Sun Sentinel Palm Beach Edition
‘Possibility’ N. Korea behind cyberattack
Experts point to “ransomware” hackers’ method.
SEOUL, South Korea — Cybersecurity experts are pointing to circumstantial evidence that North Korea may be behind the global “ransomware” attack: the way the hackers took hostage computers and servers across the world was similar to previous cyberattacks attributed to North Korea.
Simon Choi, a director at South Korean anti-virus software company Hauri Inc. who has analyzed North Korean malware since 2008 and advises the government, said Tuesday that the North is no newcomer to the world of the bitcoin. It has been mining the digital currency using malicious computer programs since as early as 2013, he said.
In the attack, hackers demand payment from victims in bitcoins for users to regain access to their encrypted computers. The WannaCry malware has scrambled data at hospitals, factories, government agencies, banks and other businesses since Friday, but an expected second outbreak largely failed to materialize, in part because security researchers had already defanged it .
Choi is one of a number of researchers around the world who have suggested a possible link between the ransomware known as WannaCry and hackers linked to North Korea. Researchers at Symantec and Kaspersky Lab have found similarities between WannaCry and previous attacks blamed on North Korea.
The evidence is far from conclusive, however. Authorities are working to catch the extortionists behind the global cyberattack, searching for digital clues and following the money trail.
“We are talking about a possibility, not that this was done by North Korea,” Choi said.
WannaCry paralyzed computers running mostly older versions of Microsoft Windows in some 150 countries. It encrypted users’ computer files and displayed a message demanding $300 to $600 worth of bitcoin to release them; failure to pay would leave the data scrambled and likely beyond repair.
The hackers appeared to have taken control of computers and servers around the world by sending a type of malicious code known as a worm. The worms quickly scanned computers with vulnerability, in this case the older versions of Microsoft Windows, and used those computers as hackers’ command and control centers.
Experts say that the rapid spread of the worm globally suggests it did not rely on phishing, a method whereby an email is sent to people with the aim of having them click on infected documents or links.
Rather, analysts at the European Union cybersecurity agency say the hackers likely scanned the internet for systems that were vulnerable to infection and exploited those computers remotely.
The worm then is likely to have spread through a channel that links computers running Microsoft Windows in a network.
This method has been found in previously known North Korean cyberattacks, including the Sony hack in 2014 blamed on North Korea.