Aletho News

Did North Korea Really Hack Sony?

By James DiEugenio | Consortium News | February 3, 2015

One of the major problems with modern American democracy is the fact that the U.S. government has a serious credibility problem. This is not new of course. In its contemporary strain, it goes back at least to 1964 when two events focused and magnified the problem. The first was the Gulf of Tonkin incident, which was used to launch the Vietnam War. The second was the issuance of the Warren Report, the widely doubted official account of John F. Kennedy’s assassination.

As Kevin Phillips demonstrated with polling results in his book Arrogant Capital, that year marked the beginning of a long decline in the public’s trust in the government’s ability to do what is right most of the time. Prior to that year, the number hovered in the mid-70 percentile. After that, the figure began to drop steeply. It bottomed out at 19 percent in 1992. (This was clearly a large factor in boosting the presidential candidacy of Ross Perot that year.) It has failed to recover in any significant way since.

Historically speaking, it’s easy to name some of the causes for this headlong slide into skepticism and disbelief: the escalation in Vietnam, the assassinations of key leaders during the 1960s, Watergate, the Iran/Contra affair, the exposure of CIA drug-running during wars in Southeast Asia and Central America.

As Nicolas JS Davies has pointed out, some more recent examples would be the false reasons for the invasion of Iraq, the dubious attribution of imminent nuclear weaponry for Iran, the attempt to accuse President Bashar al-Assad of Syria of using sarin gas against civilians, and the attempt to blame Russia for the shoot-down of Malaysia Airlines Flight 17.

As the reader can see, many of these instances involve the effort of certain reactionary members of the Executive Branch in Washington and their allies in the media to use the American military abroad. One would have thought that after the disastrous results of the Tonkin Gulf Resolution, the major media would investigate more carefully what now seems to be a recurrent pattern of ersatz attribution to provoke American intervention. But, by and large, the doubts about these events have been expressed only in the alternative media.

The final incident Davies (briefly) mentioned was last year’s computer hacking of Sony/Columbia studios, which the FBI blamed on North Korea. The ostensible reason for this cyber-attack was the upcoming release of the comedy film, The Interview, which depicted an interview by a fictional American TV personality with Kim Jong-un, the actual leader of North Korea.

This interview becomes a pretext for an assassination attempt that goes awry. But, as the movie unfolds, the interview does happen and Kim does not come off well in it. This causes him to try to kill the Americans responsible. It backfires and he is killed instead.

Perhaps no film since Oliver Stone’s JFK generated as much pre-release controversy as The Interview. But unlike Stone’s picture, which created a sensation over its contrary-to-the-Establishment view of President Kennedy’s assassination, this particular brouhaha is largely based upon the alleged cyber-attack by North Korea.

When the FBI pointed the finger at Pyongyang, Sony/Columbia decided not to release the film, citing security concerns. Both people in the film colony and in the media met that decision with much derision. Therefore, Columbia reconsidered and did a limited theatrical run for the film, combined with a large online release. Due to the massive coverage of the controversy, the latter has been a big success. In fact, it has set records in that category.

‘The Interview’ as a Movie

The movie was co-directed by Seth Rogen and Evan Goldberg, who also had a hand in writing the story. Along with James Franco, Rogen also stars in the film. Rogen and Goldberg have been friends since childhood in Vancouver, Canada. Rogen’s career took off after he moved to Los Angeles and met writer-director Judd Apatow, who produced Anchorman: The Legend of Ron Burgundy and directed The 40 Year Old Virgin.

After first using Rogen in a TV series called Freaks and Geeks, Rogen starred in Apatow’s 2007 film Knocked Up. Apatow then produced two films written by Rogen and Goldberg, Pineapple Express and Superbad. Franco was also in Freaks and Geeks, and Pineapple Express with Rogen. Rogen and Goldberg then scripted The Green Hornet in 2011; they wrote and co-directed This Is the End in 2013.

Reportedly, Rogen once advised Apatow to make his work more “outrageously dirty.” [Los Angeles Times, May 13, 2007] And Apatow once said he wanted to include a penis in each of his films. [The Guardian. Aug. 26, 2008]

Well, we get those kinds of jokes in The Interview. The premise of the film revolves around Franco as a TV personality named Dave Skylark, the host of a rather lowbrow interview show titled Skylark Tonight. Rogen plays the producer-director of the program and has ambitions of doing something more socially and politically significant, a la 60 Minutes.

