Indian-origin Google techie links ransomware attack to North Korea


Team Udayavani, May 16, 2017, 2:52 PM IST

London (UK): An Indian-origin security researcher with Google has found evidence suggesting that North Korean hackers may have carried out the “unprecedented” ransomware cyberattack that hit over 150 countries, including India.

Neel Mehta has published a code which a Russian security firm has termed as the “most significant clue to date”, BBC reported today.

The code, published on Twitter, is exclusive to North Korean hackers, researchers said.

Researchers have said that some of the code used in Friday’s ransomware, known as WannaCry software, was nearly identical to the code used by the Lazarus Group, a group of North Korean hackers who used a similar version for the devastating hack of Sony Pictures Entertainment in 2014 and the last year’s hack of Bangladesh Central Bank.

Security experts are now cautiously linking the Lazarus Group to this latest attack after the discovery by Mehta.

Mehta has found similarities between code found within WannaCry and other tools believed to have been created by the Lazarus Group in the past, BBC reported.

Security expert Prof Alan Woodward said that time stamps within the original WannaCry code are set to UTC +9 – China’s time zone – and the text demanding the ransom uses what reads like machine-translated English, but a Chinese segment apparently written by a native speaker, the report said.

“As you can see it is pretty thin and all circumstantial. However, it is worth further investigation,” Woodward said.

“Neel Mehta’s discovery is the most significant clue to date regarding the origins of WannaCry,” said Russian security firm Kaspersky, but noted a lot more information is needed about earlier versions of WannaCry before any firm conclusion can be reached, it reported.

“We believe it is important that other researchers around the world investigate these similarities and attempt to discover more facts about the origin of WannaCry,” it said.

Attributing cyberattacks can be notoriously difficult – often relying on consensus rather than confirmation, the report said.

North Korea has never admitted any involvement in the Sony Pictures hack – and while security researchers, and the US government, have confidence in the theory, neither can rule out the possibility of a false flag, it said.

Skilled hackers may have simply made it look like it had origins in North Korea by using similar techniques.

In the case of WannaCry, it is possible that hackers simply copied code from earlier attacks by the Lazarus Group.

“There’s a lot of ifs in there. It wouldn’t stand up in court as it is. But it’s worth looking deeper, being conscious of confirmation bias now that North Korea has been identified as a possibility,” Woodward said.

It’s the strongest theory yet as to the origin of WannaCry, but there are also details that arguably point away from it being the work of North Korea.

First, China was among the countries worst hit, and not accidentally – the hackers made sure there was a version of the ransom note written in Chinese. It seems unlikely North Korea would want to antagonise its strongest ally. Russia too was badly affected, the report said.

Second, North Korean cyber-attacks have typically been far more targeted, often with a political goal in mind.

In the case of Sony Pictures, hackers sought to prevent the release of The Interview, a film that mocked North Korean leader Kim Jong-Un. WannaCry, in contrast, was wildly indiscriminate – it would infect anything and everything it could, the report said.

Finally, if the plan was simply to make money, it’s been pretty unsuccessful on that front too – only around USD 60,000 has been paid in ransoms, according to analysis of Bitcoin accounts being used by the criminals.

With more than 200,000 machines infected, it’s a terrible return, the report said.

On Friday, Europol Director Rob Wainwright said, “The global reach is unprecedented. The latest count is over 200,000 victims in at least 150 countries and those victims many of those will be businesses including large corporations”.

The most disruptive attacks were reported in the UK, where hospitals and clinics were forced to turn away patients after losing access to computers.

Udayavani is now on Telegram. Click here to join our channel and stay updated with the latest news.

Top News

Paytm gets Sebi nod for mega Rs 16,600-cr IPO

India successfully flight-tests ABHYAS off Odisha coast

Successful UPSC aspirants have no right to be allocated cadre, place of service of their choice: SC

Khatauli BJP MLA acquitted in 2013 Muzaffarnagar riot case

3 days of record rains causes losses worth Rs 2,000 crore in Kumaon

Law intern’s sexual harassment case: Two police personnel suspended for dereliction of duty

Baby kidnap case: Kerala govt orders probe by woman, child welfare department

Related Articles More

US lawmakers say India’s success will help world defeat COVID-19 as it achieves 100 crore jabs milestone

Queen back at Windsor Castle home after brief hospital stay

Key suspect behind violence against Hindus arrested by Bangladesh police

UN envoy: Myanmar is now in conflict, could be failed state

US seizes made-in-China toys, popular in India, for having dangerous chemicals

MUST WATCH

Unlucky auto Driver in Chikkamagaluru

Udayavani News Bulletin 22-10-2021

Manjamma Jogathi On The Discrimination She Faced

POLYHOUSE | Cucumber Cultivation Guide

Monuments lit up in tricolour to mark 100 crore vaccine


Latest Additions

Paytm gets Sebi nod for mega Rs 16,600-cr IPO

India successfully flight-tests ABHYAS off Odisha coast

Successful UPSC aspirants have no right to be allocated cadre, place of service of their choice: SC

Khatauli BJP MLA acquitted in 2013 Muzaffarnagar riot case

Bombay HC reserves order on ZEEL’s plea against EGM as requested by Invesco

Thanks for visiting Udayavani

You seem to have an Ad Blocker on.
To continue reading, please turn it off or whitelist Udayavani.