Hacker News Reader

Hacker News

Comment by crdoconnor | Hacker News Reader

Full thread

crdoconnor

Reasons for pretending that North Korea did it rather than a disgruntled ex-employee:

Sony executives:

* Sony gets tons of free publicity for its new movie.

* It diverts attention away from those emails that were starting to make certain Sony execs look really bad.

* They don't look quite so hopeless and incompetent if they're getting hacked by a nation state.

FBI/CIA/NSA/DOD:

* It's something that can be used to deflect heavy criticism of their all-pervasive surveillance.

* It's something they can use to wangle more money - to face the exciting new "cyberwar" threat.

Reasons for North Korea denying involvement if they actually did it:

...

View on HN

While that all seems possible, it's all speculation. We talk about how this doesn't quite all add up, but at least there is some evidence/basis for thinking it was NK. Where exactly is all the evidence for any of the things you listed above? Otherwise, at this point it's all just a conspiracy theory, one if it was even remotely true would be a high risk deception to pull off for both the government and Sony.

>Otherwise, at this point it's all just a conspiracy theory

You do realize that the "North Korea did it" story is also a conspiracy theory?

>one if it was even remotely true would be a high risk deception to pull off for both the government and Sony.

There's a veritable laundry list of times both have lied about more important issues than this and gotten away with it.

The FBI said North Korea did it. Doesn't that automatically remove it from the conspiracy theory category? I don't know what more authoritative source we can go to to decide what is or isn't officially in the running for explanations.

If we say that the FBI's position is part of the conspiracy, well then good luck ever leaving the conspiracy theory bin. You'll likely never get tangible information from another credible source. It'll just be a never-ending conspiracy theory.

> authoritative source

There was a time when I would assume good faith for most FBI/federal law enforcement statements. After Clapper and Snowden, that day has passed. I'll still believe an FBI statement with evidence. But without evidence it's just words, and very possibly with an agenda that's hostile to my Constitutional rights.

>The FBI said North Korea did it. Doesn't that automatically remove it from the conspiracy theory category?

Any theory about how it was done is automatically a conspiracy theory because it WAS a conspiracy. Using it as a pejorative in this context is stupid.

>I don't know what more authoritative source we can go to to decide

Most of the OPSEC community - who don't have a motive to lie to get more goodies out of Congress and whose story actually adds up.

My point was that if you examine the motives of all the parties involved, the FBI's story stinks as much as the CIA's did when they started screaming yellowcake. They have every reason to lie and the North Koreans have no reason to lie.

There's also the added bonus of timing, as the torture report seemed to only be gaining steam up until this.

Also, the concept of "cyber-terrorism" being a thing seemed kind of ubiquitous to me, but from what I've been hearing, it really wasn't on the minds of the populous until the 24 hour news networks started drumming it up in relation to the Sony hack.

> There's also the added bonus of timing, as the torture report seemed to only be gaining steam up until this.

I doubt it was that, if only because North Korea has been complaining about this movie since long before the CIA torture report was released (so it's not like "The Interview" just popped up into the media after that).

Moreover the report itself is more a catalyst for discussing something everyone knows about than an announcement of something novel. The world has known the U.S. was torturing people during Bush for more than a decade by now. That's the whole reason terms like "waterboarding" are in our lexicon. Likewise Obama publicly eliminated the use of torture on his second full day in office, after running on a public campaign of banning torture during his Presidential run.

Choosing to exchange a report that is only a 'source of heat and light' for a serious cyberhacking incident that demonstrates the weakness of U.S. options vs. North Korea isn't really an upside for the U.S. government as far as I can tell.

Extortion and blackmail from state actors is precisely the thing the U.S. government is supposed to protect U.S. persons and corporations from, so a U.S. admission that North Korea has managed to "reach out and touch Sony Pictures" is bad news for the U.S. government, not good news.

>Extortion and blackmail from state actors is precisely the thing the U.S. government is supposed to protect U.S. persons and corporations from, so a U.S. admission that North Korea has managed to "reach out and touch Sony Pictures" is bad news for the U.S. government, not good news.

The relevant actor in this case is not the whole US government acting on its own agenda, but departments of the federal government acting on theirs.

I already explained why it's great news for them - precisely because it engenders the same reaction that you just had. Good enough that they'd invent it even if it weren't true (just like yellowcake).

> the torture report seemed to only be gaining steam up until this.

This isn't remotely true. There was no 'gaining steam'. It was a topic for a week, and then it was always going to fall off the table. There was no need to distract from something that was already fading from the spotlight.

Does anyone here know of a single infosec professional who thinks DPRK committed the attacks?

Certainly the evidence as described and the way NK has presented indicates its a strong possibility.

If you act like a mad man (in terms of diplomacy) don't be surprised if people assume the worst.

What evidence? Do you mean the FBI press release?

As described in the press release id be minded to think that NK is a strong possibility.

