North Korea, hack

North Korean hackers have been implicated as the source of several high profile attacks recently. Source: Shutterstock

North Korean hackers ‘highly likely’ behind WannaCry attack – Symantec

By | 23 May, 2017

CYBERSECURITY firm Symantec Corp said on Monday it was “highly likely” a hacking group affiliated with North Korea was behind the WannaCry cyber attack this month, which infected more than 300,000 computers worldwide and disrupted operations at hospitals, banks and schools across the globe.

Symantec researchers said they had found multiple instances of code that had been used both in the North Korean group’s previous activity and in early versions of WannaCry.

In addition, the same Internet connection was used to install an early version of WannaCry on two computers and to communicate with a tool that destroyed files at Sony Pictures Entertainment. The United States government and private companies have accused North Korea in the 2014 Sony attack.

At the same time, flaws in the WannaCry code, its wide spread and its demands for payment in the electronic bitcoin before files are decrypted suggest the hackers were not working for North Korean government objectives in this case, said Symantec‘s security response technical director Vikram Thakur.

SEE ALSO: Asia Pacific braces for next wave as cyberattack fallout continues

“Our confidence is very high this is the work of people associated with the Lazarus Group because they had to have source code access,” Thakur said in an interview.

“We don’t think this is an operation run by a nation-state.”

Lazarus is the name many security companies gave to the hacking group behind the Sony attack and others. By custom, Symantec does not attribute cyber campaigns directly to governments, but its researchers did not dispute the common belief Lazarus works for North Korea.

With WannaCry, Thakur said, Lazarus Group members could have been moonlighting to make extra money, or they could have left government service, or they could have been contractors without direct obligations to serve only the government.

The most effective version of WannaCry spread via a flaw in Microsoft Windows and a program that took advantage of it that had been used by the US National Security Agency, officials said privately.

SEE ALSO: Real winners of the WannaCry ransomware attack? Insurance companies

That program was among a batch leaked or stolen and then dumped online by a group calling itself The Shadow Brokers, who some in U.S. intelligence believe to be affiliated with Russia.

Analysts have been weighing in with various theories on the identity of those behind WannaCry, and some early evidence had pointed to North Korea. The Shadow Brokers endorsed that theory, perhaps to take heat off their own government backers for the disaster.

WannaCry exploited a Windows networking protocol, which allowed the ransomware to spread within networks. Source: Shutterstock

Beau Woods, deputy director of the Cyber Statecraft Initiative at the Atlantic Council, said the Korean language used in some versions of the WannaCry ransom note was not that of a native speaker, making a Lazarus connection unlikely.

But Thakur said some hackers deliberately obfuscate their language to make tracing them harder. It is also possible the writer in question was a contractor in another country, he said.

SEE ALSO: Best cybersecurity solutions for keeping threats at bay

Thakur said a less likely scenario is that Lazarus’ main aim was to create chaos by distributing WannaCry.

If the hackers’ main objective was to earn money on the side, that would suggest an undisciplined hacking operation run by North Korea, one that could be exploited and weakened by the country’s many foes.

“The intelligence community will probably take away from this that there is a possibility of splinters in the Lazarus Group, or members who are interested in filling their own pockets, and that could help,” Thakur said. – Reuters



By

READ MORE