A bit of history
In the world that we live in
today, it is not uncommon for big organizations to face some cyber-attacks. In
fact, any decent sized organization would have faced some heat in the last few
years. JP Morgan, LinkedIn, Microsoft, Standard Chartered, Alibaba, Home Depot,
I could go on and on, have all been in the news. Eventually, if the
adversaries are motivated enough, and given enough resources, it is only a
matter of time before an organization gets compromised.
Sony is no exception to this
rule. As per the public records
available,
Sony was compromised a whopping 21 times, between Apr-2011 and July-2011 alone.
That is an average of more than once per week, during that time. As a response,
they beefed up their security, and
announced
a new CISO (Philip Reitinger), around Sep-2011.
Goes without saying, one
person cannot change the security posture of a company overnight. In fact, they
continued to get compromised in
Oct-2011,
and
Sep-2012,
and again in
Jul-2013.
I am not trying to pass any judgment, but it did seem as if Sony was not taking
security too seriously, at the time. Nevertheless, things did appear to have
improved after early 2012.
Sony Pictures Hack
When Sony Pictures employees got into the office on Monday, 24-Nov-2014,
they discovered
that their corporate network had been hacked by “#GOP”. The attackers took
terabytes of private data, deleted the original copies from Sony computers, and
left threatening messages, on the computer screens of the employees. Apparently
they had some demands, and Sony was given one day to comply, but I am not sure
what these demands exactly were.
The impact: The organization had to
switch
to typewriters and fax machines, just because the network was so badly
compromised, that no workstation or server could be trusted. In fact, even at
the time of writing this, Sony is still not confident if their network is
clean
and trusted.
Lost, Leaked, Damaged?
It is estimated that about 100
TB of data was stolen. Not all has been leaked on the internet. What we do know
so far:
- Five Sony
movies were leaked on peer-to-peer networks (torrents). Four of these
movies were unreleased at the time (including ‘The Interview’). Meaning, a direct impact to the revenue of the
company.
- The employee’s healthcare, social security
numbers, and salary data was leaked.
In fact the employees later filed
a class-action law suit against
Sony, because of the lost personal data.
- Internal email
communication, which put some of the famous actors in bad light. So, these
actors may now think twice about working with Sony again.
- There was even an internal email, with a racist joke
on President Obama
- Budgets of some movies (like the upcoming James
Bond Spectre), and what aliases
are used by the Hollywood stars
- Passport details
of actors, movie crew, etc.
- Worse, company lost
the private keys to its digital certificates. This was later used to sign
malware, and make it look like legit Sony products. The certs were quickly revoked
by their CA (DigiCert). However, it is still a kick to the company’s goodwill
to have malware signed as ‘trusted’ under their name.
The Interview
Now supposedly this whole attack is in
retaliation
to a movie called “
The Interview”, a
comedy movie that makes fun of the North Korean leader Kim Jong-un, and has a
plot built around his assassination. The hacking group Guardians of Peace (GOP)
issued a warning to Sony to not release the movie. In fact the employees of
Sony too got some scary
threats,
to leave the company. Moreover, the movie
theaters
were threatened as well, and were warned to not play the movie.
Under pressure, Sony decided
to
stop
all TV advertisements of the movie, and to scrap the planned Christmas Day
release. However, after President
Obama
gave some confidence to the company, Sony made a U-turn on their decision, and
finally
did release the movie in theaters and VOD.
Blame North Korea!
The FBI, and even The
President himself, has clearly
pointed at North
Korea for being the mastermind behind this attack. They are so sure of
themselves that the Government even imposed some
sanctions
on North Korea. On the other hand, the Korean government has repeatedly
denied
any involvement in the hack. In fact, they even volunteered to help with the
investigation.
Some
evidence
suggests that a former Sony employee may have provided information to Lulzsec
members (a hacktivist organization), thus enabling the attack. While some
sceptics
believe this was all a publicity stunt, orchestrated by Sony.
There is
another
theory, that the hackers may not even be linked to North Korea. After all, at
the time of the hack, there was no
mention of this movie. At the time it was all an extortion attempt. It is only
after the media started suggesting that the hack was linked to ‘
The Interview’, did the hackers conveniently
get inspired by the idea, and played along.
Why is it so complicated to confirm who were these
cyber-criminals? Here let me quote Bruce Schneier, who
explains
this very well.
Ordinarily, you could determine who the attacker was by the weaponry.
When you saw a tank driving down your street, you knew the military was
involved because only the military could afford tanks. Cyberspace is
different. In cyberspace, technology is broadly spreading its capability, and
everyone is using the same weaponry: hackers, criminals, politically
motivated hacktivists, national spies, militaries, even the potential
cyberterrorist. They are all exploiting the same vulnerabilities, using the
same sort of hacking tools, engaging in the same attack tactics, and leaving
the same traces behind. They all eavesdrop or steal data. They all engage in
denial-of-service attacks. They all probe cyberdefences and do their best to
cover their tracks.
|
So in other words, a cyberattack investigation will never
lead to a smoking gun, or a video footage of the bad guys, patriotically
holding their country’s flag, and typing furiously at their computers.
Known Facts
For obvious reasons neither
FBI nor Sony has released all the facts publically. From what we do know, below
is a list of some of the facts. Now some of these facts help point at North
Korea, whereas most of these are inconclusive.
- The
threats were written in broken English and North Korea had condemned “The
Interview” in a July letter
to the U.N. Secretary-General. Hence, they for sure had a motive. They had even
called the movie an
act of terrorism
- After
examining the malware
used to infiltrate the studio, the FBI said it found similarities with software
used in previous cyber-attacks carried out by North Korea
- The
IP addresses used in the attack are addresses used by North Korea in previous
attacks attributed to their government
- Guardians
of Peace (GOP) had previously
sent threatening emails to Sony, sometimes using an Internet provider address used
exclusively by North Korea
- The
malware that was found on Sony’s systems was reverse-engineered, and had Korean
language.
However, some say it is in a different
dialect
- Privileged
passwords were used for the hack. So, maybe an insider was involved.
Alternatively, it is also possible that the hackers were in the network long
enough to break into the accounts. In some cases the privileged password was
‘password’ itself.
So, cannot take too long to brute-force
The list goes on, but I try to
cover the main ones here.
Conclusion
Personally I believe the whole
theory of North Korean government being the sponsor of the attack is very
circumstantial. In the unlikely scenario that a suspect is taken to the court,
I do not see s/he getting prosecuted (based on the evidence we have so far).
Maybe it’s possible that a
North Korean, with no links to the government, is behind it. What if there are
multiple parties involved here? One who actually did hack and leak the internal
data, and another who is just taking advantage of the situation and fueling
their own propaganda.
Update 03-Mar-2016: Some
report about Operation Blockbuster & Lazarus Group ?!
