Cyber sleuths reveal new clues about mysterious Sony hackers

Image: Bob Al-Greene, Mashable

On Aug. 15, 2012, a group calling itself the "Cutting Sword of Justice" hacked into the network of Saudi oil giant Aramco, and destroyed all data on 30,000 of its computers. Less than a year later, another mysterious group of hackers self-identified as the "Whois Team" launched a cyberattack on South Korea, hitting some of the country's banks and TV companies, and wiping multiple hard drives in their computers.

In both of these attacks, which are known as "Shamoon" and "DarkSeoul", the hackers used a destructive digital weapon designed to erase all data on the targets' computers.

As it turns out, the same type of malware was used in the massive and embarrassing hack against Sony Pictures last week, according to security researchers who have been dissecting the "wiper" malware.

The similarities between these three attacks, however, don't end there.

In all three attacks, the groups claiming responsibility seemed to have a similar M.O., creating their digital weapon just several days before carrying out the attack, and then claiming responsibility with theatrical "you got hacked" messages.

The three groups also seemingly came out of nowhere: They had no prior history of attacks, and after their destructive operations, they didn't claim new victims, as Kaspersky Labs researcher Kurt Baumgartner detailed on Thursday in his analysis of the attacks.

"These similarities are both pretty specific and fairly strong, especially when the list of actors carrying out these sorts of attacks is so rare," Baumgartner told Mashable. "I would say that it's unusual for all [these similarities] to show up together like this."

Hacked by GOP

Image: Kaspersky Labs

Could the "Cutting Sword of Justice," the "Whois Team," and "Guardians of Peace" — the hackers who claimed to be behind the Sony hack — be the same group?

All these clues make for a "surreal case," Sean Sullivan, a researcher at Finnish security firm F-Secure, said. It's "very uncommon" for three attacks that took place over such different time frames and against three different targets, to share so many similarities, Sullivan told Mashable.

Perhaps the Sony hackers are just copycats, imitating past attackers to throw off investigators. Or, they could all be the same group.

"If we turn towards the data — yes, it's a possibility," Baumgartner said.

Shortly after the Sony hack, unnamed sources close to the investigation began accusing Kim Jong-un's regime of being the perpetrators, making North Korea suspect No. 1. The attack's similarities with DarkSeoul also pointed to North Korea, which is suspected of organizing that operation.

Since then, other evidence that seems to corroborate this theory has surfaced. As director of security firm AlienVault Labs Jaime Blasco told Mashable earlier this week, researchers found out that the malware in the Sony hack was compiled on a computer compatible with the Korean language.

For some, this is the strongest evidence yet that North Korea is the culprit. However, Blasco warned that it's easy to fake and manipulate data to make it look like Korean was the language setting on the computer used to create the malware.

That's why many experts are still skeptical about the regime's involvement. A North Korean diplomat also vehemently denied responsibility on Thursday.

For Sullivan, the notion that North Korean hackers — or hackers for-hire working for the regime — attacked Sony in retaliation for a Seth Rogen movie just doesn't make much sense.

"Nothing would surprise me –- but my bet just isn’t on North Korea," Sullivan said, adding that the Sony hackers' "messaging seems completely off," given their bizarre threats and bravado with the press.

Sullivan pointed out that the hackers' goal seemed to have been to extort Sony, since they hinted at a series of unmet demands in their "Hacked by #GOP" message, which appeared on some Sony Pictures employees' computers during the attack.

In their correspondence with reporters, it seems the hackers are not native english speakers, but it's unclear whether or not they speak Korean. On Thursday, the hackers ended a message sent to freelance reporter Thomas Fox-Brewster with a phrase in Korean.

However, according to both a Korean security consultant and a native Korean speaker that Mashable consulted, the sentence doesn't seem to be written by a Korean speaker.

Little is known about the attackers at this point. But both Baumgartner and Sullivan warned not to underestimate the group.

They are "smarter than your average script kiddie, for sure, is what my gut says," Sullivan said, using a common expression to refer to unskilled hackers who lift code developed by others for their exploits.

"While they are not the most sophisticated of adversaries, they appear to be a smaller, organized and professional group," Baumgartner said. "They are dangerous, effective and continuing to ramp up capabilities."