Attack Is Suspected as North Korean Internet Collapses
nytimes.com
nytimes.com
This outage won't hurt North Korea. At best it makes for a good head line to see the whole country offline. At worst this means that their elite citizens cannot access social networks or email outside of their country.
I really hope this isn't the doing's of the US government. You'd hope they could do better than this..
[1]: https://news.ycombinator.com/item?id=8777226
edit: I do not mean that what the person who created that website is a 14 year old as it is a very thorough analysis. Just that with this type of information on the internet it is probably pretty easy to construct a bunch of bots to take out the country's connections to the outside world.
Not going to go even more to war, then.
the only proof it has on North Korea’s involvement in the hacking, is “that the FBI said so,” apart from claims by the “Sony Pictures’ PR department.”
Sony was domiciled in Japan, specifically in Minato, Tokyo, Japan. And so it’s a Japanese multi-national corporation not an American one. And one would think that some sort of an offence by a state actor or anyone else against the Japanese corporation would be a concern for the Japanese government, and not the United States government,”
The North Korean government insisted on Saturday that it was not behind the hacking and proposed a joint investigation with the US to prove it had no involvement in the cyber attacks
outraged by the film showing the assassination of leader Kim Jong Un - also claimed to have 'clear evidence' that the U.S. government engineered the project as a 'propaganda' attack against North Korea.
the North Korean government is also convinced that directors Seth Rogen and Evan Goldberg were under direct instruction from U.S. officials, who told them to include extra scenes to 'insult the dignity' of North Korea
a group calling themselves the Guardians of Peace has claimed credit.
Guardians of Peace responded to the FBI with a message on Saturday, mocking their investigation and trolling them with a video that essentially called them idiots.
Goodness. It could be the same organization behind both. Instigation.
If you search for the MD5 hashes of the code you can find code snippets and incidents where such code was used in the past (hacking attempts at DHS, etc). Even though none of these were '0-days' or written by those with ties to NK, the attribution seems to be based on such code reuse.
[1] http://www.cbc.ca/news/world/uranium-shipped-to-montreal-fro... [2] http://www.nytimes.com/interactive/2014/10/14/world/middleea...
"Without exception, all of the allegations included within the September Dossier have been since proven to be false, as shown by the Iraq Survey Group."
"I've hired you to help me start a war! That's a prestigious line of work with a long and glorious tradition."
=)
If they are running Cisco up front I wonder it's possible their network was brought down by a zero-day exploit that only uncle sam knows about? (vs. a more mundate DDoS?)
Well not to put too fine a point on it... but if you are reliant on the Chinese... that's the same thing as not having blocks.
1. Give the world a visible sign of response.
2. Perhaps trick the DPRK into believing this was the USA et al.'s real move.
What the U.S. needs most from North Korea is information; they're not going to burn exploits and vulnerabilities for a simple DDOS. If anything, they want North Korea to be more online, where it's easier for the NSA to collect information.
[1] http://www.cnn.com/2014/12/22/world/asia/north-korea-us-sony...
"Yes, let's go out and get all the republicans (the unintentional irony of the GOP supporting the movie notwithstanding) to buy tickets to see this movie to show those foreigners that when terrorists try to scare us, we just buy a bunch of useless shit."
Perhaps one of the dumbest things I've heard in response to this situation yet.
Sorry - I know I'm fairly new as a commenter (long time listener, nearly-first time caller!), and my karma may take a nosedive for this one. I just couldn't hold this one inside.
http://www.inquisitr.com/1691688/anonymous-announces-vengean...
The whole thing smells like just another move to convince the non-believers into thinking NK was responsible for the Sony hack.
This looks like a small DoS against one router, as any random could do (and perhaps has done), but of course, .kp doesn't have much connection to the public internet, so that's about all it takes. And it isn't exactly a big impact on them as a country - yet it's still knocking a country off the internet.