In one of the several unfathomable plot twists in the film, Kim likes Skylark Tonight so much that he wants to be a guest on the show and to arrange the guest spot through Rogen. But, in another hard to buy plot twist, Kim wants to arrange the interview in some sparsely populated rural area in China. (I think this segment was designed to generate laughs — which it does not.)

The visit to North Korea is now set up with a female military representative of Kim’s. Upon Rogen’s return, he and Franco celebrate and they announce the upcoming event on the air.

Now, another rather hard to believe strophe occurs. The CIA visits the two men and asks them to assassinate Kim. No specific reason is given as to why (though Kim is widely viewed in the West as a clownish and unstable dictator), or why they chose these two utter amateurs for such a daring, high-risk scheme.

The CIA wants them to kill Kim with a toxic poison attached to the palm of their hands. This strip is hidden in a pack of gum. But when they arrive in North Korea, one of their military guards takes out the pack and chews the strip. He spits it out, and in a rather unfunny follow-up, we later watch him die from the poison at a dinner.

Franco now meets Kim. The North Korean is on his best behavior and the two hit it off for a couple of days playing basketball and partying with some scantily clad girls.

Twisting the Plot

But now, another rather weird plot twist occurs. Franco wanders out of the presidential palace, going to what he thought was a grocery store nearby. He goes inside and discovers that the store is really a Potemkin village. That is, things like fruit and vegetables are really painted props.

Obviously, this scene is intended to highlight the shortage of food supplies in North Korea, but why the North Koreans would plant the store so close to the palace, why they would leave it unattended, and why they could not import real goods to stock it at this crucial time, these kinds of questions make this episode another head-scratcher. But the plot device explains why Franco turns on his new friend, Kim Jong-un.

In the meantime, Rogen has fallen for the female military attaché. It turns out she secretly hates Kim and now allies herself with the Americans. She says they cannot just kill him; they must humiliate him on TV so the Korean people will see him as a pretentious buffoon and charlatan.

So, Franco/Skylark decides to structure the interview to expose Kim. But the station technicians cut the feed. Rogen and his girlfriend then pull out firearms, touching off a bloody fight in the control room also involving Korean troops. Somehow, the amateur Americans kill all the Koreans. Franco is shot at, but he survives because he had a bulletproof vest on.

The trio manages to escape in a tank (no, I won’t explain how that happened) and are pursued by Kim and some soldiers in a helicopter. Kim orders preparations for a nuclear launch. But the tank fires a heat-seeking missile that takes out the chopper. Some CIA double agents then help Rogen and Franco escape the country.

At the end, we see Franco at a book reading about the whole affair as Rogen talks to his North Korean girlfriend via Skype. She stayed behind to democratize the country.

As the reader can see, the story is pretty much escapist, goofball fiction with a plot focused on murdering a real-life leader. But as bad as the script is, the direction by Rogen and Goldberg is even worse.

The Decline of Comedy

In 1965, before he retired from the field, illustrious film critic Dwight MacDonald wrote an essay entitled “Whatever Happened to Hollywood Comedy?” There, he lamented how low the genre had fallen from the Alpine peaks attained by the likes of Keaton, Chaplin, Lloyd and Langdon. Or even from the hills of Preston Sturges, Billy Wilder, Ernst Lubitsch and Howard Hawks.

MacDonald outlined three rules that comic films he was reviewing broke almost systematically. First, he wrote that most of the films had no appealing comic protagonists, which he felt was necessary in the genre. Second, he said they were overproduced and too Rube Goldberg-like in their construction and depiction. (Rogen and Goldberg shoot the helicopter exploding at the end in super-slow-motion.)

Finally, according to MacDonald, the sadism inherent in comedy could not be shown realistically, i.e., if the comic actually broke his back while slipping on a banana peel, that would not be funny.

Well, in the fight in the control room in The Interview, we watch as not one, but two fingers get bitten off. Apparently, no one on the set said to Rogen, “Uh Seth, is that really funny?” Rogen is an even worse director than he is an actor. And the man can’t act.

If MacDonald felt gloomy about the state of film comedy in 1965, one can imagine what he would have written in later years, which leads us to the first question about the hacking mystery: Unless the North Koreans are as imbecilic as the people depicted in the film, could they really have thought that such a frivolous production somehow imperiled the security or image of their country – and to such an extent that they went ahead and risked retaliation by hacking into a private company’s computer system?

