Typical for the NYT to bury the strong countervailing evidence against the official war-mongering story in a couple of paragraphs 2/3rds of the way through the article. Still, the sophistication of the Sony hack was such that many experts say they are skeptical that North Korea was the culprit, or the lone culprit. They have suggested it was an insider, a disgruntled Sony ex-employee or an outside group cleverly mimi…
N.S.A. Tapped into North Korean Networks Before Sony Attack, Officials Say
51–60 of 159 posts
Re: N.S.A. Tapped into North Korean Networks Before Sony Attack, Officials Say
#52Earlier quoted context omitted.
I seem to be in the minority on Hacker News, but as someone in the professional computer security field I know that any company or state/department/organization can be hacked by a motivated attacker. In the case of SONY, the attackers were able to enter the network through spearphishing emails - something that essentially no investment in security is going to prevent. The malware similarly could not have been detecte…
> In the case of SONY, the attackers were able to enter the network through spearphishing emails - something that essentially no investment in security is going to prevent. Investment can make spearphishing much harder. Defense is not always absolute, but about raising the cost for the attacker.
I have trouble thinking of a cost-effective way that SONY could have prevented #GOP from getting in.
IMO SONY had two failures:
1.) The hording of data. Again I don't think that this is uncommon. I would expect to see this at pretty much any company of their size.
2.) The lack of an ability to respond to the APT once it was discovered. This is extremely tricky business, but a critical piece of security. It is common now for businesses to assume that they have been compromised and to build out the capability to recover and isolate issues as quickly as possible. Unfortunately for SONY, all of their data had been exfiltrated out of the network by the time they knew there was a problem.
Re: N.S.A. Tapped into North Korean Networks Before Sony Attack, Officials Say
#53> Mr. Jang said that as time went on, the North began diverting high school students with the best math skills into a handful of top universities, including a military school specializing in computer-based warfare called Mirim University, which he attended as a young army officer. I realize I'm not engaging the core topic being discussed, but stories like this are why I'm surprised people like Will Scott haven't gott…
That is a very scary argument. To deny education because it could be used in ways you may not like is a very unfortunate position to take. Education is likely the only way a system like North Korea's will ever fall short of a militarized take over - another horrible fate to wish on those same people. And were it to fall, an education is all that would permit their survival in the world at large. To deny individuals a…
To use a hypothetical: Would you condone someone teaching particle physics in North Korea? How about biology? Chemistry? Turbine engineering? Teaching any of these would probably increase North Korea's ability to threaten and harm its people and the rest of the world. It's sad that this is the case, but it's hard to argue otherwise.
Unfortunately, I seriously doubt education will help free North Korea. If you read the stories of defectors, you'll find that almost everyone in universities is indoctrinated. Also, because of how people are encouraged to report each other, no underground network of dissenters can exist. Even if 90% of North Koreans wanted to overthrow the government, anyone who voiced dissidence to a few friends would likely be reported and thrown in a prison camp (if not outright executed), along with their family. It doesn't take much to control many.
I really wish it was as easy as, "Education is good." But there can be dire consequences to actions, even ones as typically benign as teaching others. It's important to have a finely-tuned sense of ethics, otherwise we risk harming people who we mean to help.
Re: N.S.A. Tapped into North Korean Networks Before Sony Attack, Officials Say
#54> Mr. Jang said that as time went on, the North began diverting high school students with the best math skills into a handful of top universities, including a military school specializing in computer-based warfare called Mirim University, which he attended as a young army officer. I realize I'm not engaging the core topic being discussed, but stories like this are why I'm surprised people like Will Scott haven't gott…
Let's not forget the great value and results of CS education in the US:
- spying for pretty much everybody, regardless of location
- drone guidance systems to kill people unlawfully
- missile systems for air strikes on countries purported to have WMDs
- millions of $ spent on silly apps that arguably do nothing to improve quality of life, whilst millions suffer and die of starvation
Do you really know enough about North Korea's tech community to say that "More likely, these students will go on to make software for less-than-ethical purposes"?
Re: N.S.A. Tapped into North Korean Networks Before Sony Attack, Officials Say
#55> Mr. Jang said that as time went on, the North began diverting high school students with the best math skills into a handful of top universities, including a military school specializing in computer-based warfare called Mirim University, which he attended as a young army officer. I realize I'm not engaging the core topic being discussed, but stories like this are why I'm surprised people like Will Scott haven't gott…
Plus, More than likely he (and others like him) are providing intel or participating in espionage on behalf of Western Governments.
Re: N.S.A. Tapped into North Korean Networks Before Sony Attack, Officials Say
#56Earlier quoted context omitted.
The sophistication of the attack is pretty questionable IMO. The malware used can be purchased by anyone on the black market and had been used before by Iranian hackers in 2012. Furthermore, spearphishing emails were used to get inside the network. Furthermore, how would sophistication be evidence against a State actor with (a reported) 7,000 personnel?
When I hear "sophisticated" in the context of a breach, I think "we weren't paying attention"
Unfortunately the term is thrown around pretty loosely, limiting the usefulness of the term.
Re: N.S.A. Tapped into North Korean Networks Before Sony Attack, Officials Say
#57> Mr. Jang said that as time went on, the North began diverting high school students with the best math skills into a handful of top universities, including a military school specializing in computer-based warfare called Mirim University, which he attended as a young army officer. I realize I'm not engaging the core topic being discussed, but stories like this are why I'm surprised people like Will Scott haven't gott…
Yes, and that same argument can be made for pretty much any other country... why teach computer science to US, as they have shown they can't be trusted - they will probably end up in the NSA!
But to respond to your real argument: It's a matter of probabilities. The chance that an American programmer will work on software harmful to humanity is quite small. The chance that a North Korean programmer will do so is massive. Even if the person doesn't want to work on missile guidance or centrifuge control software, they can be ordered to, and their family can be held hostage. There is no such thing as a conscientious objector in North Korea.
Re: N.S.A. Tapped into North Korean Networks Before Sony Attack, Officials Say
#58The US yet again going around the world making enemies, and giving them perfectly valid reasons to retaliate.
Re: N.S.A. Tapped into North Korean Networks Before Sony Attack, Officials Say
#59Earlier quoted context omitted.
It's perfectly fine to be OK with your government hacking other countries while also being mad when those other countries do the same thing (though it's foolish to be shocked when it happens). I would disagree that this opinion is fine; this is only fine if one selfishly considers oneself more important than the 7000000000+ other people on the planet.
Do you really not consider yourself and family more important than most of the 7000000000+ other people on the planet? There are plenty of people more important than me, but I wouldn't sacrifice myself for any of them. In the same vein, it would be foolish for me, a US citizen, to say that my government should intentionally weaken itself for the benefit of the citizenry of other countries.
Re: N.S.A. Tapped into North Korean Networks Before Sony Attack, Officials Say
#60"We realized there was another actor [South Korea] that was also going against them [North Korea] and having great success because of a 0 day they wrote. We got the 0 day out of passive and were able to re-purpose it. Big win."
NSA learned of a 0-day exploit being used by South Korea (not five eyes) and re-purposed it. They had knowledge of an exploit in the wild. Did they share this with anyone in order to close this security flaw? They exploited it. This is not a case of the NSA developing an exploit in house. They took this from the wild. This would seem to confirm suspicions that NSA is/was willing to allow active 0-days to fester, leaving the general public exposed.