The FBI says it has conclusively tied North Korea to the massive hack of Sony Pictures. US authorities have been investigating the leak since the beginning of December and had previously stated in public they had been unable to establish a link between North Korea and its notorious Bureau 121 hacking unit. North Korea has denied involvement with the hack, carried out by a group calling itself Guardians of Peace (GOP). The group has released a slew of highly embarrassing data from Sony, demanding Sony pull the release of The Interview, a comedy starring Seth Rogen and James Franco, which depicts the assassination of North Korean leader Kim Jong-un.
In a statement released on Friday, the FBI said technical analysis of the malignant software, known as malware, used in the attack had been linked to other malware “that the FBI knows North Korean actors previously developed.” The FBI said there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks. The FBI also said that the infrastructure used in the Sony attack was similar to other malicious cyber activity aimed at the US that had previously been linked directly to North Korea. For example, the FBI discovered several internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack.
The tools used in the Sony attack also had similarities to a cyber attack in March 2013 aimed at South Korean banks and media outlets, which North Korea carried out. “We are deeply concerned about the destructive nature of this attack on a private sector entity and the ordinary citizens who worked there. Further, North Korea’s attack on SPE [Sony Pictures Entertainment] reaffirms that cyber threats pose one of the gravest national security dangers to the United States,” the FBI said in a statement.
“North Korea’s actions were intended to inflict significant harm on a US business and suppress the right of American citizens to express themselves. Such acts of intimidation fall outside the bounds of acceptable state behavior. The FBI takes seriously any attempt – whether through cyber-enabled means, threats of violence, or otherwise – to undermine our citizens’ economic and social prosperity.”
READ MORE :
- 10 Health Problems Caused by Computer Use and How to Win Them
- Hackers who targeted Sony invoked 9/11 attacks in warning to moviegoers
- iPad 3: the tablet that will give mobile operators a headache
- A Day at ‘the Gulag’: what it’s Like to Work at Sports Direct’s Warehouse
- Dubai’s LifeLine to Recovery – Sports City
As Secretary of Homeland Security Jeh Johnson said, pressure for action mounted: “The cyberattack against Sony Pictures Entertainment was not just an attack against a company and its employees. It also attacked our freedom of expression and way of life.” GOP reportedly sent Sony executives a message on Thursday evening, calling the studio’s Wednesday decision to cancel the release of the controversial film The Interview “very wise.” The statement was written in broken English and leaked to CNN. It continued: “Now we want you never let the movie released, distributed or circulated in any form of, for instance, DVD or piracy.
“And we want everything related to the movie, including its trailers, as well as its full version, down from any website hosting them immediately.” Sony did not immediately respond to a request for comment from the Guardian. Reuters had quoted anonymous federal law enforcement officials saying the hack may have been a collaboration between North Korean and Chinese hackers or that servers in China could have been used to disguise the attack’s origins. But the FBI’s formal statement made no mention of China.
The announcement comes hours before an end-of-year presidential press conference where President Obama is expected to comment on the matter for the first time. The White House described the hack as a “serious national security matter” and said it was considering a proportional response but stopped blaming North Korea. Senator John McCain, the incoming chairman of the Senate Armed Services Committee responsible for the funding and oversight of the Department of Defense, described the hack as an “act of war.”
“This is the greatest blow to free speech that I’ve seen in my lifetime probably,” McCain told Arizona radio station KFYI 550 on Friday morning, “We have to respond in kind. We have lots of capability in cyber, and we ought to start cranking that up.” McCain pledged on Thursday to strengthen oversight of the Obama administration’s cyber security program and blasted the president’s record on the issue. Any involvement by China could escalate an already politically explosive situation. In May, the Justice Department indicted five Chinese military officers, alleging they had hacked into US companies to steal trade secrets. Among the companies targeted were Alcoa and US Steel.
The indictment drew a furious response from Chinese officials, who said the charges were “based on fabricated facts” and “grossly” violated “the basic norms governing international relations.” China suspended participation in a US-China working group on cybersecurity. The FBI has been looking into the Sony hacking scandal since the beginning of December and had previously stated in public they had been unable to establish a link with North Korea and its notorious Bureau 121 hacking unit.
But anonymous federal law enforcement officials told various media outlets over the past 48 hours that a link between the hack and North Korea had been established. Sony has been left reeling from the November attack after thousands of confidential documents, including employee social security numbers, personal emails, unreleased films, and executive pay, were published online. On Wednesday, Sony canceled the film’s release after threats against cinemagoers and major US theater groups.
Eddie Schwartz, president of White Ops, a cyber security specialist, said many hacks leave a digital “fingerprint” that could allow the authorities to identify the culprit. Investigators will begin by looking at the malware and the software used by the hackers and then look at the next moves they made. “Different groups have different patterns of activity that they take on once they enter a system. Those patterns are like a fingerprint, almost like a playbook. You’ll see they go after certain servers first and conduct operations a certain way.”
