WASHINGTON - On December 19, less than one month after Sony Pictures Entertainment suffered one of the worst computer hacks in history, the U.S. Federal Bureau of Investigation announced it had found the culprit: North Korea.
While a group calling itself Guardians of Peace claimed responsibility, Pyongyang had long been suspected of having a hand in the attacks, given its vocal dislike for the "The Interview" depicting the assassination of Kim Jong Un.
The FBI announcement seemed to make it official, and President Barack Obama promised a against North Korea, terming the attack an act of "cyber-vandalism."
But just days after the FBI’s accusation, computer security analysts began questioning the FBI’s conclusions, saying the real culprit may be much harder to identify. And that’s raising worries about what may come next.
"Attribution is hard," at the cybersecurity firm RiskBased Security. "The idea that a mere two weeks into the investigation and there is positive attribution, enough to call this an act of war, seems dangerous and questionable."
What’s uncontested is that the Sony hack was accomplished by means of destructive malware that had somehow been inserted into its computer systems, with the resulting theft of terabytes of data (the GOP claims it stole 100 terabytes; Sony has not divulged the exact size of its data loss).
It’s also known that North Korea trains elite units to engage in cyberattacks and that Pyongyang has managed to carry out several successful hacks, mostly targeting South Korea, although on a much smaller scale than the Sony attack.
Beyond that, everything gets considerably murkier.
In its announcement, the FBI lists three bullet points connecting the North Korean regime to the attacks. First, it says:
This means, in part, that the malware’s design has elements similar to those seen in previous hacks tied to North Korea. One of those elements, known as a "wiper," was included to not just steal but to destroy data on Sony’s computers.
In this case, as security analyst Kurt Baumgartner writes at SecureList, the Sony wiper is something called Trojan Destover. Without getting too much into the cyber weeds, Baumgartner says Destover is built using commercially available RawDisk malware drivers, and bears similarities to the DarkSeoul and Shamoon bugs employed in a wide variety of cyberattacks unconnected to North Korea for years.
Further, while not specifically referenced by the FBI, some elements of the malware files appear to have been compiled on computers set for the Korean time zones and language. Again, that may indicate a link back to North Korea. But calling the connections to North Korea "flimsy," reporter Kim Zetter writes "an attacker can set the language on a compilation machine to any language they want and, researchers note, can even manipulate information about the encoded language after a file is compiled to throw investigators off."
The second FBI bullet point reads:
Given the near nonexistence of the Internet or ISPs in North Korea, it’s a relatively easy matter to tie data traffic back to specific locations and entities there. Here, the FBI is saying that traces of IP addresses tied to North Korea were found coded into the malware.
But security analyst Marc Rogers, writing on his blog, called this evidence "perhaps the least convincing of all." The FBI statement, he noted, only mentions IP addresses "associated with known North Korean infrastructure." That, he said, could suggest anything at all and is practically meaningless.
"The IP address is never what is interesting," he wrote. "It’s what’s running on the system that has that IP address that is interesting. Furthermore, to imply that some addresses are permanent fixtures used by North Korean hackers implies a fundamental misunderstanding of how the internet works and in particular how hackers operate."
Lastly, the third FBI bullet point says:
This refers to a 2013 hack that targeted a South Korean bank and several broadcasters, resulting in frozen ATMs and other problems. South Korea immediately blamed the North, saying it bore similarities to previous Pyongyang-linked hacks over the last four years – claims the North denied.
Interestingly, it that the hacks appeared to come not from North Korea, but from an IP address in China. Whether that proves or disproves the North’s connection to the 2013 hack is still an open question.