This is quite a challenge you've set for us. You claim that there are no infosec professionals who think NK did it. Exclude, apparently, the FBI from the universe of infosec professionals. And then refuse to credit the description of the evidence provided by the FBI, literally the only organization likely to have direct access to the evidence.

I'm not saying that the FBI is totally trustworthy on this, but it's one thing to distrust them and quite another to accord no epistemic weight at all to their claims about the evidence. While they may have ulterior motives, they (and NK itself) are also the ones best positioned to tell us the truth, if they choose to do so. And while, again, one should not take it on faith that the FBI always tells the truth, I'd trust them over the NK propaganda apparatus any day of the week.

I made no such claim. I'm no expert in this regard, and my knowledge base should be understood here as a layman's.

I read the FBI report, and while I'm sure that there is plenty left out of the report, their diagnosis was based largely on first, structural and tactical similarities to other, earlier DPRK attacks, and second, North Korean IP addresses that were pinged by the malware. Both of these, to my layman's understanding, seem easily falsifiable.

All I stated is that within my own circles and based on the infosec figureheads I follow, that I have not seen a single individual who claims to have been convinced that this is indeed a DPRK attack. Because I'm obviously somewhat filter bubbles, I was asking for individuals whose opinion I could get which would help me expand my own filter bubble.

Dave Aitel has been raised as a counter example, and while he's certainly not unbiased, it's tough to find people in this field who are in fact unbiased, so I'm grateful to hear his opinion. I'd like to find more counter-opinions.

>If you act like a mad man (in terms of diplomacy)

In terms of diplomacy this is simply how they are presented by the western media to a largely credulous western audience.

If they were truly as irrational as they are presented the North Korean government would have stopped existing decades ago. Mad men are not good at self preservation.

Never mind being able to develop heavy industry, nukes and a minor space program all while under sanctions.

Does anyone know of a single infosec professional (who's talking) who has access to the details of the evidence the FBI summarized in claiming North Korean involvement?

Given this news, maybe the FBI was wrong. But the "professionals" in the doubt squad were mostly just guessing along with the rest of us.

Sure. Everyone is guessing. But is there anyone who is qualified to make guesses who is not in the "doubt squad"

One name. Seriously just one name.

...the FBI? Do they not employ quite a number of infosec professionals?

Of course they do.

And look, I really try not to shout conspiracy at everything.

But the FBI is relatively new to the Cybersecurity game. CNN yesterday was showing "MPAA cyberterrorism experts". The links to DPRK seem tenuous at best.

So in this context, when the organization who blackmailed Martin Luther King says something, I'm going to try to seek independent confirmation.

All the security professionals who I follow on the internet has either expressed doubts or outright disbelief that DPRK is culpable for this attack. Obviously, I'm in a bit of a bubble, so I'm trying to find independent people outside of my circle who agree with the FBI line.

The FBI has been in cybersecurity for a couple decades now.

Ah, that's absolutely true, and I should clarify:

My understanding of FBI cybersecurity is that until very recently, they were primarily responsible for domestic cybercrime.

Responding to "Cyberterrorism", to my knowledge, is something that has happened much more recently.

I, of course, am no expert in this regard, which is why I'm seeking out expert opinons! If you have more info I'd really appreciate having some more stuff I can take a look at.

"Cyberterrorism" existing happened rather recently. In terms of general cybercrime abroad, well, off the top of my head I can think of the Half-Life 2 leak in 2003... And in terms of general infosec chops in the present, the FBI have recently taken down two famous Tor hidden sites.

But of course, this is little more than circumstantial evidence regarding the case at hand.

Here's something you might want to consider. Bruce Schneier has said that North Korea probably isn't behind the hack (https://www.schneier.com/blog/archives/2014/12/comments_on_t...), but follow his link. He thought North Korea wasn't behind it, because the FBI said so.

His latest post simply points out that the FBI has said North Korea is responsible, without elaboration or contradiction. https://www.schneier.com/blog/archives/2014/12/lessons_from_... So while it does not appear that Schneier has reviewed any evidence (what evidence could he review?) and reached his own conclusion, he seems perfectly content to credit the FBI's conclusions.

While not the strongest argument (The absence of an argument is not an argument), I do appreciate you bringing up this nuance which I think is a valid one.

The FBI's assumption is absolutely newsworthy, and I'm glad Schneier reported it, even though he abdicated any judgement either way. You're correct in saying that he does not elaborate or contridict the FBI statement, but it should also be noted that neither does he endorse it. So I am moving Schneier from the "Having doubts" column over to the "ambivalent" column in my mental list.

Thanks for taking the time to provide more information.

Schneier is going back in the "Skeptic" category.

https://www.schneier.com/blog/archives/2014/12/did_north_kor...

https://twitter.com/thegrugq/status/546047647929229312

https://twitter.com/thegrugq/status/546409624891424768

Not that I think infosec professionals are very much more qualified to make guesses than the rest of us.

