Slashdot Mirror
Norse Security IDs 6, Including Ex-Employee, As Sony Hack Perpetrators
chicksdaddy writes Alternative theories of who is responsible for the hack of Sony Pictures Entertainment have come fast and furious in recent weeks -- especially since the FBI pointed a finger at the government of North Korea last week. But Norse Security is taking the debate up a notch: saying that they have conclusive evidence pointing to group of disgruntled former employees as the source of the attack and data theft. The Security Ledger quotes Norse Vice President Kurt Stammberger saying that Norse has identified a group of six individuals — in the U.S., Canada, Singapore and Thailand — that it believes carried out the attack, including at least one 10-year employee of SPE who worked in a technical capacity before being laid off in May. Rather than starting from the premise that the Sony hack was a state sponsored attack, Norse researchers worked their investigation like any other criminal matter: starting by looking for individuals with the "means and motive" to do the attack.
HR files leaked in the hack provided the motive part: a massive restructuring in Spring, 2014, in which many longtime SPE employees were laid off. After researching the online footprint of a list of all the individuals who were fired and had the means to be able to access sensitive data on Sony's network, Norse said it identified a handful who expressed anger in social media posts following their firing. They included one former employee — a 10-year SPE veteran who he described as having a "very technical background." Researchers from the company followed that individual online, noting participation in IRC (Internet Relay Chat) forums where they observed communications with other individuals affiliated with underground hacking and hacktivist groups in Europe and Asia. According to Stammberger, the Norse investigation was eventually able to connect an individual directly involved in conversations with the Sony employee with a server on which the earliest known version of the malware used in the attack was compiled, in July, 2014.
HR files leaked in the hack provided the motive part: a massive restructuring in Spring, 2014, in which many longtime SPE employees were laid off. After researching the online footprint of a list of all the individuals who were fired and had the means to be able to access sensitive data on Sony's network, Norse said it identified a handful who expressed anger in social media posts following their firing. They included one former employee — a 10-year SPE veteran who he described as having a "very technical background." Researchers from the company followed that individual online, noting participation in IRC (Internet Relay Chat) forums where they observed communications with other individuals affiliated with underground hacking and hacktivist groups in Europe and Asia. According to Stammberger, the Norse investigation was eventually able to connect an individual directly involved in conversations with the Sony employee with a server on which the earliest known version of the malware used in the attack was compiled, in July, 2014.
Cyber-hack against US subsidiary.
'Obvious' perpetrator targeted by hardliners in government who leverage the blood-lust of the populace, and who pressure the president into immediate action.
Actual perpetrators turn out to be a small group of disgruntled employees.
Nothing anywhere near conclusive from the information provided.
forum
fôrm/
noun
noun: forum; plural noun: forums; plural noun: fora
1.
a place, meeting, or medium where ideas and views on a particular issue can be exchanged.
Stammberger was careful to note that his company’s findings are hardly conclusive
Draw your own conclusion. At least he didn't throw in the old 'we have other information we won't reveal' claim the government always uses to mask its own speculation.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Now being skilled and being laid of automatically makes you a crime suspect for having "means and motive".
For uns in IT business, we wouldn't be hired if we wouldn't have the knowledge that could also be used for blackhat purposes, and being laid of during a restructering is usually nothing an individual can control.
Thank you....
bickerdyke
I was assured by numerous talking heads that this particular network intrusion against a Japanese multinational was not only state-sponsored; but an act of Cyber-terror-war against America and the Homeland, and something that could only be answered in a suitably apocalyptic fashion, lest our nation's honor be soiled!
How could it possibly be something as pedestrian as upset employees?
And yet I was called a North Korean and other things for saying what is obvious.
Love the internet. So fuck you all. I was right and you FBI/President believing dumb fucks are wrong, again.
As I said before, the USA owes the NK a big fucking apology.
Be seeing you...
starting by looking for individuals with the "means and motive" to do the attack.
The problem is that Sony is- I wanted to say incredibly lax about security, but that's clearly not right — egregiously careless about security, and also typically, boringly evil so the people with motive are legion. You could find people with motive and opportunity under any rock.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I just talked with all the rest of the guys here on Slashdot, and we all agree: how could we be so stupid? We're all sorry and it definitely won't happen again; we'll pay really close attention to everything you say from here on out.
Your choice, co-ordinated propaganda campaign or massive incompetence.
"If any question why we died, Tell them because our fathers lied."
You're making this too hard. You can upload terabytes of data using good old SSL or encrypt files with zip tools like 7-zip and there is nothing in the stream of data that will be recognized... that's what encryption is for.
The person wanting to get data out doesn't have to work hard at all to ensure it can't be recognized as it is being transmitted. The difficulty is in making sure that the users of the system don't notice the decrease in disk IO and loss of bandwidth. If they've got a good perimeter defense or the right heuristics for the server, they may notice "hey, that's more activity than usual" and respond, but that's about the only way to catch somebody in the act of transporting data out of a system.
Unless they're stupid. Which, with Sony's security, they could have been.
B) Eliminate all the stupid users. This is frowned upon by society.
Folks,
The evidence here is really, really weak. The connection is tenuous enough and the original pool of possible suspects via their methodology is large enough that I sure as heck wouldn't rule out a connection via random chance. Until we get better evidence, this isn't worth very much.
Norse Security says as much in The Fine Article:
--Paul
Is working for Sony that bad?
My ism, it's full of beliefs.
I like how you worked both "I told you so" and "I was right, you were wrong" in there. Wait, are you my girlfriend? Baby, is that you? Come back to bed honey, I didn't mean any of those awful things I said.
... it looks like Norse found what they wanted to find, and not necessarily the reality of what happened.
Or unless sending terabytes of data out is routine. Sony Pictures makes movies. Movies are digital. Digital video loves disk space.
So sending dozens of gigabytes a day to any random address may well be business as usual.
Faster! Faster! Faster would be better!
Nevertheless it's slightly more credible than N.K. having done it.
Oceania has ALWAYS BEEN AT WAR with East Asia.
"Flyin' in just a sweet place,
Never been known to fail..."
and see where the stones fall, then post a disclaimer on the article saying "Well it might not be him" ????? Profit?
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
I'd be surprised if they don't ship out big pile of bits for rendering on the AWS/Google/MS clouds, since it's so much cheaper than buying dedicated CPUs that will then sit unused until the next batch of rendering needs to be done. Much of the original Star Wars movies were actually rendered after hours on servers at Informix and ARC GIS networks, so it's nothing new.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
6-7 years ago I worked for the then biggest payment service provider, BIBIT, we were part of the Royal Bank of Scotland and had a massive datacentre in Scotland, I am now unable to tell how big, only that it was huge.
Well every time Sony had a launch of some product (PS3, films, etc) they had to tell us in advance because they laid our whole datacentre flat. I recall once having to stay up in the middle of the night because we thought a massive DoS attack was going on as no other merchants were able to connect to our systems... and it was just that the idiots had forgotten to tell us in advance that they were going to send in payments for a new campaign.
This gives you and idea of how big they were already back then (and payment data is not very "heavy", just XML) and how chaotic they operate.
Sending out huge amounts of data would be of no concern at all for them, nobody would have noticed anything.
-- 29A the number of the Beast