To me, the risk simply does not equate with whatever reward was to be had. But there are other indications that the case against North Korea is not nearly as conclusive as the FBI wants us to think. President Barack Obama may have compounded the problem by announcing retaliatory sanctions on Jan. 2. Further, White House Press Secretary Josh Earnest implied there would be more of this because he called it “the U.S. government’s first action…”

The Facts of the Case

The controversy actually began to take shape last June when the North Korean ambassador to the United Nations — without seeing the movie in all of its silliness — condemned the film and urged the United States to cancel its distribution. Clearly, making light of assassinating a nation’s leader is problematic, whatever one may think of the leader, and the North Koreans made their disgust clear.

Then, on Nov. 24, 2014, Columbia discovered that its computers had been hacked. Their employees were locked out and an ugly caricature of a bright red skeleton popped up on their screens that morning. A message appeared which said, “Hacked by #GOP.” Later, personal information, e-mails and unreleased films were leaked online. The films included Still Alice, Annie and To Write Love on Her Arms.

In this context, GOP does not refer to the Republican Party but to a hacking group that calls themselves the Guardians of Peace. It’s interesting to note that although North Korea denies the attack, Guardians of Peace takes credit for it. In fact, the Guardians actually called the FBI a bunch of idiots because of the stupidity of their investigation.

As Kim Zetter pointed out in Wired, nation-states usually don’t announce themselves with images of blazing skeletons or criticize their victims for having poor cyber security, nor do they post stolen data to Pastebin, which is sort of the unofficial warehouse for heisted files on the cloud.

As Zetter writes, “These are all hallmarks of hacktivists — groups like Anonymous and LulzSec, who thrive on targeting large corporations for ideological reasons … or by hackers sympathetic to a political cause” (Wired, Dec. 17, 2014)

Cyber-security expert Marc Rogers agreed that the operation did not look like it was from a nation-state, and he criticized the FBI’s case on specific grounds, noting that because the malware was written in Korean means little, since programs exist to translate that code.

Rogers also said that whoever wrote the malware had extensive knowledge of hard-coded paths and passwords. This would suggest that whoever did the attack was somehow watching Sony/Columbia’s computer architecture for a long time or was a company insider because not only did the hackers know where certain files were located but they knew the access codes on them.

Third, Rogers wrote that when a hacker simply dumps this amount of material onto a public site, that has the earmarks of a hack job from some ideologically motivated group. There was much information North Korea could have garnered from the huge access they allegedly had. And this could have served them well in their intelligence files. Why make it public? (See Roger’s blog, “Marc’s Security Ramblings” entry dated Dec. 18, 2014)

More Skepticism

Rogers is backed up on his first point by Kurt Stammberger, senior vice-president of Norse, a company that provides computer intelligence systems and technology to both private corporations and the government.

Stammberger has been in possession of the specific malware used in the Sony hack as far back as last July, which can be secured by interested parties on the black market. His sample of the program is totally in English, not a trace of Korean.

The executive noted that specific Sony credentials, server address and digital codes and certificates were then written into the malware. As another authority in the field noted, certain malware behaves erratically. It just dives into a system, shuffles around the computer and spirals around looking for things to link to randomly. The Sony hack was more like a cruise missile.

“This stuff was incredibly targeted. That is a very strong signal that an insider was involved,” said Stammberger. (New York Post, Dec. 30, 2014) Thus, he concluded that “It’s virtually impossible to get that information unless you are an insider, were an insider, or have been working with an insider. That’s why we and so many other security professionals are convinced an insider played an important role.”

Furthering this belief is the fact that, last spring, Sony issued layoff notices to hundreds of employees. A private Facebook group made up of former Sony employees voted by a large majority that the hack was an inside job. An ex-employee said what makes this even more possible is that Sony’s security was not very tight or sophisticated, a point that was echoed by Rogers. (Dana Liebelson, Huffington Post, Jan. 6, 2015)

In fact, Norse, Stammberger’s computer-intelligence company, went even further. They named a former employee as a suspect, along with five accomplices. They did this by going through hacked personnel files and then locating a disgruntled employee online. (The Security Ledger Dec. 18, 2014)

In one message, for instance, one of Stammberger’s suspects identified as “lena” wrote :“Sony doesn’t lock their doors, physically, so we worked with other staff with similar interests to get in. I’m sorry I can’t say more, safety for our team is important.” (The Wrap, Dec. 30, 2014)

From this and other evidence, Stammberger deduces that the conspiracy was a collaboration between an employee or employees terminated early last summer and a hacking group involved in distributing pirated movies online, a group that has been pursued by Sony.

