Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The NSA has linked the WannaCry computer worm to North Korea

washingtonpost.com

Post reply on HN
Print view View original

71–80 of 253 posts

Re: The NSA has linked the WannaCry computer worm to North Korea

#71

Post by oh_sigh »

DaiPlusPlus wrote: post #52
jorblumesea wrote: post #51

Earlier quoted context omitted.

It also makes some practical sense, as NK regime has little in the way of hard foreign currency and bitcoins would be a great source of untraceable unsactionable income. Their previous adventures in illegal activities (counterfeit bills, meth, prostitution and slave labor) show they are not above deviousness to achieve stable income for the Kim state.

Supposing North Korea has Bitcoins... how could they sell them in a way that grants them usable currency?

Sell them on one of the Chinese exchanges for yuan and physically carry it over the border to NK.

Re: The NSA has linked the WannaCry computer worm to North Korea

#72

Post by [deleted] »

cottsak wrote: post #46
openasocket wrote: post #43

Earlier quoted context omitted.

In that link they only raise doubts about Lazarus being behind WannaCry, not Lazarus being associated with the DPRK. And the Kapersky researchers' quote says that this being a false flag is "possible" but "improbable"

Agreed, confirming that there is no public evidence which hard links Lazarus to DPRK. Just want everyone to know the facts.

[deleted]

Re: The NSA has linked the WannaCry computer worm to North Korea

#73

Post by meowface »

cottsak wrote: post #38
openasocket wrote: post #21

OK, so I know this is going to come up in the comments, but this is not remotely a baseless allegation. The Lazarus group (one of the names for the DPRK-associated APT group) is somewhat well known and is quite sophisticated. This is the same group that hacked Sony a few years back. And to preempt people who are going to chime in with "Sony was just some insider leaking data" there is extensive evidence showing it wa…

It's not been fully confirmed/established that Lazarus group == DPRK: see "false flag" from Kaspersky researchers https://www.wired.com/2017/05/wannacry-ransomware-link-suspe...

>In its blog post, Kaspersky acknowledged that the repetition of the code could be a "false flag" meant to mislead investigators and pin the attack on North Korea. After all, the WannaCry authors cribbed techniques from the NSA as well. The ransomware leverages an NSA exploit known as EternalBlue that a hacker group known as Shadow Brokers made public last month.

>Kaspersky called that false flag scenario "possible" but "improbable."

This is more a standard disclaimer of any intelligence analyst than a serious qualification in this case. When trying to attribute something that allows easy copycats, an investigator will obviously constantly be thinking "is this clue genuine or intentionally placed to suggest a different origin"? And without an incredible amount of evidence, it's hard to definitively say certain malware or tools were written or used by a particular entity.

Re: The NSA has linked the WannaCry computer worm to North Korea

#74

Post by openasocket »

cottsak wrote: post #46
openasocket wrote: post #43

Earlier quoted context omitted.

In that link they only raise doubts about Lazarus being behind WannaCry, not Lazarus being associated with the DPRK. And the Kapersky researchers' quote says that this being a false flag is "possible" but "improbable"

Agreed, confirming that there is no public evidence which hard links Lazarus to DPRK. Just want everyone to know the facts.

What would a "hard link" be? A signed confession from the head of the DPRK military? Under the circumstances, barring classified intelligence (like the NSA may have), we are as sure as we can be.

Re: The NSA has linked the WannaCry computer worm to North Korea

#75

Post by meowface »

52-6F-62 wrote: post #26
openasocket wrote: post #21

OK, so I know this is going to come up in the comments, but this is not remotely a baseless allegation. The Lazarus group (one of the names for the DPRK-associated APT group) is somewhat well known and is quite sophisticated. This is the same group that hacked Sony a few years back. And to preempt people who are going to chime in with "Sony was just some insider leaking data" there is extensive evidence showing it wa…

Re: Sony Hack I heard that the DPRK was definitely involved, but that they involved themselves at a later point in the publicity over the attack, and that it the original attack was initiated by disparate individuals only loosely cooperating. Not to disparage your points on the Lazarus group. I've heard the same about their sophistication. I know next to nothing about the WannaCry attack besides the tragedy of the NH…

Who do you believe conducted the original attack?

