Advice from a Real Hacker: Why I'm Skeptical That North Korea Hacked Sony « Null Byte :: WonderHowTo

Seldom in recent history has a cyber security event caused so much media stir (maybe because it happened to a media company?) and international relations upheaval. Cyber security breaches seem to take place daily of major corporations, but the Sony hack seems to have captured the American imagination and, for that matter, the whole world's attention.Maybe it was the salacious details in the released emails of the interaction between the studio and its stars. Or, maybe it was the American public's feelings of being wronged by a petty dictator. Whatever the reason, the Sony hack has captured the fancy and attention of the public like none other.Soon after the hack, the FBI "conclusively" determined that the attack came from North Koreans and reported to the President and the American public as such. For my part, I have many reservations about that conclusion.Last week, I wrote aboutmy observations on the Sony hack, and in that article, I simply recounted the thoughts that had bounced around my head. Now that I have had more time to examine the evidence and congeal my assessment, I feel compelled to tell you that I haveseriousdoubts that this hack was committed by North Korea. Probably, more accurately, I have serious doubts that the evidence the FBI has cited points to North Korea.Let me tell you why.There Was No Immediate North Korean ConnectionThe hacker group, "Guardians of Peace," made no reference to the movieThe Interviewor North Korea, initially. Only after the media began to speculate that the motive of the attacker was regarding the movie did the hackers mention it. It appears that the attackers were happy to deflect the investigation away from themselves.If you were the hacker and everyone wanted to blame North Korea instead of you, wouldn't you be smart to run with that scenario?The Evidence Was CircumstantialAs I mentioned inmy earlier article, in most of these types of cases, the fingerprint of the hacker is found through examining the malware. This "fingerprint" is only circumstantial evidence, meaning that it is far from conclusive, but it caninferthe identity of the attacker. It examines the pieces and modules of the malware and attempts to trace it backward to the perpetrator. In essence, it looks for re-used code and who may have used it in the past to infer who last used it. Imperfect at best, inconclusive at worst.According tothe FBI report:"Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks."Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea."The modules that the FBI cites in their report could have been used byanyone. They cite the use ofthe Shamoon attackthat was used against Saudi Arabia in 2012 and South Korea in 2013 and has been available on the malware black market to any hacker for the last two years. Just because a piece of malware was used in similar hacks, it in no way means that the attackers were the same. Any hacker could have acquired this malware in the last two years and used it in this security breach at Sony.They Cited Well-Known Proxy IP AddressesThe FBI cites cites numerous IP addresses that the attackers used in their attacks on Sony. They note that other attacks that have been traced back to North Korea also have used these same IP addresses. When one examines these IP addresses, you find that they are the IP addresses of well-used proxies that many attackers use.Fromthe FBI report:"The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack."They cite several IP addresses that the attackers used. These include:202.131.222.102 in Thailand217.96.33.164 in Poland88.53.215.64 in Italy200.87.126.116 in Bolivia58.185.154.99 in Singapore212.31.102.100 in CyprusThese IP addresses belong to well-known proxies (as discussed in this article) that any attacker could and will use to attack a target. Far from conclusive evidence that North Korea was involved.The Speed of the File Transfer Was FastInmy earlier article, I puzzled over the speed by which the attackers were able to transfer 100TB of data. Given the poor Internet architecture of North Korea, such a download would have taken weeks. One has to conclude that the attack took place from a location outside of North Korea.Even if the attack originated from outside of North Korea, moving 100TB is no trivial task. If you've ever downloaded a large file, say a 2GB movie or 4GB operating system, you know that it can take hours. Now, imagine moving files 5,000 times larger! Either the hacker had a very high-speed connection to Sony, the Sony security apparatus was asleep at the wheel, or the hack was an inside job.The Language Clues Point Toward Another CountryThe cyber security firm, Taia Global