Decius wrote:

skullaria wrote:
I read....86 IPs from 18 countries?

Its more, but...

What about propaganda for the Rockefeller cybersecurity legislation?

I didn't think about it, but you're exactly right. They are certainly leveraging it that way, even if they didn't create it.

Its a strange attack - NK wouldn't have done something this silly. It looks like something a teenager would have done - but I also don't think there are a lot of fan boy hackers who think NK is cool and want to support their interests. You see islamist stuff like that, but generally speaking people in NK don't have Internet access.

Its possible that there are people in SK who think NK is cool. I've never run into that but I guess such a subculture wouldn't be completely surprising.

However, on many levels your theory makes more sense. In particular, I don't think an NK fanboy would have been savvy enough to do it on the 4th of July at the same time as an NK missile launch - it was too well timed.

The implications of this are disturbing.

Be wary of seeing conspiracy within actions that can be explained by idiocy, especially with it comes to Congress.

Of course there are members of congress trying to leverage this to reinforce their points. Does anything ever happen that isn't used by some member of Congress to use to "prove" they are right about something?

Hoekstra seems to have used it to "prove" he is a hawk on the DPRK. I didn't review everything from the news conference, but I didn't hear anything said about the Rockefeller bill or any other piece of legislation. Just the obligatory "we've got to do something!"

And either way, the whole situation appears to have hit the news cycle with a thud. There is no active media attention. In the long-term, it's going to be hard to use this in an alarmist way, because when reviewing past events the actual analysis stands out, as opposed to the one news conference where a lawmaker declared "this couldn’t be some amateurs".

As far as the actual attack goes..

In your thoughts above, you only seem to be addressing ideology as a motivator. Money is the more common driver when a state sponsors actions. I don't see anything that rules out DPRK sponsorship. However, I don't see anything that indicates it either.

The pedigree of the malware used doesn't rule out a skilled/experienced actor either. If you are going to launch a offensive information operation, you wouldn't use your newest most rad tool first. Going straight for your best tools devalues the asset by exposing it to analysis and detection. You'd use the oldest most exposed tool that can still be effective to achieving your goal.

I still haven't seen enough information to make a determination about anything. Idiot teenage hacker? Idiot teenage hacker getting pumped money from somewhere? Skilled attacker getting pumped money and using old tools to appear like an idiot teenage hacker? Who knows...

I'd be interested in knowing how long the majority of the machines in the botnet had been infected. Was this an old botnet? Fairly new infections? Was there anything about the command hosts that connected the incident to others? Answers to some of these questions could move the indicator one way or the other..

RE: Lawmaker Wants ‘Show of Force’ Against North Korea for Website Attacks | Threat Level | Wired.com