I believe the attribution to DPRK is very probably false. I think the Sony hack was quite probably conducted by non-state actors, but there is far too little information to be sure. The US have unfortunately impeded honest forensic investigations.
And I believe that attacks on the internet, any part of it, are destructive and not constructive. The US would be extremely displeased if the same - cutting it off the internet - happened to it, so I dearly hope they are not stupid and short-sighted enough to be responsible! Whomever is behind this deserves condemnation.
Perhaps we need a treaty. Yet when a few determined individuals can do offensively essentially what a nation can, I'm not sure how that's possible. But focusing on offense will only make everything worse - the US probably has more to lose from so-called "cyber war" than any other nation on earth. It should be leading the charge against it. It isn't. And that's a huge mistake.
USG asked Beijing to shut down servers and routers used by North Korea that run through Chinese networks.
http://www.thedailybeast.com/articles/2014/12/20/sony-hacker...
Also, you seem to ignore the fact that many people posing as anonymous would take part in an action like that regardless of what they believe. Anonymous has always been more about "doing it for the lulz" than politics, even if the ones posing as "doing it for the politics" are overrepresented in the medias.
"Because Anonymous has no leadership, no action can be attributed to the membership as a whole. Parmy Olson and others have criticized media coverage that presents the group as well-organized or homogeneous." (http://en.wikipedia.org/wiki/Anonymous_%28group%29)
However, when you do something under the name "Anonymous" like the twitter account did, you are doing it as Anonymous, the "loosely defined group".
Otherwise why would you call yourself Anonymous?
I am Anonymous right now. I am legion.
Anonymous: the group of people who identify themselves as part of the group "Anonymous".
Really? Age has anything to do with this? "What's with black people and their complete inability..."
To the North Koreans, it is beyond comprehension that people living in the US made something, rather than the US government making it. To them, if Americans made it, that means America made it.
This misunderstanding isn't limited to works coming out of the US of course. Another example of this failure to comprehend freedom of expression is the aftermath of the Muhammad cartoons published by some Danish newspapers. Enraged extremists around the world began rioting in front of Danish Embassies, as though the cartoons were drawn, commissioned, or even approved by the Danish government.
See also: The souring of Chinese-Norwegian relations after the Norwegian Nobel Committee (which is a private organization which awards a private prize, despite having some members selected by Norwegian parliament) awarded the 2010 Nobel Peace Prize to Liu Xiaobo.
The Peace Prize is a bit closer to the Norwegian government than that. Alfred Nobel left that part of his will directly to the Norwegian Parliament, not to a private organization, and he tasked the Parliament with using the money to establish a peace prize. The Parliament established a committee, the Nobel Committee, to administer the award, and traditionally its members were a subset of standing members of Parliament, with the partisan makeup of the Nobel Committee reflecting each party's representation in Parliament.
In recent years they have instituted a rule that current parliamentarians can't sit on the committee, and instead retired parliamentarians are chosen, to given it slightly more distance. But they're still 100% selected by Parliament, and allocated to each party in proportion to party representation in the Parliament.
Nobel may not have set it up that way personally, but that is how it is currently set up.
Then again, there have been some eyebrow raising choices over the years.
For example, the current committee has the following members: Thorbjørn Jagland (Labour Party), Kaci Kullmann Five (Conservatives), Inger-Marie Ytterhorn (Progress Party), Berit Reiss-Andersen (Labour Party), Gunnar Stålsett (Centre Party).
A slightly different way of putting it might be: the Nobel Prize is awarded jointly by the major political parties of Norway, via their chosen representatives.
Ironically though, there are reports that this is exactly what happened: "U.S. government approved 'The Interview's' assassination scene, Sony emails allege" (http://www.dailydot.com/entertainment/sony-hack-emails-the-i...)
If North Korea suddenly became a US ally, though, it would happen eventually.
Hollywood has often been a front for US policymakers to covertly influence domestic opinion. You may be oblivious to this, but I doubt the North Koreans are.
