Attacks/Breaches

12/20/2017
04:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attack Attribution Tricky Say Some as US Blames North Korea for WannaCry

There's not enough evidence to conclusively tie the rogue regime to the ransomware attacks, some security experts say.

The US government's assertion this week that North Korea is behind the WannaCry ransomware attacks of earlier this year has surfaced familiar concerns about the tricky nature of attack attribution in cyberspace.

Some security industry experts believe there's not enough evidence - at least not enough that's publicly available - to definitively tie the government in North Korea to the attacks. They believe that most of the clues that have been cited as evidence of North Korea's involvement in an attack that ravaged some 300,000 computers worldwide, is circumstantial and can have other explanations.

"The evidence is weak," says Ross Rustici, senior director of intelligence services at Boston-based cybersecurity firm Cybereason. "Without the initial source or any way to tie the code to an actual person we cannot do real attribution." 

The Trump Administration's homeland security advisor Thomas Bossert on Monday identified North Korea as being directly responsible for the WannaCry attack, which infected computers in 150 countries. In an opinion column for the Wall Street Journal, Bossert said the US government has evidence that shows a direct link between Pyongyang and the attacks.

He did not reveal what additional information the government might have obtained - other than what is already publicly known - to arrive at the conclusion. But he asserted that other governments and private companies agree with the US assessment. "The United Kingdom attributes the attack to North Korea, and Microsoft traced the attack to cyber affiliates of the North Korean government," he said.

In a blog Tuesday, Microsoft president and chief legal officer Brad Smith expressed support for the US government's decision to formally name North Korea. Smith said that Microsoft had recently conducted an operation with Facebook and others to disrupt the activities of the Lazarus Group, a threat actor previously linked to North Korea.

The Lazarus Group is believed responsible for numerous worldwide attacks in recent years, most notably the one on Sony Pictures in 2014 and the more recent attacks on numerous banks via the SWIFT financial network. Microsoft investigations showed the group is also directly responsible for the WannaCry attacks, Smith said. "If the rising tide of nation-state attacks on civilians is to be stopped, governments must be prepared to call out the countries that launch them," Smith noted.  "Today’s announcement represents an important step in government and private sector action to make the Internet safer," he said referring to Bossert's comments.

Symantec is another company that has definitively linked WannaCry to the Lazarus Group. But it has stopped short of saying the group is linked to the North Korean government or is being sponsored by it. In fact, it has explicitly stated that the information it has is not enough to conclusively attribute the attacks to a specific nation state.

In a report earlier this year, Symantec said it found three malware samples linked to Lazarus on the network of a WannaCry victim. One of them was a disk-wiping tool used in the Sony attacks. Symantec said that a Trojan that was used to spread WannaCry in March and April was a modified version of malware previously used by Lazarus. Similarly, IP addresses for command and control and code obfuscation methods used in WannaCry have Lazarus links, as does code between WannaCry and a backdoor Trojan used in other attacks.

"Symantec has little doubt that WannaCry was developed by members of the Lazarus group," says Vikram Thakur, technical director at Symantec. "Our attribution to the group is based purely on technical analysis of WannaCry’s different versions along with threats we’ve observed and researched over multiple years."

Thakur says he has no insight on why the US government decided to go public with its accusation against North Korea at this time. But he notes that it happened on exactly the third anniversary to the date when the government previously accused North Korea of its involvement in the Sony hacks. "There is a good chance that Lazarus will get more aggressive in the short run, as a sign of disregard to public government statements," he says.

Cybereason's Rustici says there's not enough evidence to attribute WannaCry to the North Korean government or its Reconnaissance General Bureau (RGB). Given the rampant code reuse among threat groups and the highly cobbled-together nature of malware used in campaigns these days, it is hard to definitively attribute an attack based just on similarities in code, Rustici says. The fact that Lazarus code was found on the networks of some WannaCry victims is only correlation and not causation, he says.

Others in the past have also noted how easy it is for attackers to plant false flags in order to throw investigators off track and to make it appear like an attack were launched by someone else.

Other facets about the WannaCry attack also make North Korea an unlikely perpetrator, Rustici says. Two of the biggest victims of the attacks were Russia and China, both of which are nations that have been relatively sympathetic to North Korea, while the nation's biggest adversaries—the US, South Korea, and Japan—were relatively untouched. North Korea’s only Internet access transits China and Russia as well, making it unlikely the nation would want to antagonize them.

Considering Pyongyang's strategic objectives, it is unlikely they would have launched a campaign that did not inflict more direct damage on the US, Japan, and South Korea he says.

Tim Erlin, vice president of product management at Tripwire, says that when a government attributes a cyberattack on another nation, there needs to be a way for others to independently verify the evidence.

"Clearly government security groups can't directly share the evidence they've collected," he concedes. But there has to be a way to engender trust in the analysis without endangering national security, he says. "Developing a consortium of qualified, non-governmental experts who can review the detailed data and share their level of confidence in the conclusions would go a long way to establishing trust," Erlin says.

Related content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7715
PUBLISHED: 2019-03-26
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The main shell handler function uses the value of the environment variable ipcom.shell.greeting as the first argument to printf(). Setting this variable using the sysvar command results in a user-c...
CVE-2019-8981
PUBLISHED: 2019-03-26
tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the need_bytes value is mismanaged.
CVE-2019-10061
PUBLISHED: 2019-03-26
utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
CVE-2019-7711
PUBLISHED: 2019-03-26
An issue was discovered in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. The undocumented shell command "prompt" sets the (user controlled) shell's prompt value, which is used as a format string input to printf, resulting in an information leak of memory addre...
CVE-2019-7712
PUBLISHED: 2019-03-26
An issue was discovered in handler_ipcom_shell_pwd in the Interpeak IPCOMShell TELNET server on Green Hills INTEGRITY RTOS 5.0.4. When using the pwd command, the current working directory path is used as the first argument to printf() without a proper check. An attacker may thus forge a path contain...