The trail that led US officials to blame North Korea for the destructive cyberattack on Sony Pictures Entertainment in November winds back to 2010, when the US National Security Agency (NSA) scrambled to break into the computer systems of a country considered one of the most impenetrable targets on Earth.
Spurred by growing concern about North Korea’s maturing capabilities, the US spy agency drilled into the Chinese networks that connect North Korea to the outside world, picked through connections in Malaysia favored by North Korean hackers and penetrated directly into the North with the help of South Korea and other US allies, according to former US and foreign officials, computer experts later briefed on the operations and a newly disclosed NSA document.
A classified security agency program expanded into an ambitious effort, officials said, to place malware that could track the internal workings of many of the computers and networks used by the North’s hackers, a force that South Korea’s military recently said numbers roughly 6,000 people. Most are commanded by the country’s main intelligence service, called the Reconnaissance General Bureau, and Bureau 121, its secretive hacking unit, with a large outpost in China.
Illustration: Tania Chou
The evidence gathered by the “early warning radar” of software painstakingly hidden to monitor North Korea’s activities proved critical in persuading US President Barack Obama to accuse the government of North Korean leader Kim Jong-un of ordering the Sony attack, according to the officials and experts, who spoke on the condition of anonymity about the classified NSA operation.
Obama’s decision to accuse North Korea of ordering the largest destructive attack against a US target — and to promise retaliation, which has begun in the form of new economic sanctions — was highly unusual: The US had never explicitly charged another government with mounting a cyberattack on US targets.
Obama is cautious in drawing stark conclusions from intelligence, aides say, but in this case “he had no doubt,” according to one senior US military official.
“Attributing where attacks come from is incredibly difficult and slow,” said James Lewis, a cyberwarfare expert at the Center for Strategic and International Studies in Washington. “The speed and certainty with which the United States made its determinations about North Korea told you that something was different here — that they had some kind of inside view.”
For about a decade, the US has implanted “beacons,” which can map a computer network, along with surveillance software and occasionally even destructive malware in the computer systems of foreign adversaries. The government spends billions of dollars on the technology, which was crucial to the US and Israeli attacks on Iran’s nuclear program, and the documents previously disclosed by Edward Snowden, the former security agency contractor, demonstrated how widely they have been deployed against China.
However, fearing the exposure of its methods in a country that remains a black hole for intelligence gathering, US officials have declined to talk publicly about the role the technology played in Washington’s assessment that the North Korean government had ordered the attack on Sony.
The extensive US penetration of the North Korean system also raises questions about why the US was not able to alert Sony as the attacks took shape last fall, even though the North had warned, as early as June, that the release of the movie The Interview, a crude comedy about a CIA plot to assassinate the North’s leader, would be “an act of war.”
DINNER IN PYONGYANG
The NSA’s success in getting into North Korea’s systems in recent years should have allowed the agency to see the first “spear phishing” attacks on Sony — the use of e-mails that put malicious code into a computer system if an unknowing user clicks on a link — when the attacks began in early September, according to two US officials.
Those attacks did not look unusual. Only in retrospect did investigators determine that the North had stolen the “credentials” of a Sony systems administrator, which allowed the hackers to roam freely inside Sony’s systems.
In recent weeks, investigators have concluded that the hackers spent more than two months, from mid-September to mid-November, mapping Sony’s computer systems, identifying critical files and planning how to destroy computers and servers.
“They were incredibly careful, and patient,” one person briefed on the investigation said, although he added that even with their view into the North’s activities, US intelligence agencies “couldn’t really understand the severity” of the destruction that was coming when the attacks began Nov. 24.
In fact, when US Director of National Intelligence James Clapper had an impromptu dinner in early November with his North Korean counterpart during a secret mission to Pyongyang to secure the release of two imprisoned Americans, he made no mention of Sony or the North’s growing hacking campaigns, officials say.
