PhreakNIC 19 - A defense of whoever you think was behind the Sony Pictures breach - Brandon Tansey
Channel: phreaknicstaff
Date: 2015-12-21

Even in optimal conditions, incident response and attribution can be very difficult. Trying to get to the bottom of an incident when you've got no access to the compromised organization, network, or system is even more so, yet we try to do it each time there's a new headline-making breach. These communal and outsider-driven investigations are often doomed from the start when they're focused on painting a complete picture.

Last year Sony Pictures Entertainment announced a breach in true Hollywood fashion which drew lots of attention. This resulted in lots of people racing in attempt to assemble the puzzle with only a small fraction of the pieces. That said, when Richard Bejtlich was asked if he saw any public theories that were close to Mandiant's findings, he responded that he hadn't.

This presentation does not claim to be the first, nor will it make any attempt- in fact it will do the exact opposite. The audience will not leave the presentation knowing exactly what happened or "whodunnit." Instead, the presentation will attempt to demonstrate that there hasn't been enough information publicly disclosed for anyone to know with a reasonable degree of confidence. This will be demonstrated through an in-depth examination of the associated malware and its many potential red herrings, communications from "the attackers", and a review of other information reported following the disclosure. The examples discussed will be specific to the Sony Pictures Entertainment breach, however the concepts will not be.

Brandon Tansey is a security researcher at Lancope. Brandon attended and spoke at PhreakNIC18 Last year leading up the PhreakNIC he was unaware that the term was a bit overloaded around Atlanta which lead to some kind of funny conversations when he mentioned that he was slated to present.

(Atlanta also has a conference pronounced the same way as PhreakNIC, thus the confustion to Atlanta natives)

PhreakNIC is a technology conference held annually in Middle Tennessee. PhreakNIC started as an infosec hacker convention but has expanded over the years to include the maker scene, ham radio, DIY engineering, space and science nerds, the skeptics community, electronic and experimental music, gamers, anime, and general geekery.