The FBI visited Norse to hear this presentation and seemed suitably impressed. But Stammberger said the FBI didn’t reveal anything from its inquiry to Norse.

Chronology Problems

What makes the whole operation even more puzzling is the fact that an e-mail was sent to Sony executives three days before the hack became public, on Nov. 21, 2014, addressed to top executives such as CEO Michael Lynton and Chairperson Amy Pascal (among others). It reads:

“Monetary compensation we want. Pay the damages, or Sony Pictures will be bombarded as a whole. You know us very well. We never wait long. You’d better behave wisely.”

Clearly, the fact that this was sent in advance indicates that whoever sent it knew what was about to happen. But the warning contains no mention, not even a hint, about censoring an about-to-be-released movie. The message appears to be pure and simple extortion, as is clearly denoted in the first sentence about money.

But what makes this piece of evidence ultimately confusing is that it was signed by “God’sApstls,” a rubric that also was in one of the malicious files used in the cyber attack. (ibid)

As Wired’s Zetter points out, it was only on Dec. 8, a week after a logjam of media stories appeared linking the attack to North Korea, that the attackers made a reference to the film in one of their announcements. And after this, the hackers made oblique terrorist threats against the film’s premiere in New York on Christmas Day.

In other words, it was after the finger-waving at North Korea had begun that “the GOP” began to explicitly link the film to the crime. To top that, as Sam Biddle noted in The Gawker on Dec. 22, the self-declared attackers — “the GOP” — then released a message declaring that Sony/Columbia had their permission to release The Interview anyway, which certainly implies that whoever did the hacking was simply bluffing about any terrorist attacks if the film were shown.

Lessons Not Learned

This points out another interesting aspect of the case, which Peter Singer, another security expert, expounded on at Motherboard. In an interview, he said: “This is not just now a case study in how not to react to cyber threats and a case study in how not to defend your networks; it’s now also a case study in how not to respond to terrorism threats.

“We have just communicated to any would-be attacker that we will do whatever they want. It’s mind-boggling to me, particularly when you compare it to real things that have actually happened. Someone killed 12 people and shot another 70 people at the opening night of Batman: The Dark Knight Rises. They kept that movie in the theater. You issue an anonymous cyber threat that you do not have the capability to carry out: We pulled a movie from 18,000 theaters.” (Sic, that number is exaggerated.)

Singer said whoever conducted the attack understood the American psyche and culture to the point of knowing that politicians like John McCain and Newt Gingrich would call it an attack of “cyber terrorism” and demand retaliation and that no one would ask: Why?

Would North Korea really commit its scarce resources and take this geopolitical risk over a witless, very bad comedy and think that a fitting retaliation would be to publicize how much money Sony executives make or that producer Scott Rudin thinks Angelina Jolie is only marginally talented?

Gauging by the U.S. overreaction, one is reminded of what Orson Welles did with a radio microphone, four actors, and some mood music in 1938 with his broadcast of H. G. Wells’ War of the Worlds.

Singer added that this image of Sony/Columbia as a frightened and intimidated victim benefits the company because it conceals the fact that it has been hacked before, going back to 2005, and more than once.

Yet, their whole computer architecture has been relatively unchanged, even though the previous hacks were not labeled as attacks from a nation-state. It’s fairly clear that Sony did not take the attacks seriously enough to do a major upgrade on their security system or to change passwords and pass codes every few months.  Obviously, they could afford the financial outlay to do such things.

Obama’s Hypocrisy

On the day the FBI announced North Korea as the culprit, President Obama criticized Sony’s initial decision to pull the film from theaters. Echoing what Singer said, the President commented: “We cannot have a society in which some dictator in some place can start imposing censorship here in the USA. If somebody can intimidate folks out of releasing a satirical comedy, imagine what they’ll do when they see a documentary or political film they don’t like.”

He continued in this vein, “That’s not what we are, that’s not what America is about. I’m sympathetic that some private company was worried about liabilities. I wish they’d spoken to me first. Do not get into a pattern in which we’re intimidated by these kinds of criminal attacks.”

Obama did not seem aware of the irony, either in regards to his own participation in actual assassinations, i.e., “targeted killings” via drone attacks, or his administration’s aggressive effort to silence U.S. government whistleblowers through criminal prosecutions, examples of real censorship.

In response to Obama’s expressed disappointed that Sony had not come to him for help, Sony CEO Michael Lynton contradicted this observation the same day it was made on Dec. 19. In a statement made on CNN, the executive said, “We definitely spoke to a senior advisor in the White House … about the situation. The White House was certainly aware of the situation.”

Lynton added that Sony consulted with the State Department before the hacking to anticipate any political controversy the film could provoke. But Lynton went even further, saying Sony went to think tanks, foreign policy authorities, and the State Department “to get an understanding of whether or not there was a problem” with the film. The CEO said he was told by all that there was no problem, so they proceeded with the advertising rollout of the film.

Lynton said it really was not Sony that pulled the film from theatrical release but rather too many major exhibitors refused to show the film for fear of possible terrorist attacks. He concluded that he “had no alternative but to not proceed with the theatrical release on the 25^th of December.” (Deadline, Dec. 19, 2014)

Weighing the Evidence

Of course, it is possible that these accusations against North Korea are correct. However, as of today, there is a large body of expert opinion that says the evidence so far is lacking. In fact, another expert, Robert Graham of Errata Security, was even more unimpressed than Rogers, calling the FBI’s evidence “nonsense.” (New York Post, Dec. 30, 2014)

If that is so, then the Sony hack may end up joining the long line of instances in which the U.S. government either jumped to misguided conclusions or intentionally misled the American people. Meanwhile, the real culprits escape and the real facts become harder to ascertain since the U.S. government hates to admit mistakes especially when the falsely accused have been thoroughly demonized and have few defenders.

If the truth is discovered many years down the line, the major news media usually ignores it or, in the rare case that the truth is acknowledged and accepted, it is way past the time for avoiding dangerous actions rationalized by the false allegations.

It took Professor Edwin Moise three decades to produce the definitive book on the Tonkin Gulf incident, showing that just about everything President Lyndon Johnson said about what happened there was wrong. By then, millions of Vietnamese and 58,000 Americans were dead.

~

James DiEugenio is a researcher and writer on the assassination of President John F. Kennedy and other mysteries of that era. His most recent book is Reclaiming Parkland.

February 3, 2015 Posted by aletho | Deception, Mainstream Media, Warmongering, Progressive Hypocrite | North Korea, Obama, United States | 1 Comment

Who Was Behind the Cyberattack on Sony?

By GREGORY ELICH | CounterPunch | December 30, 2014

The cyberattack on Sony Pictures unleashed a torrent of alarmist media reports, evoking the image of North Korean perfidy. Within a month, the FBI issued a statement declaring the North Korean government “responsible for these actions.” Amid the media frenzy, several senators and congresspersons called for tough action. Arizona Senator John McCain blustered, “It’s a new form of warfare that we’re involved in, and we need to react and react vigorously.” President Barack Obama announced his administration planned to review the possibility of placing North Korea on the list of states sponsoring terrorism, a move that would further tighten the already harsh sanctions on North Korea. “They caused a lot of damage, and we will respond,” Obama warned darkly. “We will respond proportionally, and we’ll respond in a place and time and manner that we choose.”

In the rush to judgment, few were asking for evidence, and none was provided. Computer security analysts, however, were vocal in their skepticism.

In its statement, the FBI offered only a few comments to back its attribution of North Korean responsibility. “Technical analysis of the data deletion malware used in the attack revealed links to other malware that the FBI knows North Korean actors previously developed,” it reported, including “similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.” The FBI went on to mention that the IP addresses used in the Sony hack were associated with “known North Korean infrastructure.” Tools used in the attack “have similarities to a cyberattack in March of last year against South Korean banks and media outlets, which was carried out by North Korea.”

The major problem with the evidence offered by the FBI is that it is self-referential, all of it pointing back to the 2013 attack on South Korean banks and media that was carried out by the DarkSeoul gang. At that time, without supplying any supporting evidence, the United States accused North Korea of being behind DarkSeoul. In effect, the FBI argues that because the U.S. spread the rumor of North Korean involvement in the earlier attack, and some of the code is related, this proves that North Korea is also responsible for the Sony hack. One rumor points to another rumor as ‘proof,’ rendering the argument meaningless.

