NSA Penetrating North Korea with Malware

The NSA has been targeting North Korea and its impenetrable system for a long time. New revelations have been brought to light and the NSA has started to equip the USA for possible digital wars in the near future, using surveillance and digital weapons to enhance its existing power.

Though North Korea has been the prime suspect of the recent Sony Pictures hack last November according to the FBI, there is still great room to doubt such a claim. Especially after the new revelations from Edward Snowden and the reports from Der Spiegel, with the voice of Jacob Appelbaum and others, suspicion has been raised and nobody believes that North Korea is to blame for everything turning bad in the world. It is customary on behalf of the NSA to be linked to tactics of unauthorized surveillance, with the example of last year's report proving that the Agency has backdoors for a number of different devices toward collecting data.

A new wave of documents, leaked by Edward Snowden and published by the Der Spiegel magazine, demonstrates how the NSA has used its servers as hacking platforms (i.e. FOXACID) to hack in the system of foreign governments by implanting a malware. Other components involved in the attacks are Turbine and Turmoil, belonging to the Turbulence family exploitation systems. According to Snowden, the NSA also secretly tapped into South Korean network espionage on North Korean networks to collect information.

"Spurred by growing concern about North Korea's maturing capabilities, the American spy agency drilled into the Chinese networks that connect North Korea to the outside world, picked through connections in Malaysia favored by North Korean hackers and penetrated directly into the North with the help of South Korea and other American allies, according to former United States and foreign officials, computer experts later briefed on the operations and a newly disclosed N.S.A. document." reports The New York Times.

The NSA hackers compromised the North Korean systems by spreading malicious code through spear phishing campaigns:

"The N.S.A.'s success in getting into North Korea's systems in recent years should have allowed the agency to see the first "spear phishing" attacks on Sony — the use of emails that put malicious code into a computer system if an unknowing user clicks on a link — when the attacks began in early September, according to two American officials."

One of the hacking scenarios described in the documents leaked by Snowden describes how the NSA's Tailored Access Office hijacked a botnet known by the codename "Boxingrumble" that initially was used to target the computers of Chinese and Vietnamese dissidents and was being used to target the DOD's unclassified NIPRNET network.

"The NSA was able to deflect the attack and fool the botnet into treating one of TAO's servers as a trusted command and control (C&C or C2) server. TAO then used that position of trust, gained by executing a DNS spoofing attack injected into the botnet's traffic, to gather intelligence from the bots and distribute the NSA's own implant malware to the targets." reports ArsTechnica.

Based on the new leaks from the world-renowned whistleblower Edward Snowden, the NSA is preparing the USA for digital wars. The Agency has been building its defensive line and asking for people who enjoy breaking things to join their cause. As it seems, thorough preparation is taking place for the digital wars to come – the Internet is certain to play a crucial role to the wars of the future, after all. In order to prevail, they have been aiming to the establishment of the innovative and extremely powerful D weapons (with D referring to Digital), after the Atomic, Biological and Chemical ones of the past.

James A. Lewis is an expert in cyberwarfare working at the Center for Strategic and International Studies in Washington. He commented on the determination and certainty of Barack Obama to accuse North Korea of the recent Sony hack:

"Attributing where attacks come from is incredibly difficult and slow. The speed and certainty with which the United States made its determinations about North Korea told you that something was different here — that they had some kind of inside view."

Such haste and lack of doubt surely raise an eyebrow as to how the United States of America have managed to get solid proof of North Korea's guilt on the matter.

Der Spiegel brought to public attention another top secret document, which reveals that the NSA obtained data from places like North Korea. The document sheds light on the methods used by spying agencies worldwide, with information collected one way or another and data transferred to various destinations. As a result, all the revelations agree that the NSA has been accurate and to the point toward penetrating one of the most powerful systems in the world and that the data collected is meant to help in cases of cyberwarfare.

http://securityaffairs.co/wordpress/32592/intelligence/

« Understanding digital intelligence from a British Perspective
Hacking Paranoia: Switzerland Cashing In By Marketing Itself As A 'Safe Haven' For Storing Data »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Hack Miami

Hack Miami

HackMiami is the premier resource in South Florida for highly skilled hackers that specialize in vulnerability analysis, penetration testing, digital forensics, and all manner of IT security.

Auth0

Auth0

Auth0 is a cloud service that provides a set of unified APIs and tools that instantly enables single sign-on and user management for any application, API or IoT device.

GE Digital

GE Digital

GE Digital is a leading software company for the Industrial Internet. Products include Industrial Cyber Security for Operational Technology (OT).

Qubitekk

Qubitekk

Qubitekk has developed quantum cryptography solutions for the machine-to-machine (M2M) communications market.

Protiviti

Protiviti

Protiviti consulting solutions span critical business problems in technology, business process, analytics, risk, compliance, transactions and internal audit.

NSEIT

NSEIT

NSEIT offers end-to-end Information Technology products, solutions and services including cybersecurity to organizations in the financial sector.

CyBOK - University of Bristol

CyBOK - University of Bristol

CyBOK is a comprehensive Body of Knowledge to inform and underpin education and professional training for the cyber security sector.

German Israeli Partnership Accelerator (GIPA)

German Israeli Partnership Accelerator (GIPA)

GIPA is based on two pillars: it is an incubator aimed at young academics and a program to transfer cybersecurity expertise to corporate partners.

GoSecure

GoSecure

GoSecure Managed Detection and Response helps all organizations reduce dwell time by preventing breaches before they happen.

ThreatModeler

ThreatModeler

ThreatModeler is an automated threat modeling solution that fortifies an enterprise’s Software Development Lifecycle by identifying, predicting and defining threats.

Bloc Ventures

Bloc Ventures

Bloc Ventures is an investment company providing long-term, ‘patient’ equity capital to early stage unquoted deep technology companies.

Protek International

Protek International

Protek International delivers world-class Digital Forensics, eDiscovery, Cyber Security, and related Advisory services.

evolutionQ

evolutionQ

evolutionQ delivers quantum-risk management strategies and robust cybersecurity tools designed to be safe in an era with quantum computing technologies.

HEROIC Cybersecurity

HEROIC Cybersecurity

HEROIC’s enterprise cybersecurity services help improve overall organizational security with industry best practices and advanced technology solutions.

NPCERT

NPCERT

NPCERT is a team of Information Security experts formed to address the urgent need for the protection of national information and growing cybersecurity threat in Nepal.

DataGuard

DataGuard

DataGuard is a security and compliance software company trusted by organisations across the globe.