More Data on Attributing the Sony Attack
schneier.com
schneier.com
I would like to point out that any skilled unix developer can create a script in about an hour that can make any set of files appear to have been transferred using USB2.
This isn't really news at all, and I'm kind of surprised Schneier thought it was worthwhile enough to publish it. Look at how incredibly sensationalistic this article is, which Schneier cites as the primary source: http://www.4thmedia.org/2014/12/breaking-we-can-conclusively...
"BREAKING: We Can Conclusively Confirm North Korea Was NOT BEHIND Sony Hack", seriously?
I understand he just wanted to aggregate all the updates and commentary since his last post, but this is practically nothing and is just about bordering on FUD (I'd say "reverse-FUD" but that's not how it works, just like "reverse-racism" doesn't exist).
So far, no 3rd party has provided any strong evidence showing that North Korea either was or wasn't involved.
I messed up once and set the date/times into the future by a bit and got a bug filed against my project when someone tried to merge my software into a mainline linux distro and had problems with the future date/times.
I don't know how many people have used this information for malicious purposes, but I can guarantee that I always think about it in any hacks I've been involved in.
Do note that file creation time in unix requires kernel level access and quite a bit of low level filesystem knowledge to truly forge. The easily changeable date/time is only access and modify times. If you are going to forge this data to remove tracks from real systems you will need to root the machine completely first. It's nontrivial.
I think the easiest method would be to simply generate a bunch of files, do copies, and compare the datetime stamps with the theoretical values they should have. Once you can model the discrepancies generated in real life you can fake them.
You do make a good point that it isn't really mentioned in cybercrime books that I know of, but it seems like an obvious thing. Would be a fun chunk of code to publish on github; I'll look into it.
It is one of those things that appears obvious after you've been walked through it though. I've never been in a position where I needed to fake transfer speed though, so I'm not sure if I'd have thought about it. If it actually is an attempt to fake an insider attack, it is an impressive trick.
Try copying 100gb of 2k-200k files ( all randomly sized ) It's a huge pain in the butt and works terribly on every system I've tried to do this on.
It would be way more awesome to have a utility that can after the fact forge a scenario directly into an existing tarball. Then, you can simply pick a "model to emulate" and click go, and wham you have a forged tarball.
Even if you did use a VM, it would be slower imo than a real transfer due to both the emulated system and the usb passthrough ( which is typically limited to USB 2.0 ) Show me a VM that is capable of USB 3.0 passthrough with reasonable speeds.
Unless you truly forge the dates in a carefully modeled way, it would be possible to tell that it isn't a real transfer.
Speaking of which; who steals data using USB 2.0? That's dumb. Use a modern USB 3.0 external 2.5" SSD. If you must use something small, use a cheapo 256gb USB 3.0 drive. The throughput on those is not bad. If no USB 3.0 ports are available, bring your own PCI Ex USB 3.0 card and open the system and install it. The BIOS may have intrusion detection... so be aware...
It is much more likely than direct system transfer that data is leaked slowly through an un-monitored network channel ( DNS tunneling... email... etc ) Hence the need to make things appear to be local; to distract from looking for the real method of transfer.
USB 3.0 shouldn't be a problem for VMs, just grant the guest PCI passthrough access to the USB controller. So you'd have to use something like Xen instead of Virtualbox.
My workstation doesn't have USB 3.0, so if I were to steal company data - it would be at USB 2.0 speed. Also, if I were already inside - I'd much rather do that than trying to be clever about getting it out over the network (which would be much slower and more likely to be logged).
Timestamps are a mess on unix. POSIX doesn't support creation time but instead has ctime (change time). Newer filesystems add crtime but common utilities don't ever display crtime. Also partitions sometimes are mounted to not update atime for performance reasons.
crtime (and ctime) can be modified with root privileges without kernel access with debugfs.
