It's Actually Very Hard To Prove Who Hacked Sony

[Audrey McNeil <audrey () riskbasedsecurity com>]

https://finance.yahoo.com/news/why-hard-prove-hacked-sony-233804297.html

Ever since the Sony hack occurred nearly a month ago, the North Korean
government has often been called the perpetrators behind the attacks.

Tomorrow, the US government will reportedly name North Korea responsible.

But on Wednesday, Wired Magazine’s Kim Zetter wrote a convincing piece
explaining how hard it is to pinpoint an attack.

Zetter writes hackers can easily create false clues and disguise their
attacks as coming from a nation-state. Also, when nation-states are
involved in cyber attacks, they are usually a lot more muted about it. They
don’t go around posting their leaked documents like they did in this case.
Zetter says such actions are more indicative of hacktivist attacks
targeting large corporations.

Zetter also says the first public statement sent to Sony after the attacks
in late November had no mention of North Korea. In fact, a person claiming
to be a spokesperson for GOP said in a previous interview that it was an
“international organization…not under direction of any state.” Also, in a
letter sent to Sony executives, the attackers asked for “monetary
compensation,” a demand you rarely see in attacks for a political cause.

Some of the evidence that pointed to North Korean involvement include the
encoding language that was used by the machine in the attacks. Zetter says
that, too, can be configured to manipulate investigators. The RawDisk that
was used to wipe out data is also had nothing to do with North Korea in
previous attacks it says.

Instead, Zetter says all the evidence indicating North Korean involvement
are “circumstantial,” and points to hacktivists as the attackers.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!