Slashdot Mirror
Norse Security IDs 6, Including Ex-Employee, As Sony Hack Perpetrators
chicksdaddy writes Alternative theories of who is responsible for the hack of Sony Pictures Entertainment have come fast and furious in recent weeks -- especially since the FBI pointed a finger at the government of North Korea last week. But Norse Security is taking the debate up a notch: saying that they have conclusive evidence pointing to group of disgruntled former employees as the source of the attack and data theft. The Security Ledger quotes Norse Vice President Kurt Stammberger saying that Norse has identified a group of six individuals — in the U.S., Canada, Singapore and Thailand — that it believes carried out the attack, including at least one 10-year employee of SPE who worked in a technical capacity before being laid off in May. Rather than starting from the premise that the Sony hack was a state sponsored attack, Norse researchers worked their investigation like any other criminal matter: starting by looking for individuals with the "means and motive" to do the attack.
HR files leaked in the hack provided the motive part: a massive restructuring in Spring, 2014, in which many longtime SPE employees were laid off. After researching the online footprint of a list of all the individuals who were fired and had the means to be able to access sensitive data on Sony's network, Norse said it identified a handful who expressed anger in social media posts following their firing. They included one former employee — a 10-year SPE veteran who he described as having a "very technical background." Researchers from the company followed that individual online, noting participation in IRC (Internet Relay Chat) forums where they observed communications with other individuals affiliated with underground hacking and hacktivist groups in Europe and Asia. According to Stammberger, the Norse investigation was eventually able to connect an individual directly involved in conversations with the Sony employee with a server on which the earliest known version of the malware used in the attack was compiled, in July, 2014.
HR files leaked in the hack provided the motive part: a massive restructuring in Spring, 2014, in which many longtime SPE employees were laid off. After researching the online footprint of a list of all the individuals who were fired and had the means to be able to access sensitive data on Sony's network, Norse said it identified a handful who expressed anger in social media posts following their firing. They included one former employee — a 10-year SPE veteran who he described as having a "very technical background." Researchers from the company followed that individual online, noting participation in IRC (Internet Relay Chat) forums where they observed communications with other individuals affiliated with underground hacking and hacktivist groups in Europe and Asia. According to Stammberger, the Norse investigation was eventually able to connect an individual directly involved in conversations with the Sony employee with a server on which the earliest known version of the malware used in the attack was compiled, in July, 2014.
Cyber-hack against US subsidiary.
'Obvious' perpetrator targeted by hardliners in government who leverage the blood-lust of the populace, and who pressure the president into immediate action.
Actual perpetrators turn out to be a small group of disgruntled employees.
IRC is not a FORUM. That is something different. It is a real-time chat, not a place to post messages.
Who is editing this crap? Some intern that hasn't used a computer?
Wow...fist post too!
Nothing anywhere near conclusive from the information provided.
any of them SAP developers? Seems their SpiritWORLD media systems was at the heart of the penetration. Also, TFA talks about them being able to "sneak terabytes of data off of the network without arousing notice." If your malware could take all the info it collects and sticks it together into some fake "media files" then the data being transferred might never have been noticed.
who be haxxin nao?
Stammberger was careful to note that his company’s findings are hardly conclusive
Draw your own conclusion. At least he didn't throw in the old 'we have other information we won't reveal' claim the government always uses to mask its own speculation.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Now being skilled and being laid of automatically makes you a crime suspect for having "means and motive".
For uns in IT business, we wouldn't be hired if we wouldn't have the knowledge that could also be used for blackhat purposes, and being laid of during a restructering is usually nothing an individual can control.
Thank you....
bickerdyke
I was assured by numerous talking heads that this particular network intrusion against a Japanese multinational was not only state-sponsored; but an act of Cyber-terror-war against America and the Homeland, and something that could only be answered in a suitably apocalyptic fashion, lest our nation's honor be soiled!
How could it possibly be something as pedestrian as upset employees?
And yet I was called a North Korean and other things for saying what is obvious.
Love the internet. So fuck you all. I was right and you FBI/President believing dumb fucks are wrong, again.
As I said before, the USA owes the NK a big fucking apology.
Be seeing you...
starting by looking for individuals with the "means and motive" to do the attack.
The problem is that Sony is- I wanted to say incredibly lax about security, but that's clearly not right — egregiously careless about security, and also typically, boringly evil so the people with motive are legion. You could find people with motive and opportunity under any rock.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Wait what?
They searched through Sonys files, found a layoff... and that's a surprise?
And then they found that there were some with "Technical background" that were laid off at the same time?