The logical fallacies are many. To date, no investigation has uncovered the identity of DarkSeoul, and nothing is known about the group. The linking of DarkSeoul to North Korea is purely speculative. “One point that can’t be said enough,” emphasizes Risk Based Security, “is that ‘attribution is hard’ given the nature of computer intrusions and how hard it is to ultimately trace an attack back to a given individual or group. Past attacks on Sony have not been solved, even years later. The idea that a mere two weeks into the investigation and there is positive attribution, enough to call this an act of war, seems dangerous and questionable.”

Consider some of the other flaws in the FBI’s statement. The IP addresses that were hard-coded in the malware used in the Sony hack belonged to servers located in Thailand, Poland, Italy, Bolivia, Singapore, Cypress, and the United States. The FBI implies that only the Democratic People’s Republic of Korea (DPRK – the formal name for North Korea) could have used these servers. The Thai port is a proxy that is commonly used in sending spam and malware. The same is true of the Polish and Italian servers. All of the servers used in the Sony attack have been previously compromised and are among the many computers that are widely known and used by hackers and spam distributors. Anyone with the knowhow can use them.

Whether or not these machines were used is another matter. Hackers often use proxy machines with phony IP addresses to mislead investigators. No hackers use their own computers to launch an attack. Vulnerable systems are hijacked in order to route traffic. For the FBI to point to IP addresses either reveals a fundamental misunderstanding of cybersecurity or a cynical attempt to deliberately mislead the public.

The Sony hack also bears similarities with the 2012 Shamoon cyberattack on computers belonging to Saudi Aramco. Those responsible for that attack have never been identified either, although the United States accused Iran without providing any evidence. Using the FBI’s logic, one could just as easily argue that the Sony hack was the work of Iran. One groundless accusation is used to buttress another. As evidentiary matter, it is worthless. It should also be recalled that in 1998, the United States blamed Iraq for the Solar Sunrise hack into Defense Department computers, only for it be ultimately revealed that it was the act of a few teenagers.

Nor do the similarities in code between the Sony hack and the earlier Shamoon and DarkSeoul attacks indicate a shared responsibility. Malware is freely available on the black market. Hackers operate by purchasing or borrowing, and then tweaking commonly available software, including both illegal and legal components. Code is shared among hackers on forums, and malware is assembled by linking various elements together.

One of the components used in the Sony cyberattack was the RawDisk library from EldoS, a commercial application that allows direct access to Windows hardware bypassing security. Anyone can legally purchase this software. There is nothing to tie it to the DPRK.

“There’s a lot of malware that’s shared between different groups, and all malware is built on top of older malware,” reports Brian Martin of Risk Based Security. “They’re also built on top of hacking tools. For example, you’ll find lots of malware that uses pieces of code from popular tools like Nmap. Does that mean that the guy who wrote Nmap is a malware author? No. Does it mean he works for North Korea? No.”

Robert Graham of Errata Security regards the evidence offered by the FBI as “complete nonsense. It sounds like they’ve decided on a conclusion and are trying to make the evidence fit.” Graham adds: “There is nothing unique in the software. We know that hackers share malware on forums. Every hacker in the world has all the source code available.”

Trojan-Destover, the malware used in the Sony cyberattack, included at least six components utilized earlier by Shamoon and DarkSeoul. “Even in such damaging scenarios, the cyber attacker’s tools are reused,” points out Sariel Moshe of CyActive. “For them, if it worked once, tweak it a bit and it will work again. The attack on Sony demonstrates quite clearly that this method works quite well.” Indeed, while Shamoon and DarkSeoul are the most commonly mentioned predecessors to the Sony hack, it is thought that this software has been used on several occasions in the past against multiple targets.

The software utilized in the Sony cyberattack is atypical for a nation state. “It’s a night and day difference in quality,” says Craig Williams of Cisco’s Talos Security Intelligence and Research Group. “The code is simplistic, not very complex, and not very obfuscated.”

Four files used in the attack were compiled on a machine set to the Korean language. That fact proves nothing, notes computer security analyst Chris Davis. “That is pretty weak evidence. I could compile malware code that used Afrikaans and where the timestamp matched JoBerg in about five seconds.” Any reasonably competent hacker would change the language setting in order to misdirect investigators. Had North Korean conducted this attack, it certainly would have taken the basic step of changing the language setting on the machine used to compile code.

