Hacker News Reader

Comment by xnull2guest | Hacker News Reader

Attribution in cyberwarfare is infamously difficult.

However, there is an age old equation that works fairly well for attribution: opportunity + motive + evidence. Opportunity in cyberwarfare is a complex item to tease out and has more to do with opportunity costs than anything else (the strategy of cyberwarfare demands owning everything immediately rather than later and the exercise becomes one of triage).

In this instance we do have both a motive and some evidence that point to North Korea, and it is in line with the sort of theatrical politics NK is known for. IMHO more evidence and an analysis of opportunity cost are a must to pin NK down further, but you can be assured that (unless officials have ulterior geopolitical motives) they have a pretty good idea about the cyber capabilities and actions of other nation states - more than they are apt to release to media outlets.

View on HN

This is my concern - they are starting with a motive and the DPRK and then working backwards to fit the evidence in.

Everybody seems to have forgotten that this started as a financial ransom demand and the attackers made no mention of the movie or the DPRK until Sony and the media did.

I'm not suggesting the DPRK are not involved, but that it is a very big leap to go from media speculating about motives to the US government formally accusing them. The details leaked to the NyTimes do not substantiate this leap.

It's certainly true that a ransom was demanded first, giving Sony a few days to respond, and then only after the compromise was completed were demands made to remove 'The Interview'.

It truly is difficult to attribute and only with more evidence and a more careful analysis of timeline, the malware, and the communications will things come into focus.

One thing I have not yet been able to find are numbers for the ransom. I've seen the emails demanding ransom and the defacings demanding the same, but nowhere have I seen a number of dollars being demanded. Have you seen that anywhere?

Plus, would terrorists offer an opt out(for personal information) for rank and file Sony personnel?

Whoa. Terrorists? Which terrorists? What terrorism are you talking about?

Thanks to our favorite president GW Bush, any computer hacking is considered "terrorism" and has similar consequences just like real terrorism such as ISIL or Al Qaida:

http://www.securityfocus.com/news/257

I would suggest that even ISIL isn't a terrorist group, at least in the same sense that the word terrorism has been used throughout the past 100 years. ISIL represents 30k mobilized personel, are made up of a huge number of disparate factions (some fighting for a three state solution - which would actually be a great improvement in the organization of the middle east, whose lines right now were drawn by the British and have nothing to do with historical or cultural boundaries), are fighting with traditional armies with traditional warfare weaponry and because they are fighting for political change in a state where authoritarian governments with financial and political ties to outside nations has limited how much they can represent their people. ISIL to me, if I use textbook comparisons, looks more like an grassroots insurgent army fighting for political representation.

Re: computer hacking considered "terrorism" - this represents yet another way "terrorism" no longer means the despicable act it was originally associated with. And doesn't that make the "War on Terror" also a "War on Hacking"? How the hell are we going to win a war on hacking?

I do hope that the OP was not using the GW Bush administration definition of terrorism...

Any action that results in rich assholes losing a bit of money or potentially losing a bit of money falls under the umbrella of terrorism now, or 'economic terrorism' if you will. So copyright infringement and of course any form of organized protest fit the bill, along with hacking a Japanese company with offices in the US.

You can try to fight the total annihilation of meaning in our language, but as you see here it is a losing battle.

Oh my. This is a derailment of the thread but here are some (political) words off the top of my head having been annihilated recently:

terrorism

socialism

marxism

hero

capitalism

free market

invisible hand

imminent

torture

collect

to brief

espionage

surveillance

privacy

freedom

>>However, there is an age old equation that works fairly well for attribution: opportunity + motive + evidence.

IMHO, SONY & USgov have more of the first 2 than N.K. and the 3rd can just be made up.

I agree that if you think Sony and the US government have more motive, this changes attribution (and in fact I mentioned it wrt "ulterior motive"). I'm curious about what motives you think Sony and USG have. I'm not sure what to make about the opportunity cost analysis indicting Sony or the USG - maybe you could say more about that too?