Yes Dave Aitel from Immunity Inc said it was DPRK from the very beginning when most infosec people thought otherwise. He was on a podcast talking about it yesterday:

https://threatpost.com/dave-aitel-on-the-sony-hack/109988

But he sells offensive security tools to goverments and corporations, so he is not without bias. Actually this might be more in support of the OPs comment regarding gov support rather than refuting infosec peoples stance.

Thank you!

I've been asking this question for 3 days and haven't been able to get any response.

As you said, there's a bit of a conflict of interest here, but you'd be hard pressed to find someone who isn't biased.

I do think this supports OPs comment.

Well, except its not as though anyone is believing NK is behind it because Sony says to. So what does it matter what Sony gains from people believing NK did it? Their credibility was never in question: when it comes to assigning blame for a cyberattack, Sony has none.

The FBI, of course, is another story. But the two reasons you give for them to claim NK involvement would work just as well if any other nation or non-state actor were behind it.

And you're just not thinking hard enough if you think NK has no reason to deny responsibility. Off the top of my head: maybe they would rather wriggle out of whatever "response" it is that the U.S. is cooking up, maybe they want to retain what credibility they can so NK can plausibly deny involvement in future attacks, maybe the fallout is also hurting their relations with China, etc.

I saw a "MPAA Cyberterrorism Expert" on CNN the other day. I think Sony and the MPAA have been doing quite a bit to get people to believe that DPRK was culpable. I saw Seth Green tweet a direct quote from a Sony Press Release yesterday.

This news has also sparked these revelations:

http://www.theverge.com/2014/12/12/7382287/project-goliath

So there are a lot of issues at play here, which is why I'm cautious to endorse any viewpoint without really good documentation.

I definitely think you're right in saying North Korea has enough reason to deny responsibility. Let's not forget that Al Qaeda didn't take responsibility for 9/11 until 3 or 4 years after the fact.

>Let's not forget that Al Qaeda didn't take responsibility for 9/11 until 3 or 4 years after the fact.

Actually, applying the same line of reasoning also brought me to the same conclusion about Al Qaeda.

When Osama initially denied involvement it rang true because he had no motive to deny it if he actually was behind it. He wasn't going to suddenly stop being no. 1 on the FBI's most wanted list. He already had two sizable terrorist attacks to his name.

Whereas... consider what Bush and Cheney would have done if they had found conclusive proof that Mohammed Atta was the sole mastermind of the operation.

"Sorry guys, we can't retaliate because the perpetrators are all dead"?

Heh.

>Their credibility was never in question: when it comes to assigning blame for a cyberattack, Sony has none.

As far as the public is concerned they do have some credibility. If for no other reason than they were the ones who were actually hacked.

>The FBI, of course, is another story. But the two reasons you give for them to claim NK involvement would work just as well if any other nation or non-state actor were behind it.

They would, but by spinning the NK involvement story they can count on Sony's cooperation. If they started contradicting Sony and arguing that it was China the whole thing would seem a lot less convincing. This is a joint effort.

>And you're just not thinking hard enough if you think NK has no reason to deny responsibility. Off the top of my head: maybe they would rather wriggle out of whatever "response" it is that the U.S. is cooking up

Ok so name a plausible response that would scare them. Invade? Uh, not happening. Economic sanctions? Already doing that. Talk shit about them at the UN? North Korea doesn't care.

>maybe they want to retain what credibility they can so NK can plausibly deny involvement in future attacks

Which:

A) Again they would gain nothing from. B) Also completely goes against their modus operandi - when they gain military advantage they always crow about it. Every time. Did they cover up Taepodong? Hell no. They issued a press release.

>maybe the fallout is also hurting their relations with China

Or the opposite, because China would almost certainly be happy to mine the hacks for any useful intel. It's not like they are besties with the US.

what I still really don't understand is that Sony is a Japanese company, why is the US government suddenly involved in this?

Surely if NK wanted to "cyber-attack" the US it wouldn't do it through a Japanese company. Or am I missing something?

Sony Pictures, is an American subsidiary of Sony. The headquarters and employees are all based in Los Angeles. These are American employees whose emails and social security numbers were leaked, American employees who received death threats, American movie theaters that were threatened with a "9/11 style" attack, and an American produced movie that has been suppressed. While perhaps the Japanese government should be involved as well, I think it's quite obvious why the US government would be involved.

so was the hack restricted to Sony Pictures only? Nothing else was hacked?

From everything I've read, yes, that is correct. Only Sony Pictures has been targeted, only their emails leaked, only those employees threatened, etc.

Also, you have to understand that Sony is a 140,000 employee organization, with many different operating units that are functionally probably pretty separate. The Sony Pictures network and email system was likely entirely separate from other Sony divisions, especially since one was based in Los Angeles, and others are probably based in Tokyo.

If it helps, Sony Pictures Entertainment is just the new name for Columbia Pictures after Sony bought it.

Reply on news.ycombinator.com