In a recent speech at Fordham University in New York, Clapper acknowledged that the commander of the Reconnaissance General Bureau, Kim Yong-chol, with whom he traded barbs over the 12-course dinner, was “later responsible for overseeing the attack against Sony.” (Clapper praised the food; his hosts later presented him with a bill for his share of the meal.)
Asked about Clapper’s knowledge of the Sony attacks from the North when he attended the dinner, Brian Hale, a spokesman for the director of national intelligence, said that the director did not know he would meet his intelligence counterpart and that the purpose of his trip to North Korea “was solely to secure the release of the two detained US citizens.”
“Because of the sensitivities surrounding the effort” to win the Americans’ release, Hale said, “the DNI [director of national intelligence] was focused on the task and did not want to derail any progress by discussing other matters.” However, he said Clapper was acutely aware of the North’s growing capabilities.
Jang Sae-yul, a former North Korean army programmer who defected in 2007, speaking in an interview in Seoul, said: “They have built up formidable hacking skills. They have spent almost 30 years getting ready, learning how to do this and this alone, how to target specific countries.”
Still, the sophistication of the Sony hack was such that many experts say they are skeptical that North Korea was the culprit, or the lone culprit. They have suggested it was an insider, a disgruntled Sony ex-employee or an outside group cleverly mimicking North Korean hackers. Many remain unconvinced by the efforts of FBI Director James Comey to answer critics by disclosing some of the US evidence.
Comey told the same Fordham conference that the North Koreans got “sloppy” in hiding their tracks, and that hackers periodically “connected directly and we could see them.”
“And we could see that the IP addresses that were being used to post and to send the e-mails were coming from IPs that were exclusively used by the North Koreans,” he said. Some of those addresses appear to be in China, experts say.
The skeptics say, however, that it would not be that difficult for hackers who wanted to appear to be North Korean to fake their whereabouts. Comey said there was other evidence he could not discuss. So did NSA Director Michael Rogers, who told the Fordham conference that after reviewing the classified data he had “high confidence” the North had ordered the action.
A GROWING CAPABILITY
North Korea built its first computer with vacuum tubes in 1965, with engineers trained in France. For a brief time, it appeared ahead of South Korea and of China, which not only caught up but also came to build major elements of their economic success on their hardware and software.
Defectors say that the Internet was first viewed by North Korea’s leadership as a threat, something that could taint its citizens with outside ideas.
However, Kim Heung-kwang, a defector who said in an interview that he helped train many of the North’s first cyberspies, recalled that in the early 1990s a group of North Korean computer experts came back from China with a “very strange new idea”: Use the Internet to steal secrets and attack the government’s enemies.
“The Chinese are already doing it,” he quoted one of the experts as saying.
Defectors report that the North Korean military was interested. So was the ruling Workers’ Party, which in 1994 sent 15 North Koreans to a military academy in Beijing to learn about hacking. When they returned, they formed the core of the External Information Intelligence Office, which hacked into Web sites, penetrated firewalls and stole information abroad. Because the North had so few connections to the outside world, the hackers did much of their work in China and Japan.
According to Kim, the military began training computer “warriors” in earnest in 1996 and two years later opened Bureau 121, now the primary cyberattack unit. Members were dispatched for two years of training in China and Russia.
Jang said they were envied, in part because of their freedom to travel.
“They used to come back with exotic foreign clothes and expensive electronics like rice cookers and cameras,” he said. His friends told him that Bureau 121 was divided into different groups, each targeting a specific country or region, especially the US, South Korea and the North’s one ally, China.
“They spend those two years not attacking, but just learning about their target country’s Internet,” said Jang, 46, who was a first lieutenant in a different army unit that wrote software for war game simulations.
Jang said that as time went on, the North began diverting high school students with the best math skills into a handful of top universities, including a military school specializing in computer-based warfare called Mirim University, which he attended as a young army officer.
Others were deployed to an “attack base” in the northeastern Chinese city of Shenyang, where there are many North Korean-run hotels and restaurants. Unlike the North’s nuclear and ballistic missile programs, the cyberforces can be used to harass South Korea and the US without risking a devastating response.