What about North Korean resentment over Sony Picture’s tasteless lowbrow comedy, The Interview, which portrays the assassination of DPRK leader Kim Jong-un? It is doubtful that Americans would find themselves any more amused by a foreign comedy on the subject of killing a U.S. president than the North Koreans are by The Interview.

Among the emails leaked by the cyberattack on Sony was a message from Bruce Bennett of the Rand Corporation. Bennett was a consultant on the film and opposed toning down the film’s ending. “I have been clear that the assassination of Kim Jong-un is the most likely path to a collapse of the North Korean government,” he wrote, adding that DVD leaks of the film into North Korea “will start some real thinking.” In another message, Sony CEO Michael Lynton responded: “Bruce – Spoke to someone very senior in State (confidentially). He agreed with everything you have been saying. Everything.” Lynton was also communicating with Robert King, U.S. Special Envoy for North Korean Human Rights Issues in regard to the film.

The Western media portray North Korean reaction to The Interview as overly sensitive and irrational, while U.S. officials and a Rand Corporation consultant saw the film as having the potential to inspire the real-life assassination of Kim Jong-un. The scene of Kim’s assassination was not intended merely for so-called ‘entertainment.’

The mass media raced to attribute the Sony hack to the DPRK, based on its reaction to the Sony film. A closer look at the cyberattack reveals a more likely culprit, however. The group taking responsibility for the hack calls itself ‘Guardians of Peace’, and in one of the malware files the alternate name of ‘God’sApstls’ is also used. In the initial attack, no reference was made to the film, nor was it mentioned in subsequent emails the attackers sent to Sony. Instead, the hackers attempted to extort money: “Monetary compensation we want. Pay the damage, or Sony Pictures will be bombarded as whole.”

In an interview with CSO Online, a person represented as belonging to Guardians of Peace said the group is “an international organization…not under the direction of any state,” and included members from several nations. “Our aim is not at the film The Interview as Sony Pictures suggests,” the hacker wrote, but mentioned that the release of a film that had the potential of threatening peace was an example of the “greed of Sony Pictures.”

For two weeks following the cyberattack, the media harped on the subject of North Korean culpability. Only after that point did the Guardians of Peace (GOP) make its first public reference to The Interview, denying any connection with the DPRK. Yet another week passed before the GOP denounced the movie and threatened to attack theaters showing the film.

It appears that the narrative of North Korean involvement repeated ad nauseam by the media and the U.S. government presented a gift to the hackers too tempting to pass up. The GOP played to the dominant theme and succeeded in solidifying the tendency to blame the DPRK, with the effect of ensuring that no investigation would pursue the group.

For its part, the Obama Administration chose to seize the opportunity to bolster its anti-North Korea policy in preference over tracking down the culprits.

There are strong indications that the cyberattack involved one or more disgruntled Sony employees or ex-employees, probably working together with experienced hackers. The malware used against Sony had been modified to include hard-coded file paths and server names. System administrator user names and passwords were also hard-coded. Only someone having full access with system administrator privileges to Sony’s computer network could have obtained this information.

The GOP could have hacked into the Sony system months beforehand in order to gather that data. But it is more likely that someone with knowledge of Sony’s network configuration provided the information. Arguing against the possibility that critical information had been siphoned beforehand through a hack, cybersecurity expert Hemanshu Nigam observes, “If terabytes of data left the Sony networks, their network detection systems would have noticed easily. It would also take months for a hacker to figure out the topography of the Sony networks to know where critical assets are stored and to have access to the decryption keys needed to open up the screeners that have been leaked.”

The most likely motivation for the attack was revenge on the part of current or former Sony employees. “My money is on a disgruntled (possibly ex) employee of Sony,” Marc Rogers of CloudFlare wrote. “Whoever did this is in it for the revenge. The info and access they had could have easily been used to cash out, yet, instead, they are making every effort to burn Sony down. Just think what they could have done with passwords to all of Sony’s financial accounts.”

Nation states never conduct such noisy hacking operations. Their goal is to quietly infiltrate a system and obtain information without detection. Sony had no data that would have been of interest to a nation state. Computer security blogger The Grugq wrote, “I can’t see the DPRK putting this sort of valuable resource onto what is essentially a petty attack against a company that has no strategic value.”

It would have been reckless for a North Korean team to draw attention to itself. Cybersecurity specialist Chris Davis says, “All the activity that was reported screams Script Kiddie to me. Not advanced state-sponsored attack.” Davis adds, “Well, the stupid skeleton pic they splashed on all the screens on the workstations inside Sony…is not something a state-sponsored attack would do…Would ANY self-respecting state-sponsored actor use something as dumb as that?” The consensus among cybersecurity experts is clear, Davis argues. “The prevalent theory I am seeing in the closed security mailing lists is an internet group of laid off Sony employees.”

