism to declaring war on cyberterrorism, and we all know how that went. I know my tin foil hat is showing, but it's a creepy possibility nonetheless, and is in no way distant from Washington's past antics.

roywiggins 12y ago

I assume they're this confident because the NSA is snaffling up every 1 and 0 that comes in and out of NK. It would explain both their confidence and reticence to explain why.

esmi 12y ago
There are also nontechnical ways to attribute the attack to North Korea. For example a human informant inside North Korea which they did not want to reveal could provide quite solid information. But it appears we will never know the source of their confidence.

jdalgetty 12y ago

Do we believe this?

AlyssaRowan 12y ago

I've said my piece about attribution already. There's no new evidence I've seen (and there is not likely to be). I remain sceptical: Comey and especially Clapper aren't exactly what I'd call reliable sources. But they seem to have made their minds up, and that argument just goes round in circles. (The amused may wish to check out http://sony.attributed.to/ http://sony.attributed.to/ and reload the page a few times.) I'm concerned about where this rhetoric is heading, for several reasons. One reason is that I know this evidence absolutely can be faked: one particularly good tool to fake it is called QUANTUMSQUIRREL. They aren't the only people who can build tools like that: doesn't even take a high budget. And the same people who built QSQRL, have built other systems which automatically respond with high-budget malware when they think they're being attacked. I think we all know what happens in that endgame: the only winning move is not to play. But numerous countries, and non-state actors, are already playing it - if the FBI is to be believed, even psychotic despotic ones with relatively small budgets. I want to get off Mr Comey's wild ride; but how? Technically, we can build stronger network protocols, write bug-free software... every bit as hard as it sounds, but we can try our best. What can we do politically? Given how incredibly dangerous this could get, perhaps a treaty banning 'cyberwar' or 'cyberespionage' would be a good idea. (While we're at it, can we ban the use of 'cyber'? It sounds utterly ridiculous.) But the intelligence and law enforcement agencies already doing this would get very pouty at the prospect of their toys being taken away. It's all very disappointing. Anyone got any bright ideas?

tmzt 12y ago
There have been discussions of treaties banning "cyberwar" already. It seems counterproductive. I assume it would be preferable to someone in Seoul that they were attacked through digital means than with conventional weapons. They might lose access to their bank accounts for a while, but they won't have their homes destroyed or family killed. Asymmetric warfare of all kinds has two sides to it, it's part of the definition of asymmetric. The low capability party has to attack asymmetrically, but the high capability party can respond with much greater and effective force. In most cases, we are the high capability party. This "new" concept of cyber-warfare is really a way of saying conflict through the use of digital networks, but in a way that is distinguishable from network-centric or electronic warfare which are two different things. It is also asymmetric in the sense that it enables a low capability party to attack a high capability party with a much small investment than a strategic attack through other means would require. (Leaving out "terrorist-style" attacks using small arms or devices for the moment, which are not usually strategic.) It also means that a high capability party may not have an adequate defense against this type of attack, no matter how much they might invest in passive/defensive security. One weakness in enough systems is enough to massively increase the effectiveness of the overall attack. To respond to your second point, the overuse of "cyber-" is nauseating, and I personally restrict it to the use I mentioned earlier which is a means of differentiating it with network-centric or electronic warfare. A financial institution issuing press releases talking up their "cyber-security" means as little their marketing copy mentioning their use of "industry-grade SSL encryption." A proper disclosure would get into password policies for internal systems as well as customer accounts, what hashing algorithm they use to protect customer account passwords in their system, and other details that would give testimony to their capabilities in securing their own systems. This is somewhere where Google and Chrome can do a lot of good, giving us more than EV certificates and use of higher bit and stronger hash algorithms on CA certs as feedback in the browser. The next step could be a (cryptographically) signed affidavit of the internal security measures in place, which could be scored and used as a part of the determination of what feedback to show in the browser UI. It might also make sense for Chrome to conduct a rudimentary scan of the home router for these kind of obvious issues, or maybe for Google or someone else to offer an inexpensive secure router, though too many of these are provided by the ISPs now. Anyway, I'll leave it the cyberexperts to share their cyberknowledge about cyberwarfare and cybersecurity about how to prevent cyberviruses and other malware to those of us who are less cybersavvy, or, in the words of more than one newscaster, barely know how to turn on their computer.

