WATCH ABOVE: Sony Pictures is throwing in the towel. The Hollywood movie studio is cancelling the release of the controversial new comedy, “The Interview”. CBS News has learned the federal government will officially implicate the North Korean government for the cyber attack. Don Champion reports.
WASHINGTON – Federal investigators have now connected the Sony Pictures Entertainment Inc. hacking to North Korea, a U.S. official said Wednesday, though it remained unclear how the federal government would respond to a break-in that exposed sensitive documents and ultimately led to terrorist threats against moviegoers.
The official, who said a more formal statement could come in the near future, spoke on condition of anonymity because the official was not authorized to openly discuss an ongoing criminal case.
Until Wednesday, the Obama administration had been saying it was not immediately clear who might have been responsible for the computer break-in. North Korea has publicly denied it was involved.
READ MORE: Some U.S. theatres pull ‘The Interview’ following hacker threats
The unidentified hackers had demanded that Sony cancel its upcoming release of the movie “The Interview,” a comedy starring Seth Rogen and James Franco that included a gruesome scene depicting the assassination of North Korea’s leader. Sony on Wednesday cancelled the Dec. 25 release, citing the threats of violence against movie theatres, and the movie studio later said there were no further plans to release the film.
The disclosure about North Korea’s involvement came just after Sony hired FireEye Inc.’s Mandiant forensics unit, which last year published a landmark report with evidence accusing a Chinese Army organization, Unit 61398, of hacking into more than 140 companies over the years. Tracing the origins of hacker break-ins and identities of those responsible is exceedingly difficult and often involves surmise and circumstantial evidence, but Mandiant’s work on its highly regarded China investigation provides some clues to its methods.
WATCH ABOVE: North Korea has long history of cyber-attacks
Investigators will disassemble any hacking tools left behind at the crime scene and – similar to bomb detectives – scour them for unique characteristics that might identify who built or deployed them. Hints about origin might include a tool’s programming code, how or when it was activated and where in the world it transmitted any stolen materials.
READ MORE: Ex Sony Pictures workers file class-action suit over email hacks
In some cases, investigators will trace break-ins by hackers to “command and control” computers or web servers, and logs in those machines or information in Internet registration records might provide further clues about who is behind the hack. Sometimes, hackers using aliases are identified on social media networks or in chat rooms discussing targets or techniques. Mandiant named three Chinese Army hackers, including one known as “Ugly Gorilla.”
The most sophisticated tools or specialized techniques are generally attributed to the work of governments – such as the U.S. role in releasing a tool known as Stuxnet to cripple Iran’s nuclear program – because it can be expensive and time-consuming for experts to build them. But governments wouldn’t use their most sophisticated tools against unsophisticated targets, because of the risk that valuable tools would be discovered and rendered useless for future attacks.
It wasn’t immediately clear how the U.S. government was preparing to respond. The White House did not comment about the reported connection to North Korea and there was no immediate response from the State Department.
READ MORE: 3,800 employee SINs, confidential data leaked online following Sony cyber-attack
In May, the Justice Department took the highly unusual step of announcing indictments against five Chinese military officials accused of vast cyberespionage against major American corporations. But months later, none of those defendants have been prosecuted in the United States, illustrating the challenge of using the American criminal justice system against cybercriminals operating in foreign countries.
Comments