Following his cybersecurity firm’s investigation, Kurt Stammberger of Norse echoes that view. “Sony was not just hacked. This is a company that was essentially nuked from the inside. We are very confident that this was not an attack master-minded by North Korea and that insiders were key to the implementation of one of the most devastating attacks in history.”

“What is striking here is how well they knew to exploit Sony’s vulnerabilities,” reports Nimrod Kozlovski of JVP Labs. “The malware itself is not creative or new; there are plenty of actors that could have manifested this particular attack.” The hackers “knew more about the company, Sony, and its vulnerabilities than they knew, or needed to know, about hacking.”

As an indication of the hacker’s real motivation, it should be noted that the first communications focused on a different issue than the Sony film. The content of an email sent by the GOP to the IDG News Service refers to Sony’s restructuring, in which thousands of employees lost their jobs: “Sony and Sony Pictures have made terrible racial discrimination and human rights violation, indiscriminate tyranny and restructuring in recent years. It has brought damage to a lot of people, some of whom are among us. Nowadays, Sony Pictures is about to prey on the weak with a plan of another indiscriminate restructuring for their own benefits. This became a decisive motive for our action.” In an email to The Verge, the GOP wrote, “We want equality. Sony doesn’t… We worked with other staff with similar interests to get in.”

Seeking to diffuse tensions, North Korea proposed to conduct a joint investigation with the United States into the Sony cyberattack. Predictably, the United States quickly rebuffed the offer. National Security Council spokesman Mark Stroh arrogantly responded, “If the North Korean government wants to help, they can admit their culpability and compensate Sony for the damages this attack caused.” North Korea can hardly be expected to accept blame for an act it did not commit. But getting to the truth of the matter was the farthest thing from the Obama Administration’s mind. Similarly, U.S. officials are ignoring requests from cybersecurity experts to be allowed to analyze the Destover code. “They’re worried we’ll prove them wrong,” Robert Graham concludes.

The Obama Administration’s outrage over the Sony attack contains more than a small measure of hypocrisy. It was the United States that launched the Stuxnet attack that destroyed many of Iran’s nuclear centrifuges. According to a Washington Post article published in 2013, the United States conducted 231 cyber operations throughout the world two years before. The National Security Agency, as is now well known, regularly hacks into computer networks, scooping up vast amounts of data. The GENIE program, the Post reported, was projected to have broken into and installed implants in 85,000 computers by the end of 2013. It was reported that GENIE’s next phase would implement an automated system that could install “potentially millions of implants” for gathering data “and active attack.” According to former deputy of defense secretary William J. Lynn III, “The policy debate has moved so that offensive options are more prominent now.”

Contrast the mild treatment the media gave to the recent large-scale hacks into Target, Home Depot and JP Morgan, in which millions of credit cards and personal information were stolen, with the coverage of the cyberattack on Sony Pictures. It is impossible to avoid the conclusion that political considerations are driving the media furor over the latter case.

After six years in office, the Obama Administration has yet to engage in dialogue or diplomacy with North Korea. It prefers to maintain a wall of hostility, blocking any prospect of progress or understanding between the two nations.

Already, North Korean websites have been targeted by persistent denial of service operations. Whether the attacks were launched by a U.S. government cyber team or independent hackers inspired by media reports is not known. In any case, President Obama has already promised to take unspecified action against the DPRK. Actual responsibility for the Sony attack is irrelevant. Backed by media cheerleading, U.S officials are using the cyberattack as a pretext to ratchet up pressure on North Korea. Any action the Obama Administration takes is likely to trigger a response, and we could enter a dangerous feedback loop of action/counteraction.

Gregory Elich is on the Board of Directors of the Jasenovac Research Institute and the Advisory Board of the Korea Policy Institute. He is a member of the Committee to Defend Democracy in South Korea and a columnist for Voice of the People. He is also one of the co-authors of Killing Democracy: CIA and Pentagon Operations in the Post-Soviet Period, published in the Russian language.

December 30, 2014 Posted by aletho | Deception, Mainstream Media, Warmongering, Progressive Hypocrite | North Korea, Obama, United States | Leave a comment