Or you can go the ugly hackish way: date -s $forgedate && touch tmp && date -s $realdate && cat original >> tmp && mv tmp original
Neither are elegant, but certainly not hard.
What's really hard to forensically cover up is the order of inodes on a filesystem. That file with forged timestamps to 2012 will still have an inode that looks much more recent.
http://balyozdavasivegercekler.com/2012/10/04/dani-rodrik-di...
These featured files presented as dated 2003 even though internal evidence (including references to software and fonts) showed that they could only have been created much later.
Also, you can likely detect what OS was used ( well Linux or Windows ) due to differences in copy order as well as speed.
In theory such analysis can be done on the Sony data and tell us something more interesting than is known so far.
I don't think there are any existing tools that analyze date stamps and determine anything quite on this level... Purely because it is rare to have such a huge such of files.
[1] my comment when this "source" was posted to HN (before it was flagged for removal): https://news.ycombinator.com/item?id=8789341
Yes, I know that Chuck Johnson (http://gawker.com/what-is-chuck-johnson-and-why-the-web-s-wo...) is unreliable and worse. But in this case, I thought the data sound enough to republish.
After reading that article.. why would he believe anything from this guy?
The point I meant to get at was that the timecode analysis which was featured is not just claimed by Charles Johnson, but rather is in the torrents released by GOP.
I don't have any problem with Schneier referencing this article.
The way I see it, they're bending over backwards for the sake of profit and consumerism, as that boat is currently sinking.
I get that you're skeptical of the U.S. government. For good reason. But nobody needs to be trained to dislike NK (except, perhaps, North Koreans). Is your implication that NK isn't really so bad, and it's only a brainwashed reflex to think that it is? I, personally, really wish that were the case, for the sake of everyone who lives in NK. But it isn't.
There are things much worse than the U.S. government.
http://www.hrw.org/world-report/2014/country-chapters/north-...
Edit: You might also want to reflect on why it is that you're so willing to doubt NK's responsibility for the attack on Sony, but apparently pretty eager to believe that the U.S. is behind the attack on NK. Is the evidence for the latter claim somehow stronger than the evidence for the former? I would have thought the opposite was true.
When, for example, have we done this?
> The government practices collective punishment, sending to forced labor camps not only the offender but also their parents, spouse, children, and even grandchildren. These camps are notorious for horrific living conditions and abuse, including induced starvation, little or no medical care, lack of proper housing and clothes, continuous mistreatment and torture by guards, and executions. Forced labor at the kwan-li-so often involves difficult physical labor such as mining, logging, and agricultural work, all done with rudimentary tools in often dangerous and harsh conditions. Death rates in these camps are reportedly extremely high.
Or this?
> All media and publications are state controlled, and unauthorized access to non-state radio or TV broadcasts is punished. North Koreans are punished if found with mobile media such as DVDs or computer ‘flash drives’ containing unauthorized TV programs, such as South Korean drama and entertainment shows.
Or this?
> North Korea criminalizes leaving the country without state permission.
Or this?
> people arrested in North Korea are routinely tortured by officials seeking confessions, bribes, and obedience. Common forms of torture include sleep deprivation, beatings with iron rods or sticks, kicking and slapping, and enforced sitting or standing for hours. Guards also sexually abuse female detainees.
(Yes, I realize we have done some of these things to CIA detainees overseas, which is truly terrible. But we're talking here about all arrest in NK.)
Or this?
> Forced labor is essentially the norm in the country, and workers are systematically denied freedom of association and the right to organize and collectively bargain.
First, what evidence? Second, the USG has demonstrated the fact that it cannot be trusted to tell the truth. That has been the funniest thing about the whole Snowden story, the cycle of lies and spin when the lie is exposed by an additional leak the following day. Third, Obama publicly threatened retaliation - so a hasty cyberattack by the USG isn't far fetched at all.