“Cyberwarfare is simply the modern chapter in North Korea’s long history of asymmetrical warfare,” a security research report by Hewlett-Packard said in August.
AN ATTACK IN SEOUL
When the US first gained access to the North Korean networks and computers in 2010, their surveillance focused on the North’s nuclear program and its leadership, as well as efforts to detect attacks aimed at US military forces in South Korea, one former US official said. (The German magazine Der Spiegel published an NSA document on Saturday that provides some details of South Korea’s help in spying on the North.) Then a highly destructive attack in 2013 on South Korean banks and media companies suggested that North Korea was becoming a greater threat, and the focus shifted.
“The big target was the hackers,” the official said.
That attack knocked out almost 50,000 computers and servers in South Korea for several days at five banks and television broadcasters.
The hackers were patient, spending nine months probing the South Korean systems, but they also made the mistake seen in the Sony hack, at one point revealing what South Korean analysts believe to have been their true IP addresses.
Lim Jong-in, dean of the Graduate School of Information Security at Korea University, said those addresses were traced back to Shenyang, and fell within a spectrum of IP addresses linked to North Korean companies.
The attack was studied by US intelligence agencies, but after the North issued its warnings about Sony’s movie last June, US officials appear to have made no reference to the risk in their discussions with Sony executives. Even when the spear-phishing attacks began in September — against Sony and other targets — “it didn’t set off alarm bells,” according to one person involved in the investigation.
The result is that US officials began to focus on North Korea only after the destructive attacks began in November, when pictures of skulls and gruesome images of Sony executives appeared on the screens of company employees. (That propaganda move by the hackers may have worked to Sony’s benefit: Some employees unplugged their computers immediately, saving some data from destruction.)
It did not take long for US officials to conclude that the source of the attack was North Korea, officials say.
“Figuring out how to respond was a lot harder,” one White House official said.
Additional reporting by Nicole Perlroth
Because much of what former US president Donald Trump says is unhinged and histrionic, it is tempting to dismiss all of it as bunk. Yet the potential future president has a populist knack for sounding alarums that resonate with the zeitgeist — for example, with growing anxiety about World War III and nuclear Armageddon. “We’re a failing nation,” Trump ranted during his US presidential debate against US Vice President Kamala Harris in one particularly meandering answer (the one that also recycled urban myths about immigrants eating cats). “And what, what’s going on here, you’re going to end up in World War
Earlier this month in Newsweek, President William Lai (賴清德) challenged the People’s Republic of China (PRC) to retake the territories lost to Russia in the 19th century rather than invade Taiwan. He stated: “If it is for the sake of territorial integrity, why doesn’t [the PRC] take back the lands occupied by Russia that were signed over in the treaty of Aigun?” This was a brilliant political move to finally state openly what many Chinese in both China and Taiwan have long been thinking about the lost territories in the Russian far east: The Russian far east should be “theirs.” Granted, Lai issued
On Tuesday, President William Lai (賴清德) met with a delegation from the Hoover Institution, a think tank based at Stanford University in California, to discuss strengthening US-Taiwan relations and enhancing peace and stability in the region. The delegation was led by James Ellis Jr, co-chair of the institution’s Taiwan in the Indo-Pacific Region project and former commander of the US Strategic Command. It also included former Australian minister for foreign affairs Marise Payne, influential US academics and other former policymakers. Think tank diplomacy is an important component of Taiwan’s efforts to maintain high-level dialogue with other nations with which it does
On Sept. 2, Elbridge Colby, former deputy assistant secretary of defense for strategy and force development, wrote an article for the Wall Street Journal called “The US and Taiwan Must Change Course” that defends his position that the US and Taiwan are not doing enough to deter the People’s Republic of China (PRC) from taking Taiwan. Colby is correct, of course: the US and Taiwan need to do a lot more or the PRC will invade Taiwan like Russia did against Ukraine. The US and Taiwan have failed to prepare properly to deter war. The blame must fall on politicians and policymakers