Sat, Jan 24, 2015 - Page 9 News List

Tracking the hacker trail from North Korea to Sony

A US intelligence agency was responsible for breaking into North Korea’s computer networks years before the cyberattack on Sony Pictures, according to foreign officials and computer experts

By David Sanger and Martin Fackle  /  NY Times News Service, WASHINGTON

Illustration: Tania Chou

The trail that led US officials to blame North Korea for the destructive cyberattack on Sony Pictures Entertainment in November winds back to 2010, when the US National Security Agency (NSA) scrambled to break into the computer systems of a country considered one of the most impenetrable targets on Earth.

Spurred by growing concern about North Korea’s maturing capabilities, the US spy agency drilled into the Chinese networks that connect North Korea to the outside world, picked through connections in Malaysia favored by North Korean hackers and penetrated directly into the North with the help of South Korea and other US allies, according to former US and foreign officials, computer experts later briefed on the operations and a newly disclosed NSA document.

A classified security agency program expanded into an ambitious effort, officials said, to place malware that could track the internal workings of many of the computers and networks used by the North’s hackers, a force that South Korea’s military recently said numbers roughly 6,000 people. Most are commanded by the country’s main intelligence service, called the Reconnaissance General Bureau, and Bureau 121, its secretive hacking unit, with a large outpost in China.

The evidence gathered by the “early warning radar” of software painstakingly hidden to monitor North Korea’s activities proved critical in persuading US President Barack Obama to accuse the government of North Korean leader Kim Jong-un of ordering the Sony attack, according to the officials and experts, who spoke on the condition of anonymity about the classified NSA operation.

Obama’s decision to accuse North Korea of ordering the largest destructive attack against a US target — and to promise retaliation, which has begun in the form of new economic sanctions — was highly unusual: The US had never explicitly charged another government with mounting a cyberattack on US targets.

Obama is cautious in drawing stark conclusions from intelligence, aides say, but in this case “he had no doubt,” according to one senior US military official.

“Attributing where attacks come from is incredibly difficult and slow,” said James Lewis, a cyberwarfare expert at the Center for Strategic and International Studies in Washington. “The speed and certainty with which the United States made its determinations about North Korea told you that something was different here — that they had some kind of inside view.”

For about a decade, the US has implanted “beacons,” which can map a computer network, along with surveillance software and occasionally even destructive malware in the computer systems of foreign adversaries. The government spends billions of dollars on the technology, which was crucial to the US and Israeli attacks on Iran’s nuclear program, and the documents previously disclosed by Edward Snowden, the former security agency contractor, demonstrated how widely they have been deployed against China.

However, fearing the exposure of its methods in a country that remains a black hole for intelligence gathering, US officials have declined to talk publicly about the role the technology played in Washington’s assessment that the North Korean government had ordered the attack on Sony.

The extensive US penetration of the North Korean system also raises questions about why the US was not able to alert Sony as the attacks took shape last fall, even though the North had warned, as early as June, that the release of the movie The Interview, a crude comedy about a CIA plot to assassinate the North’s leader, would be “an act of war.”

This story has been viewed 3042 times.

Comments will be moderated. Keep comments relevant to the article. Remarks containing abusive and obscene language, personal attacks of any kind or promotion will be removed and the user banned. Final decision will be at the discretion of the Taipei Times.

TOP top