I know that NK is bad, but I also know that there are worse places, worse places even right on our door step and even within our own house that really demand and should be getting far more attention than some hermit kingdom that is rather inconsequential on a practical level.
I am "so quick" to doubt that NK has anything to do with it not based on some irrational assumption, but rather that the whole damn thing sounded and felt rather fishy from the get-go and there has just been more and more support and substantiated doubts that it was a NK originated attack.
So Schneier is repeating GotNews' (Charles C. Johnson) accusation that this fellow is connected to a serious set of crimes. All on the basis that a portion of these crimes appear to have happened on the same day the alleged conspirator resigned from his job.
Pretty outrageous behavior. Especially since the FBI has has identified NK as responsible. It's worth noting that the FBI had access to _ALL_ the available data and has presumably investigated any employees known to have left recently on bad terms (i.e. the FBI did a professional job of investigation).
All the bullshit speculation as to why the FBI is wrong has been based solely on crumbs of publicly available data/information. The underlying premise is that the FBI is utterly incompetent and unable to investigate a crime of this nature. That doesn't pass Occam's Razor let alone any kind of smell test.
Really? So North Korea launching a cyber attack in order to prevent the release of a stupid movie seems like a plausible story to you? Of course the story is a moving target, as they are now hedging with the whole foreign contracted hacker angle... Do you think they conducted a "professional job of investigation" before blaming North Korea? Do you think that they'd change their position on the matter even after discovering evidence that they were wrong? Keep in mind, Obama quickly restated their claims and threatened retaliation.
No, there's lots of different things that could be happening. The FBI could have said it was North Korea to save face. As @thegrugq (who, by the way, is one of three security researchers who I can find who believes it was North Korea) suggests, the NSA could have investigated, discovered the culprit was DPRK, and then just informed the FBI. The FBI could also be incompetent.
But lets bear in mind that this is the same organization that blackmailed MLK and told him to kill himself, launched the COINTELPRO program, started fires at Waco, spied on Elvis Presley, Frank Sinatra, John Denver, John Lennon, Jane Fonda, Groucho Marx, Charlie Chaplin, MC5, Lou Costello, Sonny Bono, Bob Dylan, Michael Jackson, and Mickey Mantle, and three years ago used a chainsaw to break into a house before realizing that it was the wrong house.
So you'll forgive me if I'm skeptical of the organization's claims.
PS. If you have any other 3rd party security researchers who believe the FBI's claims, I'd be happy to add them to my list.
Criminal investigations are tough enough, but when you are trying to catch somebody who is intelligent and doesn't want to be caught - it is pretty close to impossible. Couple that with political pressure and you get the present state, where it is much easier either create a boogieman (giving phony detonators to unstable people) or just piling more blame on those that can't defend themselves (dead men, hermit kingdoms).
Also, I'm surprised that the Secret Service isn't mentioned in all this - they've traditionally been much better equipped to handle computer related crime. This is an area that the FBI has always really sucked at.
There's no question that the U.S. and allies are heavily invested in surveilling and analyzing everything that the North Korean government does, so they would have a lot of opportunity to collect such data. And if they did, it's not likely that they would publish one bit of it.
I think the firmness of the U.S. statement that it was North Korea, combined with the waffling on the execution details (maybe they outsourced some of the hacking, maybe not) points pretty clearly to out-of-band data. They would know who to blame, but not necessarily every detail of how the attack was conducted.
For everyone else out here in non-classified land, trying to analyze the attack using only the data that the attackers themselves leaked is going to be tough, because the attackers have total control about what data we see. They can redact and obfuscate to their hearts' content before releasing it.
That said, there can be no denying that Sony turned lemons into lemonade, and milked this attack for all the awareness it could possibly get.
I saw "MPAA cyberterrorism experts" on CNN, I saw CNN commentators say that in the interest of free speech, it was every American's patriotic duty to see this film.
This was happening in the context of Project Goliath, and threatened legal action against twitter and individual users for posting the leaks.