Re: The NSA has linked the WannaCry computer worm to North Korea

#76

Post by openasocket »

oh_sigh wrote: post #71
DaiPlusPlus wrote: post #52

Earlier quoted context omitted.

Supposing North Korea has Bitcoins... how could they sell them in a way that grants them usable currency?

Sell them on one of the Chinese exchanges for yuan and physically carry it over the border to NK.

Hell, you don't even need to carry it over: anything you want to use the money to purchase is going to be in China anyway.

Re: The NSA has linked the WannaCry computer worm to North Korea

#77

Post by SomeStupidPoint »

natch wrote: post #27
pfisch wrote: post #4

Earlier quoted context omitted.

Remind me what past incident you are referring to.

There's that little part where they claim to be dedicated to helping keep our information systems secure, while they simultaneously stockpile zero day exploits and work behind the scenes to subvert and weaken encryption practices.

The NSA has always been a mix of offense and defense.

You can argue that balance has tilted inappropriately in recent times (I do), but that's different from any sort of indication they'd misattribute something like this.

Re: The NSA has linked the WannaCry computer worm to North Korea

#78

Post by flashmob »

threeseed wrote: post #32
iffe_closure wrote: post #11

Maybe I'm old fashioned but I take any hacking blame from gov to gov as likely propaganda.

The idea that the US needs to actively spread propaganda about North Korea is pretty ridiculous. You are aware that they have been sending missiles on a regular basis and inviting criticism from pretty much everyone. Who exactly is pro-North Korea that the US is trying to sway ?

> Who exactly is pro-North Korea that the US is trying to sway?

Perhaps China.

However, propaganda doesn't have to be false. It just has to fit the narrative.

Hmm. This could even be an attack on bitcoin itself? We already know North Korea is bad, then North Korea uses bitcoin, therefore bitcoin = bad?

In this case, there would be a motive to plant a false attribution to North Korea.

Re: The NSA has linked the WannaCry computer worm to North Korea

#79

Post by clouddrover »

threeseed wrote: post #18
jlgaddis wrote: post #2

The NSA has lost all credibility, as far as I am concerned.

And this is based on what, exactly ? If you're going to make hyperbolic statements maybe some clarifications would be useful.

> And this is based on what, exactly ?

The NSA developed the exploits that WannaCry was based on. The NSA lost control of its weapon (EternalBlue) in the Shadow Brokers leak and the world suffered economic damage as a consequence.

The NSA doesn't seem interested in switching to a more defensive role where they will inform software makers of the security problems they find. Instead they seem intent on maintaining offensive capability by seeking out, cataloging, exploiting, weaponizing, and keeping silent about the software security flaws they discover.

Re: The NSA has linked the WannaCry computer worm to North Korea

#80

Post by openasocket »

jszymborski wrote: post #69
openasocket wrote: post #47

Earlier quoted context omitted.

I assume you're referring to the Sony hacks? The evidence is pretty damning: https://www.operationblockbuster.com/wp-content/uploads/2016... which I linked elsewhere. Any aspect of that report you want to contest?

I'm liable to believe The Grugq, Marc Rogers and Peter Singer [0]. I've never heard of novetta before, and have no particular reason to doubt them, but I will say that this looks more like promotional material than anything else. [0] http://gawker.com/a-lot-of-smart-people-think-north-korea-di...

Why go on people's word when the evidence is right there! There were public keys used for encryption in the Sony hacks that were reused from other attacks years before.

Also, Operation Blockbuster was a joint action, taken on by Novetta, Kaspersky Lab, Symantec, and others

Post reply on HN