The likelihood of Hollywood releasing a movie that praises the Nazis is virtually nil, but that has fuck-all to do with "blurred distinctions" between Hollywood and the US Government.
And yes, that was everything to do with the US government.
edit -
Propaganda [mass noun] Information, especially of a biased or misleading nature, used to promote a political cause or point of view.
Lots of films, many I particularly like, are propaganda films.
Pleading comedy or satire doesn't prevent something being propaganda, and featuring the slow-motion fiery death of the leader of a country that you have bombed and not yet made peace with, I think qualifies.
God knows this isn't the first time North Korea has been the butt of jokes, but it is the first time it was done so publicly, on such a large scale, directly out of hollywood, that the entire world then consumes. To not respond would appear weak, I think.
But in any case, what's the point of keeping the U.S. government's action or non-action secret?
As the linked piece states:
"If the attack was American in origin — something the United States would probably never acknowledge ..."
It's sort of like the Doomsday Machine in Dr. Strangelove: it just doesn't work as a deterrent if you keep it a secret.
Or is all this secret "cyberwarfare" capability that the U.S. government is secretly building only going to be used in secret?
If this is not the US, then the cybersecurity apparatus of the US and other nations must surely provide more information about which entity has the power to take down an entire country's internet (even if, admittely, this is a small country that is easy to take down?). We need to know either that this is an explicit retaliatory attack (in which case, who is deciding the legitimacy and proportion of this retaliation), or if not, we need to know very clearly that our cybersecurity apparatus is aware of who did it, and if not, what are they doing to become aware of such issues in the future (with guarantees of public disclosure when this is not incompatible with national security).
Basically, we cannot have a situation where signficant swathes of the internet can be taken down with nobody knowing what's going on, and what the principles are behind any decisions made. That would be a basic affront to freedom.
Nebulous, intangible entities with the power to perpetrate or retaliate with no accountability, are extremely dangerous.
I see a significant dearth of information here, information that is in the public interest whoever is behind it.
Maybe my English needs work. Could someone with superior English skills to mine, please decipher the article and tell me:
Is there any actual evidence of an attack? Has traffic spiked through/from NK?
Or could this be them "pulling the plug"?
Because the first case is: "Someone attacked NK Internet and brought it down", while the second "NK Internet IPs were \"withdrawn\" from the net".
It is not the style of DPNK for them to pull the plug, that would make them appear weak to the outside world when in fact they did invent the internet and have superior everything on everything.
You misunderstand. They broke backwards compatibility with our puny Internet v1. It's progress, baby ;)
Based on the quote[2], I interpret the failure as someone attacking the routers themselves, overwhelming their control planes to the point where they can't sustain BGP sessions reliably.
[1] No post from them yet, would expect it to be at http://research.dyn.com/2014/12/ if/when they do the full write-up.
[2] "Their networks are under duress,” Mr. Madory said. “This is consistent with a DDoS attack on their routers,” he said, referring to a distributed denial of service attack, in which attackers flood a network with traffic until it collapses under the load."
If that is a verbatim quote, then Dyn is telling is that there was an attack (duress involved, no ifs buts or maybes).
If that quote has been altered even slightly[1], we're back to "NK won't pick up the phone no more"[2].
[1] Any of these would remove the "attack" edge of this:
Their networks...
* seem to be under duress
* (seem to be/are) down/nonresponsive
[2] but we don't know if someone blew up the switchboard, or if they switched it off themselves.
Agreed, but I would think a DDOS would be observable from the neighbouring (and even not-so-neighbouring) networks/systems.
Reporting an attack based on Dyn saying "under duress/consistent with DDOS" is just shitty, shitty journalism.
