,
10 tweets,
2 min read
Read on Twitter
The indictment about the Sony and Bangladesh bank attacks is 179 pages. Here are some first insights:
1/n
documentcloud.org/documents/4834…
1/n
documentcloud.org/documents/4834…
First, some remarks on methodology:
Compared to the GRU indictment from a few weeks earlier, this one contains less details about the individuals and their organization. E.g. it is not really clear how many "co-conspirators" are covered and how close their cooperation is.
2/n
Compared to the GRU indictment from a few weeks earlier, this one contains less details about the individuals and their organization. E.g. it is not really clear how many "co-conspirators" are covered and how close their cooperation is.
2/n
But: This indictment is much more transparent about the attribution and analysis methods than the GRU indictment.
Mostly, the methods are comparable to what security companies do: malware similarities, identifying shared encryption keys and shared email accounts.
3/n
Mostly, the methods are comparable to what security companies do: malware similarities, identifying shared encryption keys and shared email accounts.
3/n
Compared to analysis methods of security companies, the FBI gained a bit mor insight by getting access to collector email accounts and email subscriber records.
4/n
4/n
The difference between the Sony and GRU indictments (less suspects' details, more methodology details) hints at the possibility that the findings about GRU were not gained from classic malware and network analysis (see above), but from more confidential sources.
5/n
5/n
Now, about the findings themselves:
The main suspect supposedly worked for "Chosun Expo Joint Venture", which is called a front for the "Lab 110" of the North Korean government.
6/n
The main suspect supposedly worked for "Chosun Expo Joint Venture", which is called a front for the "Lab 110" of the North Korean government.
6/n
Apparently, the main subject did not just do hacking, but also did benign programming work for customers. This was probably a means to generate funds for the North Korean government and corroborates public reports about these fund generation methods.
7/n
7/n
These benign&hacking activities went on for several years, during which the suspect used the same email accounts for benign and malicious work projects. This _may_ be an indication that the difference between legal and illegal projects may not be very relevant for the suspect
8/n
8/n
The traced North Korean IP addresses are masked in the indictment, but allude to the public report by Group IB, who traced Lazarus connections to the Ryugyong Hotel in Pyongyang: group-ib.com/blog/lazarus
9/n
9/n
I had hoped that the indictment would shed more light on how exactly the Sony and Bangladesh Bank ("SWIFT" cases are related. But the links are similar to what security companies reported earlier: e.g. reused email accounts for spearphishing and malware similarities
10/n
10/n
