Developing cyberwarfare capabilities seems like a relatively low cost (compared to developing ballistic missiles at least), low risk investment, with a potentially large payoff, so I would be surprised if they didn't try to develop these skills.
Of course, all evidence tying N.Korea to this specific attack is circumstantial and almost impossible to definitively prove unless they admit it and show proof themselves.
It is my understanding that plenty of people do not believe North Korea cheated in 2010 (and also, plenty of people believe that other specific teams have cheated in specific years). Furthermore, it is my understanding that the North Korean team leader in recent years has not seen the problems before the contest (relying instead on the South Korean translation of the problems), thus removing the most obvious mechanism of cheating. Unfortunately, I do not know of a public source of this information and accordingly I have not verified it myself.
And yes, somebody who has the skill to craft a very low level yet highly flexible malware requires skill that goes beyong copy/paste from stackoverflow.
I know enough math people who are ABYSMAL at coding due to the differences between domains and the constraints that shaped their way of thinking, and a lot of linguists who are surprisingly good at it due to just that.
I dismissed programming as a freshman because I was so bad at math in high school. Turns out my high school teachers were very bad teachers (shocking when they're paid so little, who would've thought? ) I learned Italian fluently, spent a few years overseas immersing myself in it, came home and had a rough time finding my passion. Took a gap year and messed about with some online coding classes (code academy) and realized I loved it. It felt like a new language that instead of being expressively emotional it was a way to express logic and rules. I like logic and rules.
So I completed the minor +4 higher level classes and taught myself mobile development. No regrets... Besides not going into it as a major maybe.
Correct me if I'm wrong, but WannaCry isn't highly sophisticated. It weaponizes already known vulnerabilities to exploit soft targets on a large, but unsophisticated scale (because most of the victims are soft targets in terms of computer/network security). Ransomware is not a new idea either. Combining these things (known exploits, soft targets, ransomware) doesn't require genius or _highly_ specialized domain knowledge, hard to acquire intelligence or huge amounts of resources (labor or money). Any state capable of consistently spending a couple million dollars per year on a team for offensive security operations could, I suppose, pull this off.
> that only a domain expert with highly specialized experience could even recognize
Notably, it's about the expertise needed to recognize and identify the attack, not to launch it.
Or one of many different groups of people who can do computers.
There's just too little information to work off when all you have are a few binaries - with functions that can be trivially copied and modified at a binary level or reverse engineered and recompiled to similar binaries combined with some VPN IP addresses and a few assorted bits of information about attack patterns which are trivial to copy if anyone else has witnessed the attacks. I'm surprised intelligence agencies are asserting this kind of thing publicly with any level of confidence and it makes me worried that it's only going to be used to rationalize war efforts.
On the flip side they also have a history of lying, and could well be motivated to say this in the absence of such reliable evidence (or even evidence suggesting something else).
WannaCry is a wormable implementation of a leaked NSA exploit. Maybe not "trivial", but this wasn't exactly Stuxnet.
I frankly don't share the knee-jerk skepticism of many in this comment section, and certainly not based on the DPRK's alleged incompetence : this attack is well within their capability.
And the asymmetric nature of cyber warfare is a perfect fit for a small, marginalized state looking to destabilize everyone else.
At the same time, anti-Soviet propaganda also took many things wrong.
Truth always takes a personal effort to discover; it can't be spoon-fed by the New York Times, or Pravda, or Facebook.
And not as isolated incident of abuse of power, usually on a mass scale. They liked their genocides like they liked their mines and factories -- huge.
Not to mention the economic system of constant shortages where you had to bribe everyone, including the meat store clerk.
For others who are confused about this, they probably mean:
https://en.wikipedia.org/wiki/Vladimir_Bukovsky
...and not the famous Hollywood drunkard known as Charles Bukowski.
There is this very telling scene in And the Wind Returns... where people peruse Lenin's works on the toilet (to then use as toilet paper because there was a shortage of course) and afterwards discuss what they read. It leads to never-ending arguments because the collected Lenin's writings were so contradictory, everyone found something different.
Wut? How many huge genocides exactly did the Soviets commit? As in killing off entire ethnic groups? I can't really name any, although I can definitely name at least one that Americans committed, but we usually don't like to talk about that.
For the record, the USSR under Stalin targeted Jews in purges and forced deportation to Sibera: http://www.tabletmag.com/jewish-news-and-politics/125203/sur...