> Who caused this, and how? A long pattern of up-and-down connectivity, followed by a total outage, seems consistent with a fragile network under external attack. But it’s also consistent with more common causes, such as power problems. Point causes such as breaks in fiberoptic cables, or deliberate upstream provider disconnections, seem less likely because they don’t generate prolonged instability before a total failure. We can only guess. The data themselves don’t speak to motivations, or distinguish human factors from physical infrastructure problems. [1]
...it turns out that the DDOS part was indeed pure conjecture and over-hyped BS. Thanks, NY times.
Also, they changed the title of the article, if not more. Classy.
[1] http://research.dyn.com/2014/12/who-disconnected-north-korea...
But if the outage was from a DDoS from the USG, then I have to regard it as mostly a publicity stunt: That is, I have to believe that the NSA and CIA have much better control over, penetration of, NK computing than just a DDoS!
I mean, NK has, what, bootleg, never updated copies of Win 95, Win 2K, Win XP SP0, really old IE with lots of ActiveX pages, really old FF and Flash? The place has to be a computer version of a fire trap without a firewall! NSA and CIA rootkits have to be tripping over each other all over NK like rats in a garbage pile.
Oh, did someone compare NK with a garbage pile? Oh, how pejorative! I mean, how could one regard that pinnacle of fashion that gave the world the unique haircut of the Great Patriotic Leader, Jr.?
Besides, their girls nearly all look so young, that is, small and thin, possibly because nearly everyone there is thin. Maybe they get a lot of exercise, aren't very warm in the winters, and don't eat very much, or all of those.
"Sure a content filter makes sense, there's a war going on."
He also seemed to believe that the fault for any censorship as a result of the hack lies squarely within the US.
Yeah, I'm not sure. But I can tell you I don't know a person alive or an institution operating today for which I could tell you how I would react to information they gave me without being fully seeped in the context in which it was given.
Also, I don't know anything about what the FBI did or didn't say. I just know what was released(yeah :|) on what Obama said, which was that he would have liked for Sony or the Movie chains to have reached out.
Ultimately, I think it's a societal issue. Our culture has become terrorized since 9/11. We are a bunch of wet blankets. It's a huge problem that we have no spine outside the military/intelligence community. We just get led around by the nose.
This might be the first steps of the first cyber world war for all I know.
The only good thing is that only the elite will be affected by the collapse of NK Internet (no porn for a while). The average citizen probably can't even grasp what the net is, and none of her life is linked to it.
And for them it's more a matter of pride than real damage done to their country.
I wouldn't be surprised if they announced that they will start to make some new missile test soon.
Maybe the whole point is to instigate an escalation from "alleged vandalism" to "verifiable act of war".
My interpretation of the general history of warfare is that countries agree on restraint once some situation has occurred that all sides agree should never happen again. Mustard gas in WWI, nuclear weapons in WWII...
Hopefully this doesn't spiral out of control. It's not clear where the boundaries are that we don't want to cross.
Which is pretty much exactly why it won't happen.
If there's one thing the Sony breach and other major hacks over the last few years have illustrated, it's that there is no clear limit to the damage that can be done from something like this.
EDIT: To me, what's so frightening about this is the lack of historical precedent for conflicts between nations in the form of cyberwarfare. We don't know what could happen. We don't know if the damage will be limited to financial cost and embarrassment, and we don't know that a scuffle between nations on the Internet will remain contained as such.
In short, critical infrastructure all over the world is being needlessly put at risk. The operators are placing their own knives across their own throats, and all a network-based attacker would need to do is jog a few elbows.
A few people might die. It's not like anybody is putting kill-bots out there, connected to the Internet, with an easily-toggled BERSERK_RAMPAGE flag (yet), but I think water treatment plants and electrical power grids are probably vulnerable to attack, and could cause some folks at the margins to die.
People would definitely die.
In other words, whatever we would be capable of accomplishing with pen and ink on paper, and carrier pigeons, or smoke signals; that's what the internet does, but at nearly the speed of light, for volumes of data beyond anything worth attempting as a physical implementation.
