Hacker News Reader

Comment by berberous | Hacker News Reader

An insider strikes me as extremely unlikely. You would need to have someone that is normal and skilled enough to be hired at Sony (presumably in IT), but malicious or wronged enough to attempt to destroy the entire company, including wronging all of your co-workers and risking serious risk of prosecution from the U.S. government. Also, you would presumably be skilled enough to evade the FBI, but still somehow be stuck in some mid-tier Sony IT gig.

On the other hand, this strikes me as totally within the realm of possibility for North Korea. They have the skills, they don't really give a shit about pissing off Sony or the FBI, and they have motive.

View on HN

I think that's too narrow. You need one person with access to feel wronged, and you also need strong black-hat skills, but they don't have to be the same person.

Hollywood is famous for screwing people over, so I doubt there is a deficiency in people with grudges. Suppose one of those people were willing to spend $50k on this? Suppose they had a friend or a second cousin with a connection to some people with skills and a taste for large-scale lulz?

These people literally threatened another 9/11, the FBI is involved, and the White House is apparently seriously considering responding in some manner. I think any regular black hat or American would rightly be pissing themselves and disappearing if this were just for the lulz or revenge. The risk is just too disproportionate to the 'gain.' Unless you are a nation state that already has no qualms about hacking others, and is immune from prosecution and knows that the U.S. is not going to go to war over this.

You're assuming basic rationality of people, which unfortunately isn't universally valid (I have the same intuitive tendency, which I've learned to be aware of and compensate for).

Disgruntled (usually ex-) employees have been known to do some pretty insane, destructive things, without appropriate regard for personal consequences. What was the name of that guy who locked his ex-employer out of their infrastructure and caused a big rumpus a few years ago, again? More to the point - we know that there exist people who are capable of walking into their workplace with an assault rifle; the existence of a person inclined to execute the attack on Sony should not be surprising.

Has it been shown that the anonymous 9/11 threat was made by the same group? Could have been anyone jumping in at that point right? Even if NK wasn't involved in the hack, they could have made that threat to take absence m advantage and stop the movie.

> "The hackers have released at least nine batches of data and promised a larger quantity on Christmas."

That's why it doesn't make sense as North Korea. Their accepted motive goes as far as THE INTERVIEW, which was dodgy-enough to begin with, but which has already been shelved. Why would North Korea be threatening to release more information if their goals were already met?

Ignoring the rhetoric, the actions here looks much more like garden-variety data-ransom. If "their demands" were "x-million USD, don't contact the feds", then everything makes sense. Wiping the data. Only mentioning THE INTERVIEW after the press seized on it (misdirection and increased pressure on Sony). Actively promoting the tastiest bits of leaked data to the press. Releasing more as further deadlines pass without some unnamed capitulation (that's larger/different than simply shelving THE INTERVIEW). Having The Big Bad Deadline for a large future release.

That the US Government is publicly on-board with the DPRK theory also doesn't fit an actual "hack by North Korea" situation. The US Government gains nothing by naming perps, which is why they almost never do it, not even after the consensus opinion of third-party researchers makes an inescapable conclusion. If the perpetrators actually were North Korea, the US government would stand to lose more than most times, as we're currently trying to lure the DPRK back to the six-party talks. (A subject much larger than Sony Entertainment.)

That attribution would make perfect sense if the government is coordinating with Sony, but has to try to convince the hackers they aren't involved/competent/two-hops-away, etc. Given how cozy the US press is with the US government, I wouldn't be surprised if they were knowingly pushing the "it's totally North Korea" angle in the service of the investigation.

> Why would North Korea be threatening to release more information if their goals were already met?

They are not. You are working off of outdated information: http://gizmodo.com/sony-hackers-thanks-for-running-scared-we...

(As an aside, if anyone wants to make a friendly wager, I'd bet up 3 BTC on the fact that this is indeed a NK attack, so long as we can agree on some sort of reasonable time period and way to confirm, such as an arrest or confession. Either payment to the winner, or payment to the winner's designated charity. Is there a site that allows for committing to BTC bets with some sort of escrow or multi-sig release feature? If not, there should be.)

I think you are looking for something similar to: http://longbets.org/

Sociopaths exist. If this was an insider, possibly an administrator, all they would need to do would be to execute the equivalent of "select * from \\windows_domain", put the results in a torrent, and call it a day. From all reports the internal information security procedures at Sony Pictures were not rigorous, which implies such a thing could happen without detection.

I'm not saying that the DPRK couldn't do it, only that no proof has been offered that they did. Given the lack of proof, assigning blame to anyone is premature.

Parenthetically, it is amusing to me that the accepted narrative has so quickly become that NK definitely did it.

Or they could have stolen a few backup tapes, then infected the network with malicious software and left bits of logs pointing wherever they want. It's unlikely Sony has full network captures. So a line in a log file with an IP is likely to be taken as absolutely true.

Sony laid off quite a few people this year including an entire division. Plenty of people who could be disgruntled.

http://variety.com/2014/biz/news/sony-cuts-over-70-jobs-more...

> [..]and skilled enough to be hired at Sony (presumably in IT)[..]

As I see it, after the three (if Im not mistaken) last successful attacks at Sony, I wouldn't say they're skilled _enough_. Not even skilled basically.

Again, as I see it, it's Sony's fault: after the first attack at playstation network, the least they could do is stop using plaintext files to store passwords.

But no. Second attack with the same results and now a third.

So no. They're not even close to be characterized as skilled (and that goes especially for the managers/whoever did not decide to leave the I-store-passwords-as-plaintext practice).

Not disagreeing with you but

>be skilled enough to evade the FBI, but still somehow be stuck in some mid-tier Sony IT gig.

Skill (whatever that is) has very little to do with how successful you are at your job and/or which company you are working at.

And it's more precise to say someone is 'skilled at something' than 'skilled'. You can be exceptionally clever at covering your criminal tracks, but merely adequate at fixing broken printers. You can be fantastic at writing lock-free multithreaded code, and utterly incapable of cracking the IRS d-base.

Your argument applies equally well to just about ANY high-profile inside job, and those are incredibly common. Obviously that segment exists. Why couldn't it exist for Sony?

The majority of data theft, cybercrime, etc is done by insiders these days - a lot of companies just don't talk about it unless forced to by regulations...

Reply on news.ycombinator.com