SONY might think the movie was going to bomb anyway(I don't understand why anyone would want to watch this on xmas) and this hacking incident is probably going to cost them millions as well. Turning this likely-to-fail movie + hacking disaster into a promotional catapult generating big profits would be one option. Even I want to watch this movie now, but not on xmas.

USgov., I think they will take any chance given to them to put China, Russia and N.K. in a bad light.

I'm not sure what I think about the motive of Sony to turn the hacking into a promotional event or how the USG motive you suggest squares with what they've said over the past week (they have been careful not to attribute until just recently, even in spite of rumors of NK fault).

The big question your analysis seems to beg is why #GOP would demand that the movie not be shown. In the scenario where Sony and the USG want to spin this as anti-NK propaganda (certainly this is not out of the USG playbook), why would #GOP play along? I don't understand #GOP's motive in your scenario.

All this is pure speculation on my part of course, but I think the #GOP are just talented people doing it for the lulz. Note that the media mentioned North Korea first, possibly giving #GOP the idea to increase the lulz to levels previously unimagined. Bonus points - It diverts attention from the real hackers; making them less likely to be caught.

Finally, what do you think of #GOP coming from some of the same IPs used in prior attacks known to have been state sponsored? You must think that they bought access to these machines on the same forums they bought Korean malware?

That's the manufactured evidence I suspect is happening.

Okay, so you think that this is is a manufactured lie. I understand your position now - it seems consistent to me.

I'm not sure that I personally buy that the evidence is manufactured - that there is motivation enough from the USG to invent that evidence. But this is where there is reached an impasse. There just isn't enough information at this point to really say. Either speculation can be right.

It'll be interesting to watch as this continues.

Completely agree. I know the regime in North Korea is crazy, but I really don't see them caring about this at all. On the other hand, they're often the butt of jokes in the west. Just look at all the "you've been banned from r/pyongyang jokes on reddit. Or 'The Interview' itself, which based on the trailer, seems to be laughing at the same stereotypes. I think a bunch of hackers that frequent 4chan have a lot more motive to continue this whole joke than North Korea itself.

I'll hammer on a third agreement. I posted a similar comment elsewhere in this thread. This really does make the most sense. I cannot imagine that North Korea has the motivation, brain power, and coordination to pull off something and actually rattle our culture, let alone be adept enough to know that Sony is a good target to attack Hollywood.

Companies are "brands" for hackers. "I hacked Target. Home Depot was me." etc. Sony is a huge brand. Keep the lulz going, and see how big it can get.

North Korea threatens to nuke US, as well as half a dozen other countries, on a regular basis. There's no need for false flag operations against North Korea; they're already doing everything they can to paint themselves in a bad light.

One can always post-fact construct a motive for North Korea. One can certainly think about front page worth motives for Iran too if you try, and Russia, and whoever you want.

Opportunity costs are exactly as low for every country that the US decided to antagonize by placing on their evil axys list, and only marginally bigger for any other actor, because nobody will catch the hacker.

The only item of yours that can not point to anybody that you want is the evidence. Evidence-less finger pointing is not a sane sport.

Can you come up with a good motive for Iran or Russia?

Opportunity costs are not exactly as low for every country, as they have different capabilities, use different tactics, have different budgets and talent pools, and have different interests. Triage is going to be different for different state actors. Pure and simple. I'm not sure that an opportunity cost analysis indicts NK - and in fact I do suggest that work needs to be done there in the original comment.

Even the motive for a lone wolf hacker with a huge botnet would make sense if they were impressing themselves with how good the hack was. If they could "trick" the US into thinking it was North Korea, the lulz from that alone would be enough to have the whole charade to take on a life of its own.

That's just a good a reason as any other motive for any other suspect given that I've seen.

> Attribution in cyberwarfare is infamously difficult.

When in doubt, blame China.

Wait a couple of days. Anti-China politicians will get there.

There is an age old word too, scapegoat. It's must be easy to lay blame on something that can't be heard.

By the way, it's ulterior, not alterior.

Thanks, fixed.

Reply on news.ycombinator.com