In that sense, the only thing that denial of service really accomplishes for a hermit state like North Korea (which presumably attempts to censor the external internet for it's non-elite commoners already), is such that they lose face on "the world stage" where they receive no respect anyway.
The boundaries where things start to get ugly, in a new and truly modern sense, would be circumstances where autonomous weapons platforms run rampant, and inflict wide-spread death and destruction in various theaters of conflict at scales of their own choosing. I don't think that's a reality yet, at least not without a nuclear exchange. Drones, for the most part, are still essentially remote-controlled vehicles, operated by humans, particularly with respect to the decision to use force.
A scaled back version of that, which we might see emerge, before autonomous robots are used to crush a nation like it were a load of dirty laundry (or rather, before robots start to decide for themselves, which nations, or regions to crush), is infrastructure attacks that cripple things like electric and water services for extended periods, triggering cascades of famine and disease. For that to occur, a country would have to foolishly place all of its eggs in one basket, and lay prone to catastrophic failure without proper redundancies in place.
As others have pointed out, it's unclear that the US government is itself involved. Neither the attacks on Sony and the attacks on the North Korean internet links require uniquely state-owned military resources. They just require a relatively accessible set of knowledge, skills, and practical tools. We even get the term "script kiddies" from the long-running case of those with knowledge and skills creating tools that encapsulate same.
So what happens in a world where "warfare" level activities, causing significant disruption to nations and multinational corporations, are accessible to essentially random individuals? In the U.S. we might liken it to our mythology: the lawlessness of the Wild West. Yet it seems that lawlessness with this kind of ease-to-impact ratio is unprecedented.
It's been spiraling out of control for years.
I'm actually quite surprised at how restrained our government has been to actually engage some of these rogue countries after decades of ongoing attacks.
At some point, you have to return fire.
And yes, I'm quite aware the US has been active in several high profile attacks. Unfortunately, it pales in comparison to what China, DPRK, and several middle eastern countries have been engaged in for much longer.
They invaded the country, and got their asses handed to them by the Chinese. The geopolitical situation is, invade NK, fight the red army.
If NK nuked Seoul, in all honesty China would probably nuke Pyongyang long before the Americans, or just send eleventy million troops across the border.
The entire reason NK exists is because China prefers a border with NK rather than a unified Korea sympathetic to US interests.
What if this all turns out to be some trolling by some third party, maybe even not government affiliated.
There is no actual released evidence, only statements from government agencies. The information that has been released says that some of the attacks did originate from servers hosted by NK IP space. That's it.
NK itself says that they didn't do it, and that doesn't match their previous threatening behavior.
I think there is a lot going on and we don't know anything about it. I'm not sure if this for national security reasons or because we would be outraged beyond belief....
You said it. You know, NK claims that the movie was USG propaganda. And, to the average American ear, that notion probably sounds completely nuts on its face.
But, then, there's this that we learned just a couple of weeks ago:
http://foreignpolicy.com/2014/12/11/why-usaid-got-into-bed-w...
Not only do we not know everything that goes on, but it's becoming increasingly difficult to separate ridiculousness from truth.
As it should. There's no need for propaganda against the PDRK, they've done a pretty good job of making themselves look bad on their own.
One would certainly think so.
Still, the notion that the USG would even consider involving itself in such a movie for propaganda purposes is about as ridiculous-sounding as infiltrating the Cuban rap scene to do the same.
If not, it might be fun to create some software or a mobile app that would keep this going indefinitely. I imagine a "CrashNK" app would get alot of downloads.
If true, the backlash could be significant. There's already large portions of the world trying to de-centralize the internet from the US (routing around, etc) after the Snowden leaks and discoveries of egregious abuses of power over the internet by the US government. No single country should have the capability (or right) to knock an entire other country off the internet, North Korea or not...
We take down governments in our sleep and replace them with our own puppets.
Except for the fact that the Chinese protect that particular government, and that makes thing a lot stickier.