Then they found that one of those had access to one of the first servers that got penetrated?
Oh no! They were in a "hacking IRC channel"!!! That's like all... of the IRC channels. And he used his real name in the channel? I doubt that...
In summary, they found out that Sony had a layoff that affected at least 1 sysadmin and that sysadmin had access to some gateway server... So they're guilty? As with any company Sony's size, I suspect they have layoffs every 6 months or more. And I suspect that those layoffs frequently include people with a "Technical background" and often even "Sysadmins" And it's a surprise that such a person would have access to some random piece of hardware?!? It was his job to have access to ALL of the hardware.
Unless they have more evidence, this is nothing more than a PR stunt, and whomever this individual is, he's probably already looking for a Lawyer.
shows you what the USA game is don't it.....
I just talked with all the rest of the guys here on Slashdot, and we all agree: how could we be so stupid? We're all sorry and it definitely won't happen again; we'll pay really close attention to everything you say from here on out.
TFS paints a pretty credible picture that fits the known facts better than "The NorKs did it!"
North Korea would not have started out trying to extort money from Sony. Threats against The Interview only appeared after that had been discussed as a possible motive.
And yet Obama blamed North Korea, even going so far as to apparently take out NorK internet services.
Your choice, co-ordinated propaganda campaign or massive incompetence.
"If any question why we died, Tell them because our fathers lied."
Call me strange, but what I think the word "conclusive" means seems to be very different... it seems like they have a lot of "circumstantial" evidence, but not "conclusive" evidence.
Folks,
The evidence here is really, really weak. The connection is tenuous enough and the original pool of possible suspects via their methodology is large enough that I sure as heck wouldn't rule out a connection via random chance. Until we get better evidence, this isn't worth very much.
Norse Security says as much in The Fine Article:
--Paul
Is working for Sony that bad?
My ism, it's full of beliefs.
I like how you worked both "I told you so" and "I was right, you were wrong" in there. Wait, are you my girlfriend? Baby, is that you? Come back to bed honey, I didn't mean any of those awful things I said.
I always imagined (not being security-inclined my self, with basic understanding of some secure stuff like ssh, https, multi-factor etc) that when it comes to huge companies like this they have strict and audited security infrastructure and processes in place.
When a key employee leaves it should be as easy as doing a few mouse clicks and everyone gets "password expired" emails or stuff, right?
And not only I see this as being easy to use (not necessary easy to implement, but we're talking about tens of millions here) but also compulsory to do after someone is fired.
Why does it matter if a certain individual has a strong technical background (what does that even mean today? Can he format a HDD using command line tools or can he write his own file system?) as long as all his credentials are gone?
I'm sure they didn't get in speculating bugs in the ssh protocol.
... it looks like Norse found what they wanted to find, and not necessarily the reality of what happened.
While your method would work would it also cover firmware on a switch that would mask as user credentials to forward the data intended to be mined to where it was supposed to go?
Of course this would be a far stretch.
Personally I never thought it NK, what would they gain by going after Sony other than some retribution for Japanese occupation of Korea.
I am Bennett Haselton! I am Bennett Haselton!
The chosen one? Has Harry Potter made a statement?
APK, please go back to posting the host file nonsense. Maybe FTW you could link myUncleanPC and hosts file editing with wife beating and child sex/molestation. Maybe in a few years, you'll upgrade your hosts file solution to into a database, a 'local DNS solution'. Then maybe you can distribute it, also! You can re-implement OpenDNS!
... Ye have heard that it was said by them of old time, Thou shalt not commit adultery: But I say unto you, That whosoever looketh on a woman to lust after her hath committed adultery with her already in his heart."
I'd like to take your OT reference and update it with a NT one; the message on the Mount of Olives where Jesus said, (Matt 5:17, 27-28) "Think not that I am come to destroy the law, or the prophets: I am not come to destroy, but to fulfil.
Translation: Hey, look, I know you Jewish folks have some laws in the OT, that's great and all, but God's Law trumps all. Let me add to it a bit: Not only can you not cheat on your wife, you cannot even look at another woman for the purpose of extramarital excitement without cheating on her. So take your out of context, out of place woman hating OT stuff somewhere else.
Interesting you mention Ba'al, too. Didn't 400 of his best priests get bested by one man of God?
ProTip: ba'alah means mistress in Semitic. The one you are using refers to men/boys.
Oceania has ALWAYS BEEN AT WAR with East Asia.
"Flyin' in just a sweet place,
Never been known to fail..."
and see where the stones fall, then post a disclaimer on the article saying "Well it might not be him" ????? Profit?
