Indian-origin Google techie links ransomware attack to North Korea

Indian-origin Google techie links ransomware attack to North Korea

Write Comment     |     E-Mail To a Friend     |     Facebook     |     Twitter     |     Print

London, 16 May 2017: An Indian-origin security researcher with Google has found evidence suggesting that North Korean hackers may have carried out the "unprecedented" ransomware cyberattack that hit over 150 countries, including India.


Neel Mehta has published a code which a Russian security firm has termed as the "most significant clue to date", BBC reported today.


The code, published on Twitter, is exclusive to North Korean hackers, researchers said.


Researchers have said that some of the code used in Friday’s ransomware, known as WannaCry software, was nearly identical to the code used by the Lazarus Group, a group of North Korean hackers who used a similar version for the devastating hack of Sony Pictures Entertainment in 2014 and the last year’s hack of Bangladesh Central Bank.


Security experts are now cautiously linking the Lazarus Group to this latest attack after the discovery by Mehta.


Mehta has found similarities between code found within WannaCry and other tools believed to have been created by the Lazarus Group in the past, BBC reported.


Security expert Prof Alan Woodward said that time stamps within the original WannaCry code are set to UTC +9 - China’s time zone - and the text demanding the ransom uses what reads like machine-translated English, but a Chinese segment apparently written by a native speaker, the report said.


"As you can see it is pretty thin and all circumstantial. However, it is worth further investigation," Woodward said.


"Neel Mehta’s discovery is the most significant clue to date regarding the origins of WannaCry," said Russian security firm Kaspersky, but noted a lot more information is needed about earlier versions of WannaCry before any firm conclusion can be reached, it reported.


"We believe it is important that other researchers around the world investigate these similarities and attempt to discover more facts about the origin of WannaCry," it said.


Attributing cyberattacks can be notoriously difficult - often relying on consensus rather than confirmation, the report said.


North Korea has never admitted any involvement in the Sony Pictures hack - and while security researchers, and the US government, have confidence in the theory, neither can rule out the possibility of a false flag, it said.


Skilled hackers may have simply made it look like it had origins in North Korea by using similar techniques.


In the case of WannaCry, it is possible that hackers simply copied code from earlier attacks by the Lazarus Group.


"There’s a lot of ifs in there. It wouldn’t stand up in court as it is. But it’s worth looking deeper, being conscious of confirmation bias now that North Korea has been identified as a possibility," Woodward said.


It’s the strongest theory yet as to the origin of WannaCry, but there are also details that arguably point away from it being the work of North Korea.


First, China was among the countries worst hit, and not accidentally - the hackers made sure there was a version of the ransom note written in Chinese. It seems unlikely North Korea would want to antagonise its strongest ally. Russia too was badly affected, the report said.


Second, North Korean cyber-attacks have typically been far more targeted, often with a political goal in mind.


In the case of Sony Pictures, hackers sought to prevent the release of The Interview, a film that mocked North Korean leader Kim Jong-Un. WannaCry, in contrast, was wildly indiscriminate - it would infect anything and everything it could, the report said.


Finally, if the plan was simply to make money, it’s been pretty unsuccessful on that front too - only around USD 60,000 has been paid in ransoms, according to analysis of Bitcoin accounts being used by the criminals.


With more than 200,000 machines infected, it’s a terrible return, the report said.


On Friday, Europol Director Rob Wainwright said, "The global reach is unprecedented. The latest count is over 200,000 victims in at least 150 countries and those victims many of those will be businesses including large corporations".


The most disruptive attacks were reported in the UK, where hospitals and clinics were forced to turn away patients after losing access to computers.


Write your Comments on this Article
Your Name
Native Place / Place of Residence
Your E-mail
Your Comment   You have characters left.
Security Validation 3 + 6  = 
Disclaimer: Kindly do not post any abusive, defamatory, infringing, obscene, indecent, discriminatory or unlawful material or SPAM. reserves the right to block/ remove without notice any content received from users.
Maatru Pratishtana
Infant Jesus Church, Pilar
Infant Jesus Church, Pilar

An Appeal

Monthi Fest - 2017
Monthi Fest - 2017 Album

Albums around the world

Maria Tours & Travels

Sunshine Pride
Sunshine Pride
Uzvaad Fortnightly
Uzvaad Fortnightly

Call : 91 9482810148

Your ad Here
Power Care
Nissi Infinity
Ryan Intl Mangaluru
Tourist & visit visas for UAE
Palm Grove Travels & Tourism

Palm Grove Travels

Syndicate Bank
Mandavi Acropolis
Mandavi Acropolis
pearl printing
Anil Studio
Bellevision Cute Kid Contest
Udupi Today

Konkani Literature World

Grace Ministries