The Case for N. Korea’s Role in Sony Hack

The script-kiddie nature of the attack doesn't seem like a good argument against DPRK attribution. Only a select few are even allowed on the internet in that technological backwater, so I wouldn't expect mind-blowing 0-days.

Why do you think that about information you aren't privy to?

To start with, film is something of a national treasure in NK. Official documents show KJI as being connected with the production of over 11,000 films. That is almost certainly an exaggeration, but enough of his stuff has leaked that you can take a class on it at a film school, so it's not a 'whole-cloth' invention. NK has taken bizarre steps to secure its film heritage, including organized abduction of actors and directors from foreign countries to bolster the regime's cast list.

Meanwhile, the personality cult is strong, in a way not seen even under Stalin. For example, the whole country stopped and celebrated [0] because a random citizen put out a fire near a portrait of one of the leaders. You'll find Western media outlets speculating that of course what really happened is she thwarted an assassination attempt, because the truth is absurd to Western sensibilities.

These two things combine to form a powerful motive. The last time a film depicted a NK leader, they made serious efforts to have it banned in their allied countries, although they were not at all successful. Meanwhile, successfully hacking a US company is of major propaganda value for the regime. The two targets that they have "hacked"--SK and US--are the ones they complain most loudly about internationally. So launching some kind of attack would be very consistent with their political rhetoric.

Since that time, they've developed a much more sophisticated hacking ring. There was a time when they relaxed some of the normal rules so that you could outsource your software projects to NK software developers, and, from what I understand, some large companies did. That was one of the ways they built skills. While they're pretty incompetent by nation-state standards, they seem to have improved a lot in recent years, and of course they're better-funded and better-organized than any common criminal hacking ring. It would be completely within NK's wheelhouse to devote 10% of GDP to this project even while their people starve.

Meanwhile, of course, Sony has a very poor track record on security--between the rootkits, GeoHot, Linux, etc., I don't know a lot of qualified security researchers who would feel good about working there. This has created a bit of a security vacuum and of course they have been hit by common criminals, several times in the last few years. So it's very believable that hitting them is within NK's reach.

Finally, as far as nation-states having an extortion motive again that is very much within NK's wheelhouse. They are a poor country and they are engaged in all kinds of bizarre plots to raise money. Notably, they built up a counterfeiting ring for US currency so sophisticated that we ended up redesigning the bills [1]. NK also runs sort of an industrialized Breaking Bad operation, to the extent that a lot of the country is hooked on their own product [2]. Their MO at this point is very definitely to take common criminal operations and scale them up under the cloak of a nation-state to drive revenue. It's not a leap to electronic extortion. They're basically a super-mafia at this point, and this is a new department.

As far as their being no "DNA, smoking-gun" evidence--that's true. But I think the circumstantial identifying evidence, combined with motive, means, and opportunity, is pretty compelling. The communications from GOP are as bizarre and convoluted as anything the NK regime says, and not what you'd expect from a simple criminal enterprise. If it's not NK, it remains to be explained why the hackers went to some lengths to fool real security analysts at an actually first-class nation-state, but did so in such a bizarre and haphazard way as to target an especially weak US company that does not demonstrate any particular skill beyond what others have done before. That level of convolution demands a geopolitical explanation of some type that goes beyond simple extortion, but it's much more elaborate to explain who would want the US angrier at NK than we already are, and how these shadowy figures would benefit.

Finally, as far as the "inside job" theory--it is completely believable to me that NK would be willing to throw a few tens of thousands of dollars in bribes to get inside. They spent much more than that celebrating putting out the poster-fire. So that idea that Sony had angry employees to me actually strengthens the case for an NK-based theory, as it provides a simple and cheap way for them to get inside.

[0] http://newfocusintl.com/exclusive-why-north-korea-handed-a-b...

[1] https://en.wikipedia.org/wiki/Superdollar

[2] http://www.vice.com/read/north-korea-crystal-meth-drugs-dipl...

And a key similarity between the two, according to the article, is the graphics left behind by the hackers: lime-green type on black background, with pictures of skulls. In other words, similar to a ton of hacker sites.

A smokin' JPG is not a smoking gun.

jwz called from 1999, he wants his color scheme back.

There's no smoking gun revealed publicly, but the preponderance of available evidence points to the DPRK.

The only possibility that I see of DPRK involvement is that they initiated the hacking through the third party and that third party did a way better job than they expected.