Analysis points to secretive state for attack on film studio, which highlights legitimate concerns about its rise as a cyber power

Further evidence has emerged that the catastrophic cyber attack on Sony Pictures revealed this week was the work of North Korean hackers.

Analysis of the malware that infiltrated Sony, called Destover, revealed the hackers used the Korean language, according to Jaime Blasco, director of cyber security experts AlienVault Labs.

US security company Symantec found the malware also connected to the same hacker-controlled servers as Volgmer, another piece of malicious software that was configured specifically to attack South Korean targets and only runs on Korean computers.

Kaspersky Lab, a Russian security firm, said the methods used on Sony were similar to those in the DarkSeoul attacks on South Korean banks and media organisations in 2013.

Both Kaspersky Lab and Symantec have also linked Destover to Shamoon, a so-called “wiper” that knocked out 30,000 machines at oil giant Saudi Aramco in 2012, as the same software drivers were in use. Shamoon was initially linked to Iran.

“In all three cases, Shamoon, DarkSeoul and Destover, the groups claiming credit for their destructive impact across entire large networks had no history or real identity of their own,” said Kaspersky’s Kurt Baumgartner.

“All attempted to disappear following their act, did not make clear statements but did make bizarre and roundabout accusations of criminal conduct, and instigated their destructive acts immediately after a politically charged event that was suggested as having been at the heart of the matter.

There has been speculation that the attack was retaliation for an upcoming comedy film, The Interview, about a CIA plot to assassinate North Korean leader Kim Jong-un.

Yet all that still doesn’t lay the blame at the Democratic People’s Republic of Korea’s door, such is the chimera that is cyber attribution.

Rumours from various sources, including ones with knowledge of the investigation who spoke to the Guardian, have suggested the attack was straight out of North Korea. But many doubt The Interview film was really to blame.

Some indications point to criminal hackers rather than a military unit. A North Korean diplomat has stated the country was not culpable and the attackers have told media outlets they are not backed by any state, but actually come from Western states.

The language and brazen attitude of the hackers is also at odds with the usual silence maintained by state-sponsored hackers. In an email, one of the hackers listed in the original dump of Sony data, called Lena, signed off an email: “Sincerely, North Korean Hacking Team”, but they also left the message “모든 영광스러운 김정은 우박”, which, according to a Twitter contact, is sloppy Korean and could be a translation from Google.

How much damage can North Korea’s cyber army do?

But regardless of the origins of the attack on Sony, there may be legitimate reasons for the US, UK and others to be concerned about the rise of North Korea as a cyber power. However, the intelligence that has been made public might not be trustworthy, given it largely comes from two countries with clear political bias: the US and South Korea.

There are significant roadblocks to understanding North Korea’s digital prowess. The country’s networks are largely isolated from the outside world. Most inside the country only see the government controlled intranet known as the Kwangmyong, while an outward facing web allows access to sites in handpicked countries and is only available to authorised people.

North Korea’s electric grid is not thought to be able to support a large technological infrastructure and its technology industry in general is lacking in many departments, one of them being security. In a scan of connected machines it could reach in North Korea, HP said it found dated equipment that could have been compromised by external parties.

North Korean attackers have never been caught red-handed, unlike the NSA and GCHQ in the Edward Snowden revelations.

What have they done before?

Attacks have been linked but not directly attributed to North Korean cyber units such as the much-hyped Unit 121. Reports stretch back to at least 2004, when North Korea was said to have gained access to 33 of 80 South Korean military wireless communication networks. In 2006, Unit 121 was suspected of breaching defences at the South Korean and US defence departments.

More recently, a 2009 report by Major Steve Sin, an intelligence analyst at US Forces Korea, suggested North Korean hackers had, at that time, broken through American defence networks more than any other country that had targeted them.

In March 2013, the DarkSeoul attacks hit, with 76 pieces launched at various banks and TV broadcasters, taking swathes of systems down. South Korea officially blamed its rival.

Later that year, Kasperksy Lab suggested North Korea was the most likely perpetrator of a range of cyber espionage attacks on South Korean organisations, including the Sejong Institute, the Ministry of Unification governmental department and the Korea Institute For Defense Analyses.

Unit 121 and beyond

Little is known of the 121 crew. In 2011, Kim Heung-kwang, a defector who now resides in South Korea, told al-Jazeera the government handpicked members from the best science and mathematics students in Pyongyang. They are then sent to one of the top technical universities – the Kim Il sung University and Kim Chaek University of Technology to name two. After receiving more training in China and Russia, the successful few are then handed jobs in the elite Unit 121 to infiltrate foreign systems. Kim said at the time there were between 500 and 3,000 in the squadron.

Outside of that division, there are a host of associated units, according to HP. These include Unit 35, which trains DPRK’s digital soldiers, and The 225th Bureau, or Office 225, which does some cyber work but tends to be focused on corporeal infiltration into enemy states.

There have been some suggestions North Korea borrows from the very capable Chinese cyber divisions. The country is a major customer of China Unicom and Unit 121 is believed to have operations on Chinese soil.

Gregory Conti, associate professor for the Department of Electrical Engineering and Computer Science at the United States Military Academy, said: “Unit 121 is above average. I’d place them on a tier below the usual suspect major nation-state actors that have been making headlines. While not at the high end of capability, North Korea does take the space seriously and could present a worrisome threat.”

Frank Cilluffo, associate vice president at the George Washington University – where he leads national security and cyber security policy initiatives – said: “DPRK has comparatively decent technical ability in cyberspaceWhile their cyber capabilities are not up to par with countries such as the US, Russia, China, etc. they are still significant and likely on par with Iran

“And like Iran, they are difficult to deter, perhaps even more so, since any form of cyber retaliation would have limited effect, given they are not a wired country and would have less to lose.”

Ironically, the whole saga with Sony might leave North Korea looking more impressive than it actually is. “Considering how much effort North Korea has put into showing the world what a powerful army they have at their disposal, this will fit perfectly with that strategy,” notes security researcher Andreas Lindh.

Should you be worried?

If you work at Sony, yes. Reams of employee data has been spewed out onto the web and quickly taken down, though not before some got their hands on it. That stolen information reportedly includes thousands of social security numbers, reams of payroll information, usernames and passwords, as well as leaked scripts and copies of future Sony Pictures films. Given the attackers have only released a slice of the 100 terabytes of information they claim to have, Sony and its workers are set for a not-so-merry Christmas.

No one knows how this malware got in to Sony’s systems, but in the past similar attacks started with a malicious email sent to workers. Those at other companies should check their cyber hygiene.

The FBI was sufficiently concerned to put out a warning about destructive malware. A Trend Micro analysis of the malware indicates it is comparatively straightforward, using Windows tools to copy itself around in its attempts to steal and delete files, before preventing the infected systems from booting up.

A noted yet secretive security expert who goes by the name of The Grugq told the Guardian he believes either the hackers sent emails with malicious attachments, which at least one Sony worker opened, or an insider installed the malware directly onto the network. “No need for anything sophisticated at all,” he added. Users are advised to be wary of emails from untrusted contacts. But they can do little to protect their employers against smart insiders.

This article contains affiliate links, which means we may earn a small commission if a reader clicks through and makes a purchase. All our journalism is independent and is in no way influenced by any advertiser or commercial initiative. By clicking on an affiliate link, you accept that third-party cookies will be set. More information.