The National Security Agency has linked the North Korean government to the creation of the WannaCry computer worm that affected more than 300,000 people in some 150 countries last month, according to U.S. intelligence officials.
The assessment, which was issued internally last week and has not been made public, is based on an analysis of tactics, techniques and targets that point with moderate confidence to North Koreas spy agency, the Reconnaissance General Bureau, according to an individual familiar with the report.
The assessment states that cyber actors suspected to be sponsored by the RGB were behind two versions of WannaCry, a worm that was built around an NSA hacking tool that had been obtained and posted online last year by an anonymous group calling itself the Shadow Brokers.
[NSA officials worried about the day its potent hacking tool would get loose. Then it did.]
It was the first computer worm to be paired with ransomware, which encrypts data on victims computers and demands a ransom to restore access.
WannaCry was apparently an attempt to raise revenue for the regime, but analysts said the effort was flawed. Though the hackers raised $140,000 in bitcoin, a form of digital currency, so far they have not cashed it in, the analysts said. That is likely because an operational error has made the transactions easy to track, including by law enforcement.
As a result, no online currency exchange will touch it, said Jake Williams, founder of Rendition Infosec, a cybersecurity firm. This is like knowingly taking tainted bills from a bank robbery, he said.
[Clues point to possible North Korean involvement in massive ransomware attack]
Though the assessment is not conclusive, the preponderance of the evidence points to Pyongyang. It includes the range of computer Internet protocol addresses in China historically used by the RGB, and the assessment is consistent with intelligence gathered recently by other Western spy agencies. It states that the hackers behind WannaCry are also called the Lazarus Group, a name used by private-sector researchers.
One of the agencies reported that a prototype of WannaCry ransomware was found this spring in a non-Western bank. That data point was a building block for the North Korea assessment, the individual said.
The linkage shows that despite the Obama and Trump administrations efforts to deter North Korean aggression, the country does not appear to have been discouraged from launching one of the most wide-ranging cyberattacks the world has seen.
What it really confirms is that ... you dont have to be the best in the business to cause a lot of disruption, said Michael Sulmeyer, director of the cybersecurity project at Harvards Kennedy School. And thats what they showed they were willing and able to do.
The NSA declined to comment.
North Korea is one of the worlds most isolated countries, with very little computer infrastructure. Yet it has managed to deploy cyber capabilities to harass and annoy its rival, South Korea, and to generate revenue for the authoritarian regime.
Last year, security researchers identified North Korea as the culprit behind a series of cyber-enabled heists of banks in Asia, including one in Bangladesh that netted more than $81 million by manipulating the banks global payments messaging system.
The fact of a nation-state using cyber tools to rob banks, then-NSA Deputy Director Richard Ledgett said in March, represented a troubling new front in cyberwarfare. He did not name North Korea, but the allusion was clear. This is a big deal, he said.
North Korea in 2014 hacked Sony Pictures Entertainment and demanded that the movie studio pull a film that satirized the countrys leader, Kim Jong Un. The hackers disabled computers and released embarrassing company emails. But what tipped the scale for President Barack Obama was the threat to do more damage if the studio did not yank the movie a move that the administration viewed as an assault on free speech. The administration publicly blamed Pyongyang for the attack and imposed new economic sanctions on the regime.
The NSA cyber tool at the base of WannaCry was an exploit dubbed EternalBlue by the agency. It took advantage of a software flaw in some Microsoft Windows operating systems and enabled an attacker to gain access to those computers.
Although Microsoft, after being notified by the NSA, issued a patch for the software flaw in March, many companies around the world and some in the United States failed to update their machines and fell victim to the virus. Michael Daniel, president of the Cyber Threat Alliance, a nonprofit group devoted to improving cyberdefenses through data sharing, said there were a reasonable number of victims in the United States.
Microsoft declined to comment for this report.
Williams, who has closely studied the code, said he is convinced that the ransomware accidentally got loose in a testing phase. That would explain some of its shortcomings, such as an inability for the attacker to tell who has paid the ransom or not, he said.
Nonetheless, he said, this is a case where youve got a weaponized, government-sponsored exploit [or hacking tool] being used to deliver ransomware. If North Korea goes unchecked with this, I would expect other developing nations to follow suit. I think that would change the cyberthreat landscape quite a bit.
Daniel, who was Obamas cybersecurity coordinator, said there needs to be a broad-based approach to deterring North Korea across the board in the physical world and in cyberspace.
Federal prosecutors have been probing North Koreas role in the Bangladesh bank theft, and indictments could be issued. The Justice Department in recent years has used indictments as a tool to try to hold accountable hackers from other nation states, including China and Iran.
Rep. Adam B. Schiff (Calif.), the top Democrat on the House Intelligence Committee, which is investigating Russian interference in the 2016 election, has said that the Obama administrations response to North Korea after the Sony attack was not bold enough. I ... think the Russians were watching and decided that, well, we didnt respond to that. They could get away with a cyberattack, he said at a recent public discussion with Washington Post columnist David Ignatius.
When the South Koreans want to respond to North Korea, Schiff said, they use a form of information warfare. They do it with loudspeakers, he said. They do it by telling people in the North what a terrible regime they live under thats starving their own people.
See the rest here:
The NSA has linked the WannaCry computer worm to North Korea ... - Washington Post