tokenadult 12y ago

I thought about prior plausibility of the statement that actors for the north Korean regime would lack technical chops, and then I remembered the first north Korean nuclear weapon test.[1] A source I remember looking up after reading a Hacker News comment a year or two ago points out that the explosive yield from that test was very small, and I see that the Wikipedia article on the topic[2] reports the issue that way. Sometimes the north Korean regime intends to do something skillfully but screws up. I sure wouldn't want to be a smart person living under that regime, and there may be either intentional sabotage of some of their efforts (this has happened in plenty of other dictatorships before, by deeds of dissenters) or the best people they can find to carry out their hacks are not very 1337 hax0rs. [1] http://www.nti.org/country-profiles/north-korea/ http://www.nti.org/country-profiles/north-korea/ http://www.nytimes.com/2006/10/09/world/asia/09korea.html http://www.nytimes.com/2006/10/09/world/asia/09korea.html http://www.theguardian.com/world/2006/oct/09/northkorea http://www.theguardian.com/world/2006/oct/09/northkorea [2] https://en.wikipedia.org/wiki/2006_North_Korean_nuclear_test https://en.wikipedia.org/wiki/2006_North_Korean_nuclear_test

rilita 12y ago

"They revealed their IP address" How many technical experts do we need to explain that IP address is not proof, especially when many random IPs and proxies are involved. Suppose I am a hacker who wants it to seem like NK did it. I use a bunch of random proxies, and I use a couple machines IN NK that I previously hacked into. ( adding time delays to all commands I send to these ) I do stuff through these machines a bunch, making sure to connect to them and setup all the seeming commands ahead of time, and I let it happen. -wham- "proof" that I'm from NK and am an idiot suddenly realizing I forgot to use the proxy. I agree with the hackers. FBI are idiots. ( not the first time I've noticed they are idiots either; they also were very stupid when dealing with myself as a hacker imo )

cpeterso 12y ago
Exactly. How does the FBI distinguish between a hacker in NK and a hacker going through a proxy in NK?

xnull1guest 12y ago

Regardless of whether FBI is lying (I believe they are telling the truth in broad strokes) here are reasons to implicate NK (when both Russian and Iranian signatures were present the malware): - Instability in NK means instability in China - NK is a nuclear power and rapidly rising as a country on the world stage (according to CIA director Panetta) - Russia's sharing of hypersonic missile technology with North Korea heightens already mounting global nuclear tensions - Temporary division of Korea was set up by US and allies as a result of WWII - it was slotted for reintegration within a few years but Cold War tensions blocked cooperation between the nations required to achieve this; meaning: a.) North Korea has never been recognized by the US as a 'legitimate' state to begin with b.) The Korean War was fought for and activity in the area continues to be of proxy interest to greater geopolitical goals - Cooperation between SONY, RAND corporation and the State Department on the development of "The Interview" (and the gutting of the Smith-Mundt Act at the time this cooperation began) lends favor to the narrative that the film is a "Diplomacy Product" of the US State Department and that North Korea was the target to begin with - The United States is engaging in a mammoth amount of effort to establish international norms for cyberattacks and needs to show proactivity in this area

tmzt 12y ago
I'm not sure whether that statement came from DCI Panetta or the illustrious KCNA, but "rising on the world stage" sure sounds closer to the latter.

timebomb 12y ago

The FBI has already made it quite clear that they're trying to use these accusations as evidence that the US needs to be afraid of cyber attacks. I've seen a lot of people wonder this, but they flat out state in in an official statement on their website: "Further, North Korea’s attack on SPE reaffirms that cyber threats pose one of the gravest national security dangers to the United States." http://www.fbi.gov/news/pressrel/press-releases/update-on-sony-investigation http://www.fbi.gov/news/pressrel/press-releases/update-on-so... Second to last paragraph, second sentence.