Hacker News Reader

> 2. It actually is North Korea. We've been led to believe that they exist in a technological dark ages of sorts, with most of their infrastructure relying on technology that would horrify the average HN user. They're certainly belligerent enough, but now suddenly we find that they have not just the technology to pull it off, but also the talent? How does that kind of talent even develop under a strictly regimented government like North Korea's? What kind of ability do they actually have?

See, this really isn't the case, and why most people believe this is beyond me, when a google search would suffice. I'm not criticizing you, actually, just pointing out that there's an incredible amount of misinformation out there about North Korea. Look at these photographs of a technology trade fair in Pyongyang this summer, for example:

http://www.northkoreatech.org/2014/06/23/another-look-at-the...

Most telling, IMO, is that a 32G usb is being sold for USD20, where at the time of writing, the same product was nearly USD16 on Amazon US. That's a remarkably low markup for a product, especially for one in North Korea. Also considering that it's a high volume, low price product with so little of a markup makes me think that other technologies must be very available and accessible, and that NK is hardly the technological dark ages that popular discussion has us think it is.

Of course, this all isn't to say that NK performed the hack, but I hardly think that a lack of infrastructure would really be the barrier if North Korea really wanted to train a cadre of hackers.

The amount of $20 isn't relevant. What's relevant is how hard it is to come by $20 in the DPRK.

Indeed. Don't forget the currency is the won, not US dollars. Foreign currency in a communist country is most likely very hard to get (at least in East Germany it was).

Clearly not very hard, if the entire trade show is conducted in RMB, euros, and usd.

Or, you know, the entire trade show is:

a) for people in the higher echelons of the party that are paid more (and might still be expensive to them), e.g. a 1% of the population

b) BS organised to give the impression that they are not behind, while in reality nobody can afford those, and the buyers are "actors".

Huh, thanks for the link.

Pretty much all of the very little I know about North Korea comes from articles like http://www.theatlantic.com/infocus/2012/04/glimpses-of-human... (e.g. #17 @ http://www.theatlantic.com/infocus/2012/04/glimpses-of-human...). Or http://www.asianscientist.com/2012/12/topnews/dprk-north-kor... -- that, plus the lights-out situation at night, plus their previous difficulties with rocket technology and their impoverishment, altogether gave me the impression that they're a couple decades behind other developed nations, technologically.

I always figured at least a little of that was propaganda of sorts, but there was also the occasional "I visited DPRK and took these surreptitious shots of what I saw" article that seemed to substantiate it.

Man, they are RIGHT next to China where this stuff is manufactured and available for a lot less USD than the US pays. You want markup, just look at New Zealand.

Edit: also what camperbob said.

if North Korea really wanted to train a cadre of hackers.

They've done this -- they have an elite military-hacker unit called Bureau 121 of about 1800 people, as described by a defector in a recent Reuters story I quote in my comment above:

https://news.ycombinator.com/item?id=8767033

Those pictures aren't inconsistent with this "trade show" being about 4000 square feet of floor space with 50 people attending...

According to the military community, NK/China relations are strained at the moment. In that case I would be surprised if they worked together on such a high-profile hack.

"North Korea is even angrier, and very shaken that a retired Chinese general said publically that China would not come to the aid of the current North Korean government if the government collapses or starts a war. China often makes official announcements via public 'comments' by retired senior government or military officials. This makes it easier to, if need be, back off from the new policy. China has not backed off this one. China is telling North Korea to do what China wants or else.

China wants work on North Korean nuclear weapons stopped. China apparently promised to be useful in the UN if North Korea resumed the six nation talks over North Korean nuclear weapons."

http://strategypage.com/qnd/korea/articles/20141216.aspx

This is an article reporting on government officials' claims that the attack comes from NK. The credentials of the reporters (especially their "tech journalist" credentials) hardly matter. The NYTimes isn't endorsing this position, it's just reporting that government officials say it, and it'd be pretty stupid of the NYTimes to just make it up. I don't understand why you suspect a conspiracy, especially based on such little info.

With regard to point 2, remember that this is the country that built a nuclear weapon and launched an object into orbit (with some dramatic difficulties on the way). If the NK government wants to get something done, especially something militaristically, they do it.

One possibility I've heard aired on Twitter, which I find somewhat disturbing (it's telling of my current distrust of state actors that I even consider this highly paranoid scenario a possibility), is that this will be used as a sort of digital Pearl Harbour to justify hardening laws against hackers, security researchers, etc. Of course, the two aren't really related, and in fact security researchers and hackers increase the security of the US against such things, but that hasn't stopped the lawmakers before.

> justify hardening laws against hackers

Seems far fetched as North Korean hackers are about as far away as you can get from US influence and power.

> > justify hardening laws against hackers > Seems far fetched as North Korean hackers are about as far away as you can get from US influence and power.

The concern that they'd state would be local hackers working for or with those elsewhere for what-ever reason (payment, disenfranchisement with local policies, ...) or just doing it "for the lols".

The potential knee-jerk hardening of laws in response to this sort of thing is not specific to this case: it could equally happen in response to any other very public exploit. The same for the more insidious "we've been waiting for an excuse to..." hardening of laws, for a more paranoid view.

This is hardly paranoid. That's the type of thing neo-cons publicly wrote about before the Bush/Cheney presidency: https://en.wikipedia.org/wiki/Project_for_the_New_American_C...

Also note that CISPA passed the House this summer but failed in the Senate. Guess who takes over the Senate next year?

That's just chatter. It's the digital equivalent of "they're coming to take away our guns!" after every mass shooting.

Nicole Perlroth has good tech journalist creds.

Why do you think that? I don't see any reason to believe that based on my albeit superficial search so far.. In fact though, I see oddly coincidental and potentially biased 'creds' in her LinkedIn profile, etc. ('Her 2014 Times profile of security blogger Brian Krebs has been optioned by Sony Pictures.' https://www.linkedin.com/in/nicoleperlroth ).

Genuinely curious though if she is unbiased or if maybe she should be checked against.

Well, I did pretty much the same thing, but ignored LinkedIn -- she did an interview with Krebs, but I also saw a series of other tech-related articles with a security focus. At the least, I didn't see an obvious political bias.

I also try to be careful not to dig too deeply into the backgrounds of people writing articles I disagree with. Seems like a dishonest thing to do.

Looking at a page that was intentionally made public by the author for the purpose of displaying non-sensitive/work related information (linkedin) is in no way "digging too deeply"

I wouldn't have been disappointed to see a mention of the business she has with Sony Pictures in the article she wrote about Sony Pictures, in the interests of full disclosure.

"We've been led to believe that they exist in a technological dark ages of sorts"

They have very publicly show capability to launch long to medium range ballistic missiles and they have an active nuclear weapons program. I'm not directing this at your entirely, but I'm surprised how many people thing don't believe they lack the technical capacity for computer warfare.

I don't think anyone believes North Korea lacks the capability to execute on information freely available from the internet, or to launch Russian missiles for that matter.

What they do lack, apparently, is the ability to run a country that's not an oppressive shit hole.

As to point 2, here[1] is a fairly complete report musing on the technological and cyber warfare capabilities of the North Korean Military. Not that I think they did it, but they certainly might be capable.

[1] http://h30499.www3.hp.com/hpeb/attachments/hpeb/off-by-on-so...

What about a slight variation of #1: North Korea massively funding a Chinese hacker group to carry out the attack.