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
I would presume that the Norse group of hacker-hackers has been poring through every byte of data released by G.O.P., right? There's lot of information there about the firings (cost-cutting, it's referred to often.)
A couple of questions I have:
1) Bob Osher is the Sony "President, Sony Pictures Digital Productions". He has been instrumental in Sony's recent cost-cutting reorganization. If the hackers really were insiders upset with how Sony was laying off people, I would expect that they would be focused on him, not Pascal and Lynton. Osher is mentioned only occasionally.
2) If it wasn't about North Korea, then why were so many pre-released films distributed in the 25GB first dump, but The Interview held back? It's clearly been "in the can" for quite some time.
Thad
The US gov can not afford to admit a mistake, after executing a DOS attack against NK.
Hi guys.
I'm afraid this article implies a level of certainty that we at Norse do not share, yet.
We don't have "conclusive" evidence yet. Our investigations are ongoing. They *are* focusing on a small set of individuals, some of whom are ex-Sony employees, and some of whom are connected to pro-piracy groups. We see datapoints and indicators they MAY have communicated and worked together. We have not concluded anything yet, but we're working hard to pull together as many connections as we can to see where the data leads.
Best
Kurt Stammberger
SVP
Norse
The thought that a few, decently intelligent , disgruntled *individuals* , coupled with the 'destructive' nature of the attacks I think scares the crap out of govvies. Call it cyber-vandalism, -terrorism, or -war, the act of public destruction and 'outing' is what has made this attack a 'game changer.' State funded threat actors have been spying for years. They've mostly - the stuxnets aside - have stopped short of destruction that they're all capable of, and 'just' xfilled credit cards, or secret formulas. Think what the Target attackers could have wrought by bricking the POS terminals. So if you're a govvie, it's natural to presume that a whacky - but funded - state threat actor is behind this, as the thought of a handful of individuals is just too scary. Do any /. ers know what security product stuff that Sony deployed (which missed all of this )? I'd love to know their host based AV and HIPS, and their network FW, IPS, 'APT ' detectors/protectors.
It was obviously never NK (and I've personally expressed as much to my coworkers) when their bandwidth (nationally equivalent to a 56Kbps dial-up modem) is provided by AOL Korea and depends on sponsored ads edited using PaintShop Pro 3 on an Windows 98 Second Edition PC. Their collective disk storage capacities are probably no more than your run-of-the-mill WD 5400rpm disk storage arrays.
Okay, okay. Seriously, though, NK neither had the motive nor the means to carry out such a sophisticated cyber-attack comprising of several GB's of HR files. Why would NK give a crap about some mid-level executive's salary bonus? Why would they make terroristic threats against thousands of movie theaters on American soil when they cannot even obtain a passport and boarding pass onto an airplane?
TL;DR somebody at the FBI is getting fired.
They haven't even figured out Loki is masquerading as Odin!
Quickest way to disprove it. Was that ex-employees SSN released? He/She would be crazy to release their own just to piss off Sony.
Like a alot of slashdotters i also have a technical background, growing up in the 80s PBX + BBS HPACTV scene, running my own boards, and when the internet came of age, running ftp sites, maintaining myself on efnet. There is a culture that exists with alot of technical people that lean them toward what we collectively would agree is harmless if not a bit self serving, but comes off as scary to the general public. I think for the most of us, the older we get, we become more responsible and turn away from taking shit up to the next level like we did when we were kids. Mostly because we have kids that depend on us not to fuck around with stupid shit.
What scares me is companies like this see this type of activity and freak out. I think in any critical infrastructure job it would horrify certain people to know that the guy that runs the firewall was an ex member of a scene, wrote an article in Phrack or contributed to wardials back the day. you shine a spotlight on the lead network geek, unix geek etc you will find similiar behaviors and similiar pasts. This background does not immediately implicate someone into a crime. I am very hestitant to talk about things like this with coworkers for example, becuase i felt the prejudice first hand in the 90s when everyone was getting into IT. It starts off like "whoa dude thats awesome you got mad knowledge" and then later when hacking occurs and its "magic" to them, the tone changes.."hey...did you have anything to do with this". I know this is an age old problem. Sorry if im ranting. Just feel sorry for this dude if he is legit.
DHS NCIC spread of FBI Flash warning
Who did the deed and who paid them to do it are separate questions anyway.
I have always maintained that the deed was not done directly by NK but that NK may kill them if there is a risk of them getting caught and spilling the beans as to who the job was done for.
Why didn't Norse take their opinions to the right people an not let NK know what was going on? Now people could end up dead rather then just imprisoned.