There we go. The FBI confirmed on Friday, Dec. 19, that the massive Sony Pictures Entertainment hack was indeed, orchestrated by North Korea.
"As a result of our investigation, and in close collaboration with other U.S. government departments and agencies, the FBI now has enough information to conclude that the North Korean government is responsible for these actions," the statement read.
The organization said it came to its conclusion based on three overarching factors, the first being that the FBI linked malware used in the security breach to the secluded state. "Technical analysis of the data deletion malware used in this attack revealed links to other malware that the FBI knows North Korean actors previously developed. For example, there were similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks," the FBI wrote.
Second, the FBI saw that several IP addresses were directly linked to North Korea. "The FBI also observed significant overlap between the infrastructure used in this attack and other malicious cyber activity the U.S. government has previously linked directly to North Korea," the statement read. "For example, the FBI discovered that several Internet protocol (IP) addresses associated with known North Korean infrastructure communicated with IP addresses that were hardcoded into the data deletion malware used in this attack."
Finally, the FBI saw that the tools that were used in the Sony attack had similarities to the tools used in the March 2013 cyber attack against South Korea. "Separately, the tools used in the SPE attack have similarities to a cyber attack in March of last year against South Korean banks and media outlets, which was carried out by North Korea," the statement read. Find out more details about the hackers.
The massive attack took place on Nov. 24, resulting in the release of classified information and sensitive email exchanges, slowly leaked in piecemeal strikes to the public. According to the FBI, Sony reported the attack "within hours, which is what the FBI hopes all companies will do when facing a cyber attack."
Not only was personal information breached in the attack, but office equipment was also rendered useless, impacting Sony's business operation. "The FBI has determined that the intrusion into SPE’s network consisted of the deployment of destructive malware and the theft of proprietary information as well as employees’ personally identifiable information and confidential communications," the statement read. "The attacks also rendered thousands of SPE’s computers inoperable, forced SPE to take its entire computer network offline, and significantly disrupted the company’s business operations."
The FBI concluded its statement by expressing concern about national security. "We are deeply concerned about the destructive nature of this attack on a private sector entity and the ordinary citizens who worked there. Further, North Korea’s attack on SPE reaffirms that cyber threats pose one of the gravest national security dangers to the United States," the statement read.
"Though the FBI has seen a wide variety and increasing number of cyber intrusions, the destructive nature of this attack, coupled with its coercive nature, sets it apart. North Korea’s actions were intended to inflict significant harm on a U.S. business and suppress the right of American citizens to express themselves. Such acts of intimidation fall outside the bounds of acceptable state behavior. The FBI takes seriously any attempt—whether through cyber-enabled means, threats of violence, or otherwise—to undermine the economic and social prosperity of our citizens."
