NSA Penetrating North Korea with Malware

The NSA has been targeting North Korea and its impenetrable system for a long time. New revelations have been brought to light and the NSA has started to equip the USA for possible digital wars in the near future, using surveillance and digital weapons to enhance its existing power.

Though North Korea has been the prime suspect of the recent Sony Pictures hack last November according to the FBI, there is still great room to doubt such a claim. Especially after the new revelations from Edward Snowden and the reports from Der Spiegel, with the voice of Jacob Appelbaum and others, suspicion has been raised and nobody believes that North Korea is to blame for everything turning bad in the world. It is customary on behalf of the NSA to be linked to tactics of unauthorized surveillance, with the example of last year's report proving that the Agency has backdoors for a number of different devices toward collecting data.

A new wave of documents, leaked by Edward Snowden and published by the Der Spiegel magazine, demonstrates how the NSA has used its servers as hacking platforms (i.e. FOXACID) to hack in the system of foreign governments by implanting a malware. Other components involved in the attacks are Turbine and Turmoil, belonging to the Turbulence family exploitation systems. According to Snowden, the NSA also secretly tapped into South Korean network espionage on North Korean networks to collect information.

"Spurred by growing concern about North Korea's maturing capabilities, the American spy agency drilled into the Chinese networks that connect North Korea to the outside world, picked through connections in Malaysia favored by North Korean hackers and penetrated directly into the North with the help of South Korea and other American allies, according to former United States and foreign officials, computer experts later briefed on the operations and a newly disclosed N.S.A. document." reports The New York Times.

The NSA hackers compromised the North Korean systems by spreading malicious code through spear phishing campaigns:

"The N.S.A.'s success in getting into North Korea's systems in recent years should have allowed the agency to see the first "spear phishing" attacks on Sony — the use of emails that put malicious code into a computer system if an unknowing user clicks on a link — when the attacks began in early September, according to two American officials."

One of the hacking scenarios described in the documents leaked by Snowden describes how the NSA's Tailored Access Office hijacked a botnet known by the codename "Boxingrumble" that initially was used to target the computers of Chinese and Vietnamese dissidents and was being used to target the DOD's unclassified NIPRNET network.

"The NSA was able to deflect the attack and fool the botnet into treating one of TAO's servers as a trusted command and control (C&C or C2) server. TAO then used that position of trust, gained by executing a DNS spoofing attack injected into the botnet's traffic, to gather intelligence from the bots and distribute the NSA's own implant malware to the targets." reports ArsTechnica.

Based on the new leaks from the world-renowned whistleblower Edward Snowden, the NSA is preparing the USA for digital wars. The Agency has been building its defensive line and asking for people who enjoy breaking things to join their cause. As it seems, thorough preparation is taking place for the digital wars to come – the Internet is certain to play a crucial role to the wars of the future, after all. In order to prevail, they have been aiming to the establishment of the innovative and extremely powerful D weapons (with D referring to Digital), after the Atomic, Biological and Chemical ones of the past.

James A. Lewis is an expert in cyberwarfare working at the Center for Strategic and International Studies in Washington. He commented on the determination and certainty of Barack Obama to accuse North Korea of the recent Sony hack:

"Attributing where attacks come from is incredibly difficult and slow. The speed and certainty with which the United States made its determinations about North Korea told you that something was different here — that they had some kind of inside view."

Such haste and lack of doubt surely raise an eyebrow as to how the United States of America have managed to get solid proof of North Korea's guilt on the matter.

Der Spiegel brought to public attention another top secret document, which reveals that the NSA obtained data from places like North Korea. The document sheds light on the methods used by spying agencies worldwide, with information collected one way or another and data transferred to various destinations. As a result, all the revelations agree that the NSA has been accurate and to the point toward penetrating one of the most powerful systems in the world and that the data collected is meant to help in cases of cyberwarfare.

http://securityaffairs.co/wordpress/32592/intelligence/

« Understanding digital intelligence from a British Perspective
Hacking Paranoia: Switzerland Cashing In By Marketing Itself As A 'Safe Haven' For Storing Data »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ITQ

ITQ

ITQ is an IT consulting firm with a focus on the entire VMware-product portfolio with three main services: Professional Services, Support Services and Managed Services.

IT Security Guru

IT Security Guru

IT Security Gurus publish daily breaking news. interviews with the key thinkers in IT security, videos and the top 10 stories as picked by our Editor.

SOTI

SOTI

SOTI is an industry leader in Enterprise Mobility Management (EMM).

Codeproof Technologies

Codeproof Technologies

The Codeproof enterprise mobility solution empowers your business to secure, deploy and manage mobile applications and data on smartphones, tablets, IoT devices and more.

Hack The Box

Hack The Box

Hack The Box is an online platform allowing you to test your penetration testing skills and exchange ideas and methodologies with thousands of people in the security field.

SynerLeap

SynerLeap

SynerLeap is ABB's innovation growth hub. Our aim is to help startups accelerate and expand across industries, ranging from industrial automation and robotics to grid technologies and smart cities.

Randstad

Randstad

Randstad provide outsourcing, staffing, consulting and workforce solutions in the USA across a wide range of job sectors including IT and cybersecurity.

LBMC

LBMC

LBMC is a professional services solutions provider in accounting and finance, human resources, technology, risk and information security, and wealth advisory services.

AutoRABIT

AutoRABIT

AutoRABIT provides DevSecOps tools built specifically for Salesforce developers to increase release velocity, produce consistently high-quality code, and enhance data security.

GetHacked.ca

GetHacked.ca

GetHackded.ca is a certified company offering penetration testing and specialized cybersecurity services.

OneZero Solutions

OneZero Solutions

OneZero specialize in cybersecurity operations, information assurance, computer network operations, solutions engineering, and project management.

Royal United Services Institute (RUSI)

Royal United Services Institute (RUSI)

The Royal United Services Institute is an independent think tank engaged in cutting edge defence and security research. Areas of research include cyber security and resilience.

Cybercentry

Cybercentry

Cybercentry is a specialist information security, data protection and cyber security consultancy.

ThreatCaptain

ThreatCaptain

ThreatCaptain is a Cybersecurity Leadership Development Company driven to enhance and illuminate cybersecurity risk through strategic alignment and informed business decision-making.

SignalRed

SignalRed

SignalRed provides the cutting edge next-generation penetration testing and secure development solutions to startups and large enterprises.

OOKOS

OOKOS

OOKOS was founded in 2023 by a team of cybersecurity veterans who recognized that traditional security models were failing to keep pace with evolving threats.