FBI says little doubt North Korea hit Sony
Published 12:00 am Thursday, January 8, 2015
WASHINGTON — The FBI’s director, James Comey, said Wednesday that the United States had concluded that North Korea was behind the destructive attacks on Sony Pictures partly because the hackers failed to mask their location when they broke into the company’s servers.
Comey said that instead of routing some of the attacks and messages through decoy servers, the hackers sent them directly from Internet addresses in North Korea.
Trending
While Comey did not offer more details in a speech in New York, senior government officials said that FBI analysts found that the hackers quickly recognized their mistake. After logging into Sony’s systems and websites like Facebook from North Korean addresses, the hackers quickly switched to software that camouflaged their whereabouts by sending their attacks through computers in countries including Bolivia, Singapore, Poland and Italy, the officials said.
Before the attacks in November, Sony Pictures was threatened in a series of messages posted to a Facebook account set up by a group calling itself “Guardians of Peace.” After Facebook closed that account in November, the group changed its messaging platform and began sending threats in emails to Sony and on the anonymous posting site Pastebin. Their anger appeared to be directed at the Sony film “The Interview,” a comedy about the assassination of the North Korean leader Kim Jong Un co-directed by Seth Rogen and Evan Goldberg.
Responding to critics who have questioned why the United States thinks North Korea was the source of the attacks, Comey said Wednesday that the hackers became “sloppy” as they tried to cover their tracks. He acknowledged that the North Koreans had used decoys but did not elaborate about the specific mistakes the hackers made that gave him “high confidence” the country was behind the attack.
Comey urged the U.S. intelligence community to declassify all the information that showed that the hackers had used such servers, something that could take months. Comey’s remarks came a little more than three weeks after President Barack Obama took the unusual step of publicly naming the North Koreans as the culprit. Last week, U.S. officials imposed a series of sanctions on senior North Korean officials as retaliation for the attack.
The Sony breach has become a focal point for the FBI and other federal officials because it was one of the rare attacks on a big corporation that the United States has attributed to a foreign government. Comey made his remarks about the Sony breach in a speech at the International Conference on Cyber Security in New York. The four-day event, coordinated by the FBI, brings together law enforcement officials and Internet security experts from around the world to discuss and analyze techniques hackers use to breach corporate computer networks.
Shortly after the FBI blamed the North Korean government for the Sony attack, some digital security experts began to raise doubts about the government’s claim. Working off a sliver of the digital evidence from the attack — samples of malware that were distributed to security researchers — several security researchers said they were skeptical of government claims that the attackers were North Korean.
Trending
Critics noted that an extortion letter posted by the attackers suggested that they may have been criminals or embittered employees, not a nation state. They suggested that the fact that the attackers coded malware off computers with Korean language settings could have been faked, and they said that the IP addresses used in the attack were also used in other attacks.
But the FBI and other security experts say those critics have had access to only some of the evidence. They say the accumulation of the evidence collected by the FBI, Sony and Mandiant, a security firm hired by Sony, makes clear that North Korea was the culprit.