Nation & World

How the U.S. traced the hacker trail from North Korea to Sony

South Korean army soldiers last month watched a TV news program reporting a shutdown of North Korean websites near the border village of Panmunjom in Paju, South Korea.
South Korean army soldiers last month watched a TV news program reporting a shutdown of North Korean websites near the border village of Panmunjom in Paju, South Korea. AP

The trail that led U.S. officials to blame North Korea for the destructive cyberattack on Sony Pictures Entertainment in November winds back to 2010, when the National Security Agency scrambled to break into the well-guarded computer systems of a country considered one of the most impenetrable targets on earth.

Spurred by growing concern about North Korea’s maturing capabilities, the U.S. spy agency drilled into the Chinese networks that connect North Korea to the outside world, picked through connections in Malaysia favored by North Korean hackers and penetrated directly into the North with the help of South Korea and other U.S. allies, according to former U.S. and foreign officials, computer experts briefed on the operations and a newly disclosed NSA document.

A classified security agency program expanded into an ambitious effort, officials said, to place malware that could track the internal workings of many of the computers and networks used by the North’s hackers, a force that South Korea’s military recently said numbers roughly 6,000 people. Most are commanded by the country’s main intelligence service, called the Reconnaissance General Bureau, and Bureau 121, its secretive hacking unit, with a large outpost in China.

The evidence gathered by the “early warning radar” of software painstakingly hidden to monitor North Korea’s activities proved critical in persuading President Barack Obama to accuse the government of Kim Jong Un of ordering the Sony attack, according to the officials and experts, who spoke on the condition of anonymity about the classified NSA operation.

Obama’s decision to accuse North Korea of ordering the attack and to promise retaliation, which has begun in the form of new economic sanctions, was highly unusual: The United States had never explicitly charged another government with mounting a cyberattack on American targets.

Obama is cautious in drawing stark conclusions from intelligence, aides say. But in this case “he had no doubt,” according to one senior U.S. military official.

“Attributing where attacks come from is incredibly difficult and slow,” said James A. Lewis, a cyberwarfare expert at the Center for Strategic and International Studies in Washington. “The speed and certainty with which the United States made its determinations about North Korea told you that something was different here — that they had some kind of inside view.”

For about a decade, the United States has implanted “beacons,” which can map a computer network, along with surveillance software and occasionally even destructive malware in the computer systems of foreign adversaries. The government spends billions of dollars on the technology, which was crucial to the American and Israeli attacks on Iran’s nuclear program. The documents previously disclosed by Edward Snowden, the former security agency contractor, demonstrated how widely they have been deployed against China.

The extensive American penetration of the North Korean system also raises questions about why the United States was not able to alert Sony as the attacks took shape last fall, even though the North had warned, as early as June, that the release of the movie “The Interview,” a crude comedy about a CIA plot to assassinate the North’s leader, would be “an act of war.”

The NSA’s success in getting into North Korea’s systems in recent years should have allowed the agency to see the first “spear phishing” attacks on Sony — the use of emails that put malicious code into a computer system if an unknowing user clicks on a link — when the attacks began in early September, according to two U.S. officials.

But those attacks did not look unusual. Only in retrospect did investigators determine that the North had stolen the “credentials” of a Sony systems administrator, which allowed the hackers to roam freely inside Sony’s systems.

In recent weeks, investigators have concluded that the hackers spent more than two months, from mid-September to mid-November, mapping Sony’s computer systems, identifying critical files and planning how to destroy computers and servers.

“They were incredibly careful and patient,” said one person briefed on the investigation. But he added that even with their view into the North’s activities, U.S. intelligence agencies “couldn’t really understand the severity” of the destruction that was coming when the attacks began Nov. 24.

Still, the sophistication of the Sony hack was such that many experts say they are skeptical that it was conducted by North Korea alone. They have suggested it was an insider, a disgruntled Sony ex-employee or an outside group cleverly mimicking North Korean hackers. Many remain unconvinced by the efforts of FBI Director James B. Comey to answer critics by disclosing some of the American evidence.

Comey told a Fordham University conference that the North Koreans got “sloppy” in hiding their tracks, and that hackers periodically “connected directly and we could see them.”

“And we could see that the IP addresses that were being used to post and to send the emails were coming from IPs that were exclusively used by the North Koreans,” he said. Some of those addresses appear to be in China, experts say.

The skeptics say, however, that it would not be that difficult for hackers who wanted to appear to be North Korean to fake their whereabouts. Comey said there was other evidence he could not discuss.

  Comments