Many experts aren’t buying the theory that North Korea is behind Sony hack

THE FBI has officially blamed the Sony hack on North Korea, but a lot of very smart people think the FBI is lying to the world. Why?

IT’S one of the most tantalising and juicy stories of the year. According to the official narrative, The Democratic People’s Republic of Korea executed a sophisticated cyber attack on Sony Pictures, leaking secret documents and issuing threats all because they were disgruntled about a satirical movie depicting the assassination of their dear leader.

It’s a story that is even more fitting of a cinematic spoof than the actual film in question.

While the FBI has officially linked North Korea to the hack, the evidence isn’t strong and despite the natural inclination for the world to want to believe the supreme authority of the FBI, it wouldn’t be the first time the government body has misled the public.

So is it actually true? Is North Korea the culprit or just a convenient scapegoat? A lot of very informed people don’t believe the FBI’s story.

Actor Randall Park portrays North Korean leader Kim Jong Un in Columbia Pictures' "The Interview."

Pinning the Sony hack on Kim Jong Un’s goons is certainly politically convenient but a number of independent security experts have been poking holes in the theory for days now.

Security consultant Dan Tentler quickly refuted the evidence put forth by the FBI, saying that the malware tools identified in the attack which were linked to North Korea were “purchasable” and presumably could have been bought and used by anyone.

A former member of the notorious hacker group Anonymous said in an interview with CBS, “look at the bandwidth going into North Korea. I mean, the pipelines, the pipes going in, handling data, they only have one major ISP across their entire nation. That kind of information flowing at one time would have shut down North Korean internet completely.”

Sony has received heavy criticism for capitulating to the cyber attackers.

One of the weightiest rebuttals of the case against North Korea is that of renowned hacker, DEFCON organiser, and CloudFlare researcher Marc Roges who outlined his scepticism in a 10 point blog post.

The hackers have called themselves Guardians of the Peace and the broken English in the posts they’ve left behind has been questionable, and Mr. Rodgers isn’t buying it.

“The broken English looks deliberately bad and doesn’t exhibit any of the classic comprehension mistakes you actually expect to see in “Konglish”. i.e. it reads to me like an English speaker pretending to be bad at writing English,” he wrote.

Mr. Rodgers posits that it is far more likely to be someone who had intimate knowledge of Sony’s system and points to the likelihood of a disgruntled (possibly ex) employee of Sony.

“It’s clear from the hard-coded paths and passwords in the malware that whoever wrote it had extensive knowledge of Sony’s internal architecture and access to key passwords.”

The idea that it could be the work of a Sony insider is somewhat bolstered by the early nature of the hacks which took on a revenge-like quality and also offered the chance for some Sony employees not to have personally embarrassing information leaked.

Mr. Rodgers views the threats around the release of Seth Rogen’s movie as a classic piece of opportunistic misdirection by the hackers.

“The attackers only latched onto “The Interview” after the media did — the film was never mentioned by GOP right at the start of their campaign. It was only after a few people started speculating in the media that this and the communication from DPRK “might be linked” that suddenly it became linked,” he wrote.

Even after the FBI presented their evidence against North Korea, Mr. Rodgers was even less convinced saying it showed “a fundamental misunderstanding of how the internet works and in particular how hackers operate.”

You couldn’t ask for better publicity for a film premier.

The notion that ‘The Interview’ is a red herring is supported by Kim Zetter of Wired magazine. She points out that an extortion e-mail sent to Sony execs three days before the hack sought “monetary compensation” and made absolutely no mention of the film. “It appears to be an attempt at extortion, not an expression of political outrage or a threat of war,” she wrote.

Harvard law professor and security expert, Jake Goldsmith also has reservations about the FBI’s official theory and the tenuous evidence that underpins it.

“The “evidence” is of the most conclusory nature — it is really just unconfirmed statements by the USG,” he wrote.

Joining the chorus of naysayers is Peter W. Singer, one of America’s foremost experts on cybersecurity. The author of Cybersecurity and Cyberwar: What Everyone Needs to Know, said the evidence against North Korea is “contextual.” “It wouldn’t meet the level needed in a court of law,” he said.

The promotional movie posters evoke propagandist imagery. But these days propaganda is far more subtle ...

North Korean officials have denied involvement with the Sony hacks but that has been in stark contrast to the comical behaviour of the hackers signing off an e-mail as “North Korean Hacking Team.”

Seriously.

There is a commonly used credo among hackers that they are motivated by ‘the lulz’ — an internet parlance for amusement. And deflecting the world’s accusations onto Kim Jong Un would certainly be a serious amount of lulz.