Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/20/2017
04:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attack Attribution Tricky Say Some as US Blames North Korea for WannaCry

There's not enough evidence to conclusively tie the rogue regime to the ransomware attacks, some security experts say.

The US government's assertion this week that North Korea is behind the WannaCry ransomware attacks of earlier this year has surfaced familiar concerns about the tricky nature of attack attribution in cyberspace.

Some security industry experts believe there's not enough evidence - at least not enough that's publicly available - to definitively tie the government in North Korea to the attacks. They believe that most of the clues that have been cited as evidence of North Korea's involvement in an attack that ravaged some 300,000 computers worldwide, is circumstantial and can have other explanations.

"The evidence is weak," says Ross Rustici, senior director of intelligence services at Boston-based cybersecurity firm Cybereason. "Without the initial source or any way to tie the code to an actual person we cannot do real attribution." 

The Trump Administration's homeland security advisor Thomas Bossert on Monday identified North Korea as being directly responsible for the WannaCry attack, which infected computers in 150 countries. In an opinion column for the Wall Street Journal, Bossert said the US government has evidence that shows a direct link between Pyongyang and the attacks.

He did not reveal what additional information the government might have obtained - other than what is already publicly known - to arrive at the conclusion. But he asserted that other governments and private companies agree with the US assessment. "The United Kingdom attributes the attack to North Korea, and Microsoft traced the attack to cyber affiliates of the North Korean government," he said.

In a blog Tuesday, Microsoft president and chief legal officer Brad Smith expressed support for the US government's decision to formally name North Korea. Smith said that Microsoft had recently conducted an operation with Facebook and others to disrupt the activities of the Lazarus Group, a threat actor previously linked to North Korea.

The Lazarus Group is believed responsible for numerous worldwide attacks in recent years, most notably the one on Sony Pictures in 2014 and the more recent attacks on numerous banks via the SWIFT financial network. Microsoft investigations showed the group is also directly responsible for the WannaCry attacks, Smith said. "If the rising tide of nation-state attacks on civilians is to be stopped, governments must be prepared to call out the countries that launch them," Smith noted.  "Today’s announcement represents an important step in government and private sector action to make the Internet safer," he said referring to Bossert's comments.

Symantec is another company that has definitively linked WannaCry to the Lazarus Group. But it has stopped short of saying the group is linked to the North Korean government or is being sponsored by it. In fact, it has explicitly stated that the information it has is not enough to conclusively attribute the attacks to a specific nation state.

In a report earlier this year, Symantec said it found three malware samples linked to Lazarus on the network of a WannaCry victim. One of them was a disk-wiping tool used in the Sony attacks. Symantec said that a Trojan that was used to spread WannaCry in March and April was a modified version of malware previously used by Lazarus. Similarly, IP addresses for command and control and code obfuscation methods used in WannaCry have Lazarus links, as does code between WannaCry and a backdoor Trojan used in other attacks.

"Symantec has little doubt that WannaCry was developed by members of the Lazarus group," says Vikram Thakur, technical director at Symantec. "Our attribution to the group is based purely on technical analysis of WannaCry’s different versions along with threats we’ve observed and researched over multiple years."

Thakur says he has no insight on why the US government decided to go public with its accusation against North Korea at this time. But he notes that it happened on exactly the third anniversary to the date when the government previously accused North Korea of its involvement in the Sony hacks. "There is a good chance that Lazarus will get more aggressive in the short run, as a sign of disregard to public government statements," he says.

Cybereason's Rustici says there's not enough evidence to attribute WannaCry to the North Korean government or its Reconnaissance General Bureau (RGB). Given the rampant code reuse among threat groups and the highly cobbled-together nature of malware used in campaigns these days, it is hard to definitively attribute an attack based just on similarities in code, Rustici says. The fact that Lazarus code was found on the networks of some WannaCry victims is only correlation and not causation, he says.

Others in the past have also noted how easy it is for attackers to plant false flags in order to throw investigators off track and to make it appear like an attack were launched by someone else.

Other facets about the WannaCry attack also make North Korea an unlikely perpetrator, Rustici says. Two of the biggest victims of the attacks were Russia and China, both of which are nations that have been relatively sympathetic to North Korea, while the nation's biggest adversaries—the US, South Korea, and Japan—were relatively untouched. North Korea’s only Internet access transits China and Russia as well, making it unlikely the nation would want to antagonize them.

Considering Pyongyang's strategic objectives, it is unlikely they would have launched a campaign that did not inflict more direct damage on the US, Japan, and South Korea he says.

Tim Erlin, vice president of product management at Tripwire, says that when a government attributes a cyberattack on another nation, there needs to be a way for others to independently verify the evidence.

"Clearly government security groups can't directly share the evidence they've collected," he concedes. But there has to be a way to engender trust in the analysis without endangering national security, he says. "Developing a consortium of qualified, non-governmental experts who can review the detailed data and share their level of confidence in the conclusions would go a long way to establishing trust," Erlin says.

Related content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "SpearPhish! Everyone out of the office!"
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10100
PUBLISHED: 2019-07-17
tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab.
CVE-2019-12175
PUBLISHED: 2019-07-17
In Zeek Network Security Monitor (formerly known as Bro) before 2.6.2, a NULL pointer dereference in the Kerberos (aka KRB) protocol parser leads to DoS because a case-type index is mishandled.
CVE-2019-12475
PUBLISHED: 2019-07-17
In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.
CVE-2019-13346
PUBLISHED: 2019-07-17
In MyT 1.5.1, the User[username] parameter has XSS.
CVE-2019-13403
PUBLISHED: 2019-07-17
Temenos CWX version 8.9 has an Broken Access Control vulnerability in the module /CWX/Employee/EmployeeEdit2.aspx, leading to the viewing of user information.