However, there is an age old equation that works fairly well for attribution: opportunity + motive + evidence. Opportunity in cyberwarfare is a complex item to tease out and has more to do with opportunity costs than anything else (the strategy of cyberwarfare demands owning everything immediately rather than later and the exercise becomes one of triage).
In this instance we do have both a motive and some evidence that point to North Korea, and it is in line with the sort of theatrical politics NK is known for. IMHO more evidence and an analysis of opportunity cost are a must to pin NK down further, but you can be assured that (unless officials have ulterior geopolitical motives) they have a pretty good idea about the cyber capabilities and actions of other nation states - more than they are apt to release to media outlets.
Everybody seems to have forgotten that this started as a financial ransom demand and the attackers made no mention of the movie or the DPRK until Sony and the media did.
I'm not suggesting the DPRK are not involved, but that it is a very big leap to go from media speculating about motives to the US government formally accusing them. The details leaked to the NyTimes do not substantiate this leap.
It truly is difficult to attribute and only with more evidence and a more careful analysis of timeline, the malware, and the communications will things come into focus.
One thing I have not yet been able to find are numbers for the ransom. I've seen the emails demanding ransom and the defacings demanding the same, but nowhere have I seen a number of dollars being demanded. Have you seen that anywhere?
You can try to fight the total annihilation of meaning in our language, but as you see here it is a losing battle.
terrorism
socialism
marxism
hero
capitalism
free market
invisible hand
imminent
torture
collect
to brief
espionage
surveillance
privacy
freedom
search
Re: computer hacking considered "terrorism" - this represents yet another way "terrorism" no longer means the despicable act it was originally associated with. And doesn't that make the "War on Terror" also a "War on Hacking"? How the hell are we going to win a war on hacking?
I do hope that the OP was not using the GW Bush administration definition of terrorism...
IMHO, SONY & USgov have more of the first 2 than N.K. and the 3rd can just be made up.
USgov., I think they will take any chance given to them to put China, Russia and N.K. in a bad light.
The big question your analysis seems to beg is why #GOP would demand that the movie not be shown. In the scenario where Sony and the USG want to spin this as anti-NK propaganda (certainly this is not out of the USG playbook), why would #GOP play along? I don't understand #GOP's motive in your scenario.
Companies are "brands" for hackers. "I hacked Target. Home Depot was me." etc. Sony is a huge brand. Keep the lulz going, and see how big it can get.
I'm not sure that I personally buy that the evidence is manufactured - that there is motivation enough from the USG to invent that evidence. But this is where there is reached an impasse. There just isn't enough information at this point to really say. Either speculation can be right.
It'll be interesting to watch as this continues.
Opportunity costs are exactly as low for every country that the US decided to antagonize by placing on their evil axys list, and only marginally bigger for any other actor, because nobody will catch the hacker.
The only item of yours that can not point to anybody that you want is the evidence. Evidence-less finger pointing is not a sane sport.
Opportunity costs are not exactly as low for every country, as they have different capabilities, use different tactics, have different budgets and talent pools, and have different interests. Triage is going to be different for different state actors. Pure and simple. I'm not sure that an opportunity cost analysis indicts NK - and in fact I do suggest that work needs to be done there in the original comment.
That's just a good a reason as any other motive for any other suspect given that I've seen.
When in doubt, blame China.
> It is not clear how the United States came to its determination that the North Korean regime played a central role in the Sony attacks
To me, that sounds like they aren't privy to the reasoning used.
If the US has better evidence, why not show it? I'm not saying NK didn't conduct those attacks, I'm just saying the US government isn't really a reliable source about anything.
If there is a retraction it will be in a year's time and buried under an ad for washing powder on page 17.
You simply don't need evidence anymore when the media, unwittingly perhaps, construct the narrative for you.
Why is the New York Times held in such high esteem? Was there a period of time when it truly was a paper of record? These days it seems like the name Pravda on the Hudson is well deserved.
> That suggests, but does not prove that that the same group or individuals may have been behind both attacks.
--Washington Post
That doesn't mean the threats are legitimate. Or that North Korea is involved. But the actions of folks involved do give serious weight to such an accusation.
The evidence has to be better than this to make an accusation against a state. Botnets overlap a lot because the way they are built is with automated scanners that take advantage of common vulnerabilities. It isn't uncommon to find a botnet client that has been hacked a half-dozen other times and has had rootkits installed each time. A large part of sophisticated botnet droppers is removing all the previously installed botnets on a server where a vulnerability has been found.
Having one client in common with another attack network is a low or insignificant figure.
Similar applies to common modules found in other malware. Authors reverse engineer and re-appropriate techniques or libraries from other successful malware all the time. That is also not evidence of a link to North Korea.