Evidence points to North Korea in global ransomware attack
Circumstantial evidence suggests North Korea may have been behind the global ransomware attack, according to cybersecurity experts.
They say the way the hackers took over computers and servers across the world was similar to previous attacks attributed to North Korea.
Simon Choi, a director at South Korean antivirus software company Hauri, who has analysed North Korean malware since 2008 and advises the government, said the North is no newcomer to the world of bitcoins. It has been mining the digital currency using malicious computer programmes since as early as 2013, he said.
In a ransomware attack, hackers demand payment from victims in bitcoins to regain access to their encrypted computers.
The WannaCry malware has scrambled data at hospitals, factories, government agencies, banks and other businesses since Friday, but an expected second wave largely failed to materialise after the weekend, in part because security researchers had already tackled it .
Mr Choi is one of a number of researchers around the world who have suggested a possible link between WannaCry and hackers linked to North Korea.
Researchers at Symantec and Kaspersky have found similarities between WannaCry and previous attacks blamed on North Korea.
The evidence is far from conclusive, however. "We are talking about a possibility, not that this was done by North Korea," Mr Choi said.
WannaCry paralysed computers running mostly older versions of Microsoft Windows in 150 countries. It encrypted users' computer files and displayed a message demanding 300 to 600 US dollars (£230-£390) of the digital currency bitcoin to release them. Failure to pay would leave the data scrambled and probably beyond repair .
The hackers appeared to have taken control of computers and servers around the world by sending a type of malicious code known as a worm. The worm quickly scanned computers with vulnerability, in this case the older versions of Microsoft Windows, and used those computers as hackers' command and control centres.
Experts say the rapid spread of the worm globally suggests it did not rely on phishing, a method whereby an email is sent to people with the aim of having them click on infected documents or links.
Analysts at the European Union cybersecurity agency say the hackers probably scanned the internet for systems that were vulnerable to infection and exploited those computers remotely.
The worm is likely to have spread through a channel that links computers running Microsoft Windows in a network. The channel is typically used to share files within a network or to link to a printer, for example.
This method has been found in previously known cyberattacks, including the Sony hack in 2014 blamed on North Korea.
"Since a July 2009 cyberattack by North Korea, they used the same method," Mr Choi said. "It's not unique in North Korea but it's also not a very common method."
He also cited an accidental communication he had last year with a hacker traced to a North Korean internet address who admitted development of ransomware.
Russian security firm Kaspersky has said portions of the WannaCry programme use the same code as malware previously distributed by the Lazarus Group, a hacker collective behind the 2014 Sony hack.
Another security company, Symantec, has also found similarities between WannaCry and Lazarus tools.
But it is possible the code was simply copied from the Lazarus malware without any other direct connection.
If North Korea, believed to be training cyber warriors at schools, is responsible for the latest attack, Mr Choi said the world should stop underestimating its capabilities and work together to think of a new way to respond to cyber threats, such as having China pull the plug on North Korea's internet.
"We have underestimated North Korea so far that since North Korea is poor, it wouldn't have any technologies. But North Korea has been preparing cyber skills for more than 10 years and its skill is significant. We should never underestimate it."
- AP
