Joe Dog Software

According to the New York Times, the JPMorgan breach “might have been thwarted if the bank had installed a simple security fix to an overlooked server in its vast network.” And what fix was that?

Two-factor authentication. With this type of security, a user is required to produce two factors of authentication. One could be a password and another could be a dynamically produced PIN number.

This appears to tell us that a major American bank was breached because they exposed a console login on a public network and someone ran a dictionary attack against it.

This means they never picked up thousands of failed login attempts on that server. And it means an unguarded and “overlooked” computer had access to their private network. Just wow.

Later we find another interesting morsel in that article.

It is not clear why the vulnerability in the bank’s network had gone unaddressed previously. But this summer’s hack occurred during a period of high turnover in the bank’s cybersecurity team with many departing for First Data, a payments processor.

Your JoeDog is not suggesting it was an inside job by disgruntled employees, rather it looks like JPMorgan-Chase was a shitty place to work.

In response to Washington’s allegation that it was behind the Sony Pictures cyberattack, Pyongyang demanded a joint inquiry into the matter. North Korea claims it can prove it was not involved.

If the US has the goods, then it should welcome this offer. Does anybody think they have the goods? Your JoeDog does not. The information they’ve revealed thus far is weak and void of detail. Apparently the good stuff is classified. We’re supposed to take them at their word.

Your JoeDog has a hard time taking governments at their word. He never bought the case against Saddam Hussein and thus far he remains unconvinced on this one. If North Korea was involved, then declassify the evidence and display it to the public. If not, then Your JoeDog will continue to call bullshit.

Here’s what we know:

• On November 21st, the perpetrators contacted Sony executives and demanded ransom. The group called itself “God’sApstls.” There was no mention of the supposedly offensive Seth Rogen film.
• Soon after that, we learned about the Guardians of Peace. Images of hacked Sony Computers appeared on the Internet in which a splash screen exclaimed, “Hacked by #GOP”
• On December 1st, a representative of the GOP contacted CSO. The group claimed it had no ties to North Korea and no aims to stop The Interview as Sony suggested.
• On December 9th, Joe Demarest, assistant director with the Federal Bureau of Investigation’s cyber division, told a conference there was no attribution to North Korea. This means they couldn’t find a trail of crumbs back to the attackers.
• Yesterday, the FBI announced that Pyongyang was behind the attack. It staked its claim based on a code signature and IP addresses it claims were hard coded inside the malware.

So somehow we’ve gone from a ransom note by God’sApstls to a cyberattack from Pyongyang. Are we supposed to think North Korea was demanding ransom and taunting Sony before it got around to the movie it found so offensive? Certainly North Korea is a strange place, but that doesn’t make sense even for them….

The FBI disagrees with Your JoeDog. As of a few minutes ago, the Times published an article in which the FBI accuses North Korea of organizing the cyber attack on Sony Pictures.

Okay, what do they got?

The bureau said that there were significant “similarities in specific lines of code, encryption algorithms, data deletion methods, and compromised networks” to previous attacks by the North Koreans. It also said that there were classified elements of the evidence against the North that it could not reveal.

This is not unexpected. Cyber attackers around the world share code, tools and ideas. I wouldn’t be surprised if this toolkit contains signatures that match those used by the CIA, Iran, Israel or Anonymous.

What else do you got?

“The F.B.I. also observed significant overlap between the infrastructure used in this attack and other malicious cyberactivity the U.S. government has previously linked directly to North Korea,” the bureau said. “For example, the F.B.I. discovered that several Internet protocol addresses associated with known North Korean infrastructure communicated with I.P. addresses that were hardcoded into the data deletion malware used in this attack.”

The wording here is curious: “known North Korean infrastructure.” What does that mean? Are they in North Korea’s one known block of public IP addresses or are these Class C addresses the FBI has seen before? Kim Hak Uhr codes at a workstation with a 192.168.0.4 address so it must be North Korea!!1!1!

So we have a similarities of code, unknown IP addresses and evidence the FBI can’t reveal because s3cr37s! That’s pretty scant. I remain skeptical, very skeptical.

Your JoeDog is skeptical — very skeptical.

Unnamed US intelligence agents claim North Korea was “centrally involved” in the Sony Pictures cyber break-in. A leading “expert” is ninety percent certain North Korea was behind the attack. Well, Your JoeDog is one-hundred percent certain they weren’t.

Remember Stuxnet? It was a worm that infiltrated Iran’s nuclear facilities and attacked their centrifuges. It was certainly developed by a nation state. We still don’t know which one. Israel? They’re on the short list. The United States is, too.

That’s how nations roll when they commit cyber attacks. They don’t send emails which berate a target over its lax security. Nor do they send ransome requests. They certainly don’t give themselves nicknames like Guardians Of Peace. If North Korea would have infiltrated Sony they would have kept it on the downlow. Their message would have been implicit.

The initial interaction between the attackers and Sony was all about money. “Pay the damage,” they implored, “or Sony Pictures will be bombarded as a whole.” There was no mention of Seth Rogen’s film. There was nothing political in that message. The group that claimed responsibility was called “God’sApstls.” The “Guardians of Peace” surfaced later, after depictions of a splash screen on Sony computers surfaced on the Internets. It read, in part, “Hacked by #GOP”

In a December 1st email to CSO, a GOP representative claimed the group had no ties to North Korea:

“We are an international organization including famous figures in the politics and society from several nations such as United States, United Kingdom and France. We are not under direction of any state.

“Our aim is not at the film The Interview as Sony Pictures suggests. But it is widely reported as if our activity is related to The Interview. This shows how dangerous film The Interviewis. The Interview is very dangerous enough to cause a massive hack attack. Sony Pictures produced the film harming the regional peace and security and violating human rights for money.

“The news with The Interview fully acquaints us with the crimes of Sony Pictures. Like this, their activity is contrary to our philosophy. We struggle to fight against such greed of Sony Pictures.”

Distancing yourself from the country you represent is a funny way to promote its interests….

Personally, I wouldn’t be surprised if everybody and his sister has been inside Sony’s network. Compromising a system is only half the fun. Bragging about it is the other half. Could NK agents have caught wind of the break-in along with enough details to gain entry themselves? Sure. They may even exchanged Bitcoins for details. Maybe they were inside Sony but they didn’t orchestrate the attack and they certainly weren’t the ones who sent those emails.

Earlier this year, Home Depot fell victim to one of the worst known cyber attacks. Its systems were infiltrated and attackers stole personal information from millions of customers. The company suffered little from the attack; its stock is now at an all-time high. In the past year alone, there have been many high profile cyber attacks that have been met with little more than a shrug.

Leon Panetta, a former US Secretary of Defense, once claimed it would take a cyber “Pearl Harbor” before Americans were willing to do what was necessary to fix their computer infrastructure vulnerabilities. We haven’t faced such a catastrophe but, as the New York Times discovers, people are starting to realize that more attention must be paid to these sorts of threats. Your JoeDog has seen this new attitude first hand. His company now has more security analysts than systems analysts.

[NY Times: Hacked vs. Hackers]