Forest Global Training Partners

Cyber Risks · Krebs on Security

The Case for N. Korea’s Role in Sony Hack

Summary: Krebs on Security examined evidence behind the U.S. government's conclusion that North Korea was responsible for the Sony Pictures attack, comparing it to the March 20, 2013 Dark Seoul attacks that knocked three South Korean banks and two broadcasters offline using wiper malware that overwrote hard drives with the words "hastati" or "principes." McAfee traced the Dark Seoul malware to a single group operating an encrypted espionage network against South Korean and U.S. military targets since October 2009, and CrowdStrike's Dmitri Alperovitch said his firm independently reached a high-confidence North Korean attribution based on infrastructure overlap and malware analysis dating to 2006.

Bottom line: The attackers in the 2013 case were inside their targets for at least two months before wiping drives, and the Sony case still had no answer for how tens of terabytes of data left the network unnoticed - the dwell time and exfiltration gap, not the attribution debate, is the exposure most organizations share.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related