Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/15/2017
06:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

NSA Reportedly Confident North Korea Was Behind WannaCry

But some say no evidence exists to unequivocally pin blame for attacks on Pyongyang.

The US National Security Agency (NSA) appears to have joined the ranks of those convinced that the North Korean government was behind the recent WannaCry ransomware epidemic even as many others remain skeptical of that conclusion.

The Washington Post Wednesday reported that NSA officials have determined with "moderate confidence" that the tactics and techniques used in the WannaCry attacks point to the Reconnaissance General Bureau, the North Korean intelligence agency. The motive for the attacks apparently was to try and raise money in the form of ransom payments from victims, the Washington Post said, citing sources within the NSA.

The NSA's assessment of WannaCry concludes that threat actors sponsored by the North Korean intelligence agency created two versions of WannaCry.

News of the NSA's reported analysis coincides with a somewhat oddly timed released this week of a US-CERT technical analysis linking the North Korean government to a botnet used to launch DDoS attacks worldwide.

Together, the developments suggest that the US government could be making a case for some sort of retaliatory action against the North Korean government for its alleged misbehavior in cyberspace, though it is too early to know for sure. Such a move would certainly jibe with the Trump Administration's overall get-tough stance against Pyongyang over the isolated nation's controversial missile program.

WannaCry crypto ransomware infected over 300,000 Windows computers worldwide earlier this year using a leaked NSA exploit dubbed EternalBlue to propagate itself to vulnerable systems.

The US government's apparent conclusions about its origins have at least some measure of support within the security industry. At a Congressional hearing Thursday on the lessons learned from the WannaCry outbreak, a senior executive from Symantec reiterated statements the company has made previously about its belief that North Korea had a hand in the attacks.

"There were very, very close similarities to other kinds of attacks we have seen, specifically attacks we attribute to a group called Lazarus," said Hugh Thompson in his testimony before the Joint Subcommittee on Oversight and Subcommittee on Research and Technology hearing.

"The malware, the reuse of strings in that malware the reuse of command and control infrastructure out on the Internet by that malware led our researchers to believe there is a strong link to the Lazarus group," which the FBI has linked to North Korea, he said. The same group was linked to the attacks on Sony and to the more than $81 million cyberheist from the Bank of Bangladesh last year, he said.

Other security experts are less sure of the connection and say there's not enough evidence available to unequivocally attribute the attacks to North Korea.

"We think it is ambiguous to conjecture over the origins of WannaCry," Salim Neino, chief executive officer of Kryptos Logic, said in his testimony at the hearing. Some of the pieces of code used in the WannaCry attacks suggest that a nation-state actor was involved. According to Neino, WannaCry may have impacted as many as 2 million systems worldwide, which is considerably more than previous estimates.

"But unfortunately, anyone could have created this level of attack," and then made it look like North Korea was behind it, he said. "I would compare it perhaps to photo-shopping a program to make it look a certain way. Or, it could have simply been what it is. What I can say is these attacks are very difficult to attribute," he noted.

Others have suggested that the authors of WannaCry have a Chinese connection. Security vendor FlashPoint, for instance, says its linguistic analysis of the 28 ransomware messages used in the WannaCry attacks suggest the authors are from China or are Chinese-speaking.

"Many researchers have linked the WannaCry malware to the “Lazarus Group,” which is itself believed affiliated with North Korea," FlashPoint said in a separate intelligence report earlier this month. "Flashpoint’s own analysis of the 28 odd foreign language ransom notes, however, strongly suggests a Chinese-speaking author of the notes themselves," the note said. "These two findings—the link to North Korea and a Chinese-speaking author of the ransom notes—are not mutually exclusive, however," the company added.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
cybersavior
100%
0%
cybersavior,
User Rank: Strategist
6/16/2017 | 2:54:43 PM
Headline:
"U.S. government accuses North Korea of unleashing a malware attack that was devised from computer exploits developed by the U.S. government for attacking computers"
Armanor
50%
50%
Armanor,
User Rank: Apprentice
6/16/2017 | 2:01:04 AM
Question about WannaCry
Does WannaCry only target companies or can it attack everybody ? I thought it was only targeting companies
The Problem with Proprietary Testing: NSS Labs vs. CrowdStrike
Brian Monkman, Executive Director at NetSecOPEN,  7/19/2019
RDP Bug Takes New Approach to Host Compromise
Kelly Sheridan, Staff Editor, Dark Reading,  7/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14248
PUBLISHED: 2019-07-24
In libnasm.a in Netwide Assembler (NASM) 2.14.xx, asm/pragma.c allows a NULL pointer dereference in process_pragma, search_pragma_list, and nasm_set_limit when "%pragma limit" is mishandled.
CVE-2019-14249
PUBLISHED: 2019-07-24
dwarf_elf_load_headers.c in libdwarf before 2019-07-05 allows attackers to cause a denial of service (division by zero) via an ELF file with a zero-size section group (SHT_GROUP), as demonstrated by dwarfdump.
CVE-2019-14250
PUBLISHED: 2019-07-24
An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.
CVE-2019-14247
PUBLISHED: 2019-07-24
The scan() function in mad.c in mpg321 0.3.2 allows remote attackers to trigger an out-of-bounds write via a zero bitrate in an MP3 file.
CVE-2019-2873
PUBLISHED: 2019-07-23
Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.2.32 and prior to 6.0.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox...