North Korea Hacking Shows Kim Jong Un’s Global Reach

In their press release, the FBI only cited evidence that was already previously to the public. http://www.fbi.gov/news/pressrel/press-releases/update-on-so...

"As a result of our investigation, and in close collaboration with other U.S. government departments and agencies, the FBI now has enough information to conclude that the North Korean government is responsible for these actions. While the need to protect sensitive sources and methods precludes us from sharing all of this information, our conclusion is based, in part, on the following:

* Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks. * The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack. * Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea."

As you will note, all of these are circumstantial and none is conclusive. Hackers can reuse malware developed by others, and it is possible to fake identifying information to make it appear as if it is the work of North Koreans.

Many security experts are not convinced just from the publicly available information, but the feeling is that the conclusion must be based on unreleased info, perhaps human or signals intelligence.

So at this point, for Americans at least, it's based on how much you trust your government to tell the truth. It's telling to see the amount of scepticism here. I'm South Korean, and we may be more willing to blame North Koreans not because we have access to conclusive evidence but because we have been following related news more here. While the international audience seems surprised that such a supposedly technically backward country could be behind the hacking, South Korea has already experienced a couple of major attacks that were blamed on North Korean hacking units, later described by defectors who allegedly worked in such a unit based in China. We also have been reading about how unhappy North Korea was about The Interview long before the hacking. Again, this is all circumstantial evidence, but it makes it easier for us to accept the FBI's conclusion.

In the end, what you choose to believe is based on your worldview.

Never underestimate the usefulness of plausible deniability, one of the main advantages of cyber warfare. It doesn't even have to be cyber warfare. North Korea still denies that it was behind the 2010 sinking of the Cheonan, a South Korean naval vessel. Conspiracy theorists still dispute the conclusion of an international inquiry that North Korean torpedoes were to blame. It's quite useful from the North Korean regime's point of view to sow that seed of doubt in the mind of the international audience and to encourage mistrust of official narratives.