based in Israel, conducteda linguistic analysisof the attackers language and syntax. Often, when one language is translated to another, the translator will use syntax and constructs that are part of their native language, but not in the target language. That is why poor translations can sound so stilted. This can provide clues as to the language of the original document or the translator or both.Taia reportedly tested the translations for clues from the following languages:MandarinChineseRussianGermanKoreanThey concluded that translation was not from an original written in Korean, but most probably, Russian.Evidence Supports a Possible Inside JobAnother cyber security firm, Norse, has donean investigationbased upon Sony's employee records that were released by the hackers. Norse used some good old detective work to scan the leaked documents and search for employees who might have had motive to hack Sony, access to the system, and technical expertise to pull it off.After reviewing these records, they claim that they have identified six individuals whom they think might have been involved in the hack. The individuals identified were based in the U.S., Canada, Thailand, and Singapore. One of these employees, code named Leena, was laid off in May and was involved a technical role with Sony before being let go.Several of these employees expressed resentment on social media toward Sony for their dismissal.The Daily Callerreported:"After examining intercepted communications of other individuals engaged in contact with hacker and hacktivist groups in Europe and Asia (where the Sony hack was routed through), Norse connected one of those individuals with the Sony employee on a server that featured the earliest-known version of the malware used against Sony."So, Did North Korea Really Pull This Off?For all of the reasons above, I amveryskeptical of the conclusion that North Korea hacked Sony. All of the evidence cited by the FBI is inconclusive and cannot be used to point the finger to any one nation or individual. Some of the evidence cited by the FBI is sophomoric—even laughably so—as a grounds for pointing a finger at North Korea. I do, however, withhold judgement as they or the NSA may have evidence that they are not sharing, but what they are sharing is inconclusive, at best.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image via1000 Words/ShutterstockRelatedThe Sony Hack:Thoughts & Observations from a Real HackerHow To:Watch Sony's "The Interview" Right Now (Update: Now on Netflix)Market Reality:As the HoloLens 2 Arrives, Magic Leap Aligns with SK Telecom & CNNNews:A Brief History of HackingHow To:Dashlane & LastPass Can Now Automatically Strengthen All of Your Weak PasswordsNews:'Turkish Crime Family' Demands $75,000 in Bitcoin from Apple in Exchange for Hacked iPhone AccountsHow To:Get Sony's Feature-Packed Xperia Keyboard on Any Android DeviceNews:Apple Says iPhone & iCloud Are Safe After Claimed Breach by 'Turkish Crime Family'White Hat Hacking:Hack the Pentagon?TypoGuy Explaining Anonymity:A Hackers MindsetHow To:Keeping Your Hacking Identity SecretHow To:Install Sony's Newest Album & Walkman Apps on Almost Any AndroidNews:North Korea, the ultimate underdogHow To:How Hackers Take Your Encrypted Passwords & Crack ThemGoodnight Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsNews:Unbrick your Sony PSP Fat or SlimFirst Round:What really grinds my gears.News:Movie Posters from KoreaPhoto Critique:Covers - 4/7/10News:South American teams doing great.News:How'd North Korean Fans Get to the Games?Community Byte:HackThisSite, Realistic 3 - Real Hacking SimulationsNews:Student Sentenced to 8mo. in Jail for Hacking FacebookCommunity Byte:HackThisSite, Realistic 5 - Real Hacking SimulationsCommunity Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsNews:Japan Nuclear Update New Images of The PlantHow to Play Homefront:The Controversial, Dystopian War Game by THQCommunity Byte:HackThisSite, Realistic 2 - Real Hacking SimulationsFIFA World Cup 2010:How I'll be watchingCommunity Byte:HackThisSite, Realistic 1 - Real Hacking SimulationsGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsNews:Special Edition Gold PS3 'Ni No Kuni' Bundle -- Another Reason to Move to JapanNews:Next Professor Layton Game to Include 100-Hour Long Bonus RPGNews:Until Project Rainfall Succeeds, We Must Hack the Wii for Xenoblade Chronicles in North AmericaNews:NAB 2010 - Sony's Digital RED ONE competitor prototypeNews:Anonymous Hackers Replace Police Supplier Website With ‘Tribute to Jeremy HammNews:Indie and Mainstream Online Games Shut Down by LulzSecNews:Teacher Yells at Student Over Obama CriticismWTFoto Image Macro Challenge:Give Us Your Best Hobo Advice!News:North Korean Broadcast of Game vs Brazil