Attacks/Breaches

12/20/2017
04:25 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Attack Attribution Tricky Say Some as US Blames North Korea for WannaCry

There's not enough evidence to conclusively tie the rogue regime to the ransomware attacks, some security experts say.

The US government's assertion this week that North Korea is behind the WannaCry ransomware attacks of earlier this year has surfaced familiar concerns about the tricky nature of attack attribution in cyberspace.

Some security industry experts believe there's not enough evidence - at least not enough that's publicly available - to definitively tie the government in North Korea to the attacks. They believe that most of the clues that have been cited as evidence of North Korea's involvement in an attack that ravaged some 300,000 computers worldwide, is circumstantial and can have other explanations.

"The evidence is weak," says Ross Rustici, senior director of intelligence services at Boston-based cybersecurity firm Cybereason. "Without the initial source or any way to tie the code to an actual person we cannot do real attribution." 

The Trump Administration's homeland security advisor Thomas Bossert on Monday identified North Korea as being directly responsible for the WannaCry attack, which infected computers in 150 countries. In an opinion column for the Wall Street Journal, Bossert said the US government has evidence that shows a direct link between Pyongyang and the attacks.

He did not reveal what additional information the government might have obtained - other than what is already publicly known - to arrive at the conclusion. But he asserted that other governments and private companies agree with the US assessment. "The United Kingdom attributes the attack to North Korea, and Microsoft traced the attack to cyber affiliates of the North Korean government," he said.

In a blog Tuesday, Microsoft president and chief legal officer Brad Smith expressed support for the US government's decision to formally name North Korea. Smith said that Microsoft had recently conducted an operation with Facebook and others to disrupt the activities of the Lazarus Group, a threat actor previously linked to North Korea.

The Lazarus Group is believed responsible for numerous worldwide attacks in recent years, most notably the one on Sony Pictures in 2014 and the more recent attacks on numerous banks via the SWIFT financial network. Microsoft investigations showed the group is also directly responsible for the WannaCry attacks, Smith said. "If the rising tide of nation-state attacks on civilians is to be stopped, governments must be prepared to call out the countries that launch them," Smith noted.  "Today’s announcement represents an important step in government and private sector action to make the Internet safer," he said referring to Bossert's comments.

Symantec is another company that has definitively linked WannaCry to the Lazarus Group. But it has stopped short of saying the group is linked to the North Korean government or is being sponsored by it. In fact, it has explicitly stated that the information it has is not enough to conclusively attribute the attacks to a specific nation state.

In a report earlier this year, Symantec said it found three malware samples linked to Lazarus on the network of a WannaCry victim. One of them was a disk-wiping tool used in the Sony attacks. Symantec said that a Trojan that was used to spread WannaCry in March and April was a modified version of malware previously used by Lazarus. Similarly, IP addresses for command and control and code obfuscation methods used in WannaCry have Lazarus links, as does code between WannaCry and a backdoor Trojan used in other attacks.

"Symantec has little doubt that WannaCry was developed by members of the Lazarus group," says Vikram Thakur, technical director at Symantec. "Our attribution to the group is based purely on technical analysis of WannaCry’s different versions along with threats we’ve observed and researched over multiple years."

Thakur says he has no insight on why the US government decided to go public with its accusation against North Korea at this time. But he notes that it happened on exactly the third anniversary to the date when the government previously accused North Korea of its involvement in the Sony hacks. "There is a good chance that Lazarus will get more aggressive in the short run, as a sign of disregard to public government statements," he says.

Cybereason's Rustici says there's not enough evidence to attribute WannaCry to the North Korean government or its Reconnaissance General Bureau (RGB). Given the rampant code reuse among threat groups and the highly cobbled-together nature of malware used in campaigns these days, it is hard to definitively attribute an attack based just on similarities in code, Rustici says. The fact that Lazarus code was found on the networks of some WannaCry victims is only correlation and not causation, he says.

Others in the past have also noted how easy it is for attackers to plant false flags in order to throw investigators off track and to make it appear like an attack were launched by someone else.

Other facets about the WannaCry attack also make North Korea an unlikely perpetrator, Rustici says. Two of the biggest victims of the attacks were Russia and China, both of which are nations that have been relatively sympathetic to North Korea, while the nation's biggest adversaries—the US, South Korea, and Japan—were relatively untouched. North Korea’s only Internet access transits China and Russia as well, making it unlikely the nation would want to antagonize them.

Considering Pyongyang's strategic objectives, it is unlikely they would have launched a campaign that did not inflict more direct damage on the US, Japan, and South Korea he says.

Tim Erlin, vice president of product management at Tripwire, says that when a government attributes a cyberattack on another nation, there needs to be a way for others to independently verify the evidence.

"Clearly government security groups can't directly share the evidence they've collected," he concedes. But there has to be a way to engender trust in the analysis without endangering national security, he says. "Developing a consortium of qualified, non-governmental experts who can review the detailed data and share their level of confidence in the conclusions would go a long way to establishing trust," Erlin says.

Related content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
The Case for a Human Security Officer
Ira Winkler, CISSP, President, Secure Mentem,  12/5/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8651
PUBLISHED: 2018-12-12
A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV.
CVE-2018-8652
PUBLISHED: 2018-12-12
A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1.
CVE-2018-8617
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8618
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8619
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, aka "Internet Explorer Remote Code Execution Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Exp...