It seems to be quite the opposite actually:
> Any civilized world will oppose hacker attacks or terror threats. But a movie like ‘The Interview,’ which makes fun of the leader of an enemy of the U.S., is nothing to be proud of for Hollywood and U.S. society,” an editorial in the newspaper said. “No matter how the U.S. society looks at North Korea and Kim Jong-un, Kim is still the leader of the country. The vicious mocking of Kim is only a result of senseless cultural arrogance.[1]
[1] http://www.ibtimes.com/sony-hack-triggers-diplomatic-tightwa...
China's general attitude over the last decade or two has been a gradually increasing private irritation with NK's behavior and while China still tends to defend NK in public, these defenses seem more and more perfunctory as time goes on. There's a sense that while they value NK as a communist buffer state, the Chinese government has little love for the NK regime in particular, and wishes they'd get their act together.
We could consider an analogy: would Sony run afoul of US (or international) law if they knocked North Korea offline by launching highly-targetted ballistic missiles from their US offices?
My gut feeling is yes, that's illegal. If not, then the US is even more self-righteous than it appears!
That isn't remotely close to an analogy. Mere possession of explosive devices, or even the materials to make them, is a crime in the US. However, it isn't clear if attacking a remote network is a crime under US law. Normally it would be up to the victim country to prosecute and request extradition, but there would be no extradition from the US or any other country (except perhaps from China, one of NK's few allies) in this case.
Protected system: "including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States"
I think taking down NK internet would be considered affecting foreign commerce/communication.
If so, would there be anything under the U.S. Code or otherwise that would supersede the CFAA; or are there exclusions in the CFAA itself?
Criminal law, except from a political standpoint, does not constrain the policy of the executive branch.
If so, we're effectively saying the same thing, with the exception that I do believe individuals are, and know themselves to be, technically liable for criminal conduct. As such, I believe that individuals and groups working within the USG (Executive or otherwise) do seek legal cover for their actions.
So, rather than haggling with dragownwriter over that bit, I went on to point out that I don't believe the USG would be constrained by it for different reasons than the outright impunity he suggested; that is, that they would find legal justification for it.
But, I do see that I may have misconstrued your comment by over-focus on the USG involvement bit. My bad.
I don't think that's really different; finding the legal justification to cite for it is responding to the political constraint (it also is a means of invoking the impunity, because reliance on such a legal justification provided by superiors within the executive branch itself creates a colorable legal defense against future prosecution without requiring an explicit pardon, even if the justification itself is flawed. This has been identified by many experts as one of the problems with actually prosecuting the people directly involved in torture in the US criminal justice system.)
The CFAA is so vague. It almost always is interpreted in a manner supportive of the USG's prosecution, go figure.
http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf
(I was going to quote some parts of this, but there are too many... giant wall of text.)
Edit: This is also useful: http://www.fas.org/sgp/crs/misc/97-1025.pdf
And I'll quote this part (which is from a case cited in the footnotes):
A computer that accesses the Internet is a computer used in interstate or foreign commerce.
So there's your answer
http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
here's a list of us cybercrime laws: http://en.wikipedia.org/wiki/International_cybercrime#U.S.
Look at what happened to Sony (even if NK may had nothing to do with it) and imagine what would happen if NK decided to shut down several US companies 'Sony style'.
The financial damage would be tremendous for the economy.
IMO cyber war is a bit like nuclear war : the goal is not to use it, or life can become really complicated really fast.
If the Pirate Bay was still online, would 'The Interview' have leaked already?
Is the seizure of The Pirate Bay linked to the intentional suppression of the release of this film?
Why would the government raiding TPB concede to do this for terrorists?
I mean, I hate to be one of those conspiracy nuts, but - it really seems like this is all a big distraction for the start of some new strange form of cyberterrorism.
No, the Pirate Bay is largest and most visible torrent sharing site, but by no means the only one. If anyone wanted to leak Interview there are plenty of options.
Also, TPB is far from the only torrent indexing site.