The Holodomor is frequently cited as a genocide: https://en.wikipedia.org/wiki/Holodomor_genocide_question
They also targeted 'kulaks' for deportation and/or extermination: https://en.wikipedia.org/wiki/Dekulakization
https://en.wikipedia.org/wiki/Population_transfer_in_the_Sov...
To badly paraphrase a Manhattan Project scientist, from memory: "there are lots of ways to create a nuclear explosion and no matter which one we try they all seem to work"
Miniaturised nukes are much, much more complicated and seem to require 1990s+ levels of physics, computer modelling and engineering.
Or you can see what's happening through others who actually travelled there, like this photographer: https://www.dprk360.com
Do you apply the same statement to all world religions? At least that would be consistent, but it is also starting out of the gate with a very hefty dose of hubris.
It is more reasonable to respond to the article as, just some for-profit paper's entertainment piece. It's reasonable to assert that claims made without evidence can be dismissed without evidence. It's reasonable to criticize the U.S. government for an excess of secrecy, an overuse of classification.
In 1959 the DoD had 12 meter resolution spy satellites. And 0.6 meter resolution spy satellites by the early 1980's. Those captures were never released nor leaked to the public contemporaneously, it would be decades before it was declassified and released.
But let's take your "only rational response" is skepticism, and apply binary logic to the outcomes just to keep it simple: you believe the report is 100% true, you believe the report is 100% false. Let's take the false case. That necessarily commits you to the NSA being either incompetent or malevolent. If the NSA, with its vast resources, is engaging in either gross negligence or is malevolent, that means contemplation of the higher likelihood of deaths of millions: negligence or malevolence does not reduce the risk of death, for sure. And now you're confronted with rebel's dilemma as NSA is a domestic threat.
What you do by saying the only rational response is skepticism, is commit yourself, morally and ethically, to arriving at certainty. Not hand waving that the burden is on others. You just placed the burden on yourself.
The NSA oops dropped a ton of cyberweapons on the streets and they would have gotten away with it, if not for those meddling kids .. kims .. well. Of course not, some other meddling kids would have wreaked havoc abusing the dangerous tech they didn't secure.
Whose fault is this really?
The damage was done the moment they lost control of that software. It could have been North Korea, some criminal gang, scriptkiddies, another country ... and that's bad and they'd be bad. But if you're a country that got hit by this ransomware you're not thinking "ow darn those North Koreans at it again" you know very well it was the NSA's fuckup, and if it hadn't been NK, someone else would have caused a large amount of damage using that tech in one way or another. They've been warned about the dangers of their inability to keep cyberweapons secure for years.
Maybe from within the US for those who are somehow still rooting for the NSA, pointing fingers at one of the usual suspects is ... satisfying? But from outside it just looks childish. What I'm seeing is other people doing the cleanup, dealing with the aftermath, and what's the NSA doing? Fingerpointing. What does this gain anyone?
I'de say it's highly likely too, but what we need to find out is why would the US deep-state do this? Is there a specific motive for the US deep-state haphazardly implicating NK, other than, just maybe, the NSA got their hands on some evidence that we aren't aware of?
For all we know, this could have been leaked by Joe the North Korea analyst to raise his profile and increase his status.
- NK is developing longer-range ICBMs, and relations with the US have been deteriorating; recently, in response to a Trump tweet, NK threatened to drop a nuke on NYC [1]. Nobody in the administration is going to complain if NK takes a propaganda hit.
- The NSA has been taking a lot of blame for WannaCry, and pointing fingers at NK diverts some of that blame.
[1] http://www.newsweek.com/north-korea-attack-new-york-nuclear-...
Which is the exact reason I wouldn't trust any NSA-provided news about the origins of WannaCry more than I trust an average warez-site.
Budget. If they can spin this as a national security matter rather than a criminal matter they get the money rather than the FBI cybercrimes division.
NK specifically has the advantage that nobody will believe them and there is no political fallout from accusing them.
Also: https://www.pastemagazine.com/articles/2017/04/5-eye-opening...
In the old days of the USSR, while very difficult, it was at least conceivable that you could just fly to moscow and see if they were eating their children there or burning priests or god knows whatever else.
There was a natural limit to the deception that could occur and further a normal person could make conclusions about the things they saw with their own eyes.
Now, the enemy that "we have always been at war with" is a completely isolated (and economically trivial) state that virtually nobody travels to and who is attacking us with secret cyber weapons that only a domain expert with highly specialized experience could even recognize, much less qualify.
And the people that are telling us are those same people that are, or are not, secretly recording all of our conversations.
There's not one little thing there you could take at face value.