4 Theories Regarding the Sony Hack

It’s been a little over two weeks since the U.S. government blamed North Korea for the cyber-attack against Sony Pictures, and Cybersecurity firms and hackers have continued to express doubts as to the legitimacy of these claims. Two cyber security firms, Norse Corporation and Cloud Flare, conducted independent investigations into the hack. Their results are in stark contrast to the FBI’s claim that Pyongyang carried out the hack.

However, the U.S. Government continues to implicated North Korea in the hacks against Sony Pictures saying that security companies offering alternate theories do not have an accurate understanding of the evidence.

Rather than settling the debate, the FBI’s claims have increased speculation as to who hacked Sony. Skeptics have claimed that evidence cited by the FBI is inconclusive and questioned whether Pyongyang had the ability, much less motivation to break into Sony’s servers. In a country where it’s estimated only a few thousand have access to the internet, with just over 1,000 IPv4 addresses and outdated technology, it’s hard to believe they were able to perform such a historic hack.

Here are a few of the top theories floating around.

Inside Job: Physically Hacked

HackersGotnews.com claims they “can confirm that North Korea was not behind the Sony hack”. Citing an investigation into the data they showed that over 200GB of data was copied over 5-6 hours on the night of November 21st. Using the time stamps of the released data they were able to come up with a rough transfer speed of around 480Mbit/s, which is the speed of a USB 2.0.

Their conclusion: The “hackers” were physically at a Sony LAN workstation and pulled the data from there. Got News went a step further citing that the same night of the data transfer Charles Sipkins, the Sony Pictures’ head of corporate communications, publicly resigned from his $600,000 job. Sipkins’s former client was NewsCorp and Sipkins was officially fired by Pascal’s husband over a snub by the Hollywood Reporter.

Inside Job: Remotely Hacked

Researchers from the security firm Norse allege that their investigation into the hacking uncovered evidence that leads, decisively, away from North Korea. Instead, Norse alleges that a group of six individuals are behind the hack, one of which was a former Sony Pictures employee that worked in a technical role and had knowledge of the company’s network and operations.

Using the HR data that was leaked out, Norse was able to identify employees that had been laid off during April-May. After identifying a former employee who was described as having a “very technical background”, researchers from Norse followed the individual online, noting angry posts she made on social media about the layoffs and Sony. The company further identified several suspect individuals through access to IRC forums and other sites. They were able to capture communications with known underground hacking and hacktivist groups in Europe and Asia.

Stammerberger, the Senior Vice President at Norse, was careful with the company’s finding, stating that they were hardly conclusive and may just add a wrinkle to the already wrinkled picture. Norse employees are reported to be briefing the FBI today about their finds.

“They’re the investigators. We’re going to show them our data and where it points us. As far as whether it is proof that would stand up in a court of law? That’s not our job to determine, it is theirs.” – Kurt Stammberger

When considering how hackers could have obtained near-perfect knowledge of Sony Pictures’ network and successfully siphon off terabytes of data, while remaining undetected – it raises concerns that someone on the inside was involved. According to Mark Rasch, a former federal prosecutor and a principal at Rasch Technology and Cyberlaw, “It has always been suspicious that it was North Korea,” Rasch said. “Not impossible – but doubtful…It made a lot more sense that it was insiders pretending to be North Korea.”

The Guardians of Peace (GOP) Framed North Korea

A group calling themselves the Guardians of Peace have taken credit for the cyberattack. Whoever the hackers are, they released gigabytes worth of stolen, private data since penetrating Sony’s defenses on Nov. 24. But neither the country of North Korea nor “The Interview” were explicitly referenced in the GOP’s original message:

“We’ve already warned you, and this is just a beginning. We continue till our request be met. We’ve obtained all your internal data including your secrets and top secrets. If you don’t obey us, we’ll release data shown below to the world.”

Taking into consideration the above theory, perhaps it was an inside job, one in which the GOP and insider teamed together and framed North Korea in order to cover their tracks. Evidence further supporting this is the software used in the hack.

After examining the malware used to infiltrate the studio, the FBI said it found similarities between that software and software used in previous cyber-attacks carried out by North Korea. But Jack Goldsmith, a Harvard Law Professor, who serves on the Hoover Institution Task Force on National Security and Law, is unconvinced.

“It is at least possible that some other nation is spoofing a North Korean attack,” he wrote Friday on the national security blog Lawfare. “For if the United States knows the characteristics or signatures of prior North Korean attacks, then so too might some third country that could use these characteristics or signatures.”

The most compelling evidence for this is that the threats against the movie The Interview were only made by the hackers after the media picked up on the possible connection between the movie and the hack.

North Korea Hacked Sony

The FBI hasn’t released all the evidence they have, and it’s entirely possible they are sitting on a smoking-gun that indisputably points back to North Korea. The FBI has issued this statement:

As a result of our investigation, and in close collaboration with other U.S. Government departments and agencies, the FBI now has enough information to conclude that the North Korean government is responsible for these actions. While the need to protect sensitive sources and methods precludes us from sharing all of this information, our conclusion is based, in part, on the following:

Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks.

The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. Government has previously linked directly to North Korea. For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack.

Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea.

The FBI’s press release says that the bureau’s conclusion is only based “in part” on the clues mentioned. This leaves the possibility that the U.S. government has classified evidence that North Korea is behind the attack. After all, the NSA has been trying to eavesdrop on North Korea’s government communications since the Korean War.

Images from Kobby Dagan and Shutterstock.

A UNC Chapel Hill graduate, blockchain enthusiast and analyst. I have a background in programming and IT, strong studies in econ, stats and game theory. I'm interested in online privacy and privacy laws.