Ransomware attack has traces of N Korean hack
Cybersecurity researchers have found evidence they say could link North Korea with the WannaCry cyber attack that has infected more than 300,000 computers worldwide as global authorities scrambled to prevent hackers from spreading new versions of the virus.
A researcher from South Korea's Hauri Labs said on Tuesday their own findings matched those of Symantec and Kaspersky Lab, who said on Monday that some code in an earlier version of the WannaCry software had also appeared in programmes used by the Lazarus Group, identified by some researchers as a North Korea-run hacking operation.
"It is similar to North Korea's backdoor malicious codes," Simon Choi, a senior researcher with Hauri who has done extensive research into North Korea's hacking capabilities and advises South Korean police and National Intelligence Service.
Both Symantec and Kaspersky said it was too early to tell whether North Korea was involved in the attacks, based on the evidence that was published on Twitter by Google security researcher Neel Mehta. The attacks, which slowed on Monday, are among the fastest-spreading extortion campaigns on record.
Damage in Asia, however, has been limited.
Vietnam's state media said on Tuesday more than 200 computers had been affected. Taiwan Power Co. said that nearly 800 of its computers were affected, although these were used for administration, not for systems involved in electricity generation.
FireEye Inc, another large cyber security firm, said it was also investigating but cautious about drawing a link to North Korea.
"The similarities we see between malware linked to that group and WannaCry are not unique enough to be strongly suggestive of a common operator," FireEye researcher John Miller said.
US and European security officials told Reuters on condition of anonymity that it was too early to say who might be behind the attacks, but they did not rule out North Korea as a suspect.
The Lazarus hackers, acting for impoverished North Korea, have been more brazen in their pursuit of financial gain than others, and have been blamed for the theft of $81 million from the Bangladesh central bank, according to some cyber security firms. The United States accused An Indian-origin security researcher with Google has found evidence suggesting the involvement of N Korean hackers it of being behind a cyber attack on Sony Pictures in 2014.
An official at South Korea's Korea Internet & Security Agency said on Tuesday the agency was sharing information with intelligence officials on recent cases reported for damages but was not in position to investigate the source of the attack. The official declined to comment on intelligence-related matters.
A South Korean police official that handles investigations into hacking and cyber breaches said he was aware of reports on North Korea link but said the police were not investigating yet.
Victims haven't requested investigations but they want their systems to be restored, the official said. There's a blame game brewing over who's responsible for the massive cyberattack that infected hundreds of thousands of computers. Microsoft is pointing its finger at the US government, while some experts say the software giant is accountable too.
The attack started Friday and has affected computers in more than 150 countries, including severe disruptions at Britain's National Health Service. The hack used a technique purportedly stolen from the US National Security Agency to target Microsoft's marketleading Windows operating system. It effectively takes the computer hostage and demands a $300 ransom, to be paid in 72 hours with bitcoin.
Microsoft President and Chief Legal Officer Brad Smith blamed the NSA's practice of developing hacking methods to use against the US government's own enemies. The problem is that once those vulnerabilities become public, they can be used by others. In March, thousands of leaked Central Intelligence Agency documents exposed vulnerabilities in smartphones, televisions and software built by Apple, Google and Samsung Electronics.
The argument that it's the