https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiy_CSOXtvxBdx0cTWsmJ3e4NFxdIge3t2jsfcSa1UPDmDTIVme6YyatTqSJIxDTM4Lvncw9WFphKpX69Rbgq8c_zUQlNJaVqUfgyiJ5xwWbbsUnwQE4vr2-qWRKofFK_4daBSzFqOqHJw/s1600/WannaCry+ransomware+has+links+to+North+Korea%252C+cybersecurity+experts+say.png
Two top security firms have found evidence linking the WannaCry ransomware to the prolific North Korean cybergang known as Lazarus Group.
Kaspersky and Symantec both said on Monday that technical details within an early version of the WannaCry code are similar to code used in a 2015 backdoor created by the government-linked North Korean hackers, who were implicated in the 2014 attack on Sony Pictures and an $81m heist on a Bangladeshi bank in 2016. Lazarus Group has also been known to use and target Bitcoin in its hacking operations. The similarities were first spotted by Google security researcher Neal Mehta and echoed by other researchers including Matthieu Suiche from UAE-based Comae Technologies.
Similitude between #WannaCry and Contopee from Lazarus Group ! thx @neelmehta – Is DPRK behind #WannaCry ? pic.twitter.com/uJ7TVeATC5
— Matthieu Suiche (@msuiche) May 15, 2017
Shared code doesn’t always mean the same hacking group is responsible – an entirely different group may have simply reused Lazarus group’s backdoor code from 2015 as a “false flag” to confuse anyone trying to identify the perpetrator. However the reused code appears to have been removed from later versions of WannaCry, which according to Kaspersky gives less weight to the false flag theory.
“We believe it’s important that other researchers around the world investigate these similarities and attempt to discover more facts about the origin of WannaCry,” said Kaspersky Lab in a blog post, pointing out that in the early days of the Bangladesh bank attack, there were scant clues linking it to the Lazarus group. However, over time researchers found more clues to build the case against the North Korea-linked cybergang.
Kaspersky is among the research teams to have been studying Lazarus Group for years, and in April it published a detailed “under the hood” report exposing the group’s modus operandi.
“This level of sophistication is something that is not generally found in the cybercriminal world. It’s something that requires strict organization and control at all stages of operation. That’s why we think that Lazarus is not just another advanced persistent threat actor,” said Kaspersky, which also found attacks originating from IP addresses in North Korea.
The WannaCry ransomware attack has now now hit more than 200,000 computers in 150 countries, crippling hospitals, governments and businesses.
The links to North Korea come at a time when security researchers and technology companies are criticizing the US government for stockpiling cyberweapons including the malicious software used in WannaCry.
The WannaCry exploits used in the attack were drawn from a cache of exploits stolen from the NSA by the Shadow Brokers in August 2016. The NSA and other government agencies around the world create and collect vulnerabilities in popular pieces of software (such as Windows) and cyberweapons to use for intelligence gathering and cyberwarfare.
Once these vulnerabilities were leaked by the Shadow Brokers, they became available for cybercriminals to adapt for financial gain by creating ransomware. This ransomware spread rapidly on Friday by exploiting a vulnerability contained in the NSA leak, targeting computers running Microsoft’s Windows operating system, taking over users’ files and demanding $300 to restore them.
“This attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem,” said Brad Smith, president and chief legal officer of Microsoft, in a blog post.
“Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage. An equivalent scenario with conventional weapons would be the US military having some of its Tomahawk missiles stolen.”
The blog posts mentions that vulnerabilities stockpiled by the CIA also ended up in the public domain via Wikileaks.
“This is an emerging pattern in 2017,” Smith said, adding that the latest attack represents a “completely unintended but disconcerting link” between nation-state action (the NSA) and organized criminal action (the ransomware creator).
“The governments of the world should treat this attack as a wake-up call,” said Smith, urging nations to treat cyber weapons in the same way that physical weapons are treated.
“We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits.”
Jeremy Wittkop, chief technology officer of security company Intelisecure, argues that if governments are to stockpile weapons they need to secure them better.
“The government has a responsibility like with nuclear weapons to make sure they don’t fall into the hands of the wrong people,” he said. “If you are going to create something that can cause this much damage you have to protect it.”
Microsoft has called for a “Digital Geneva Convention” requiring governments to report vulnerabilities to the creators of the software instead of stockpiling, selling or exploiting them.
guardian.co.uk © Guardian News & Media Limited 2010
Published via the Guardian News Feed plugin for WordPress.
WannaCry ransomware has links to North Korea, cybersecurity experts sayhttps://goo.gl/8wlyfA
Posts
0 comments:
Post a Comment