NSA Penetrating North Korea with Malware

The NSA has been targeting North Korea and its impenetrable system for a long time. New revelations have been brought to light and the NSA has started to equip the USA for possible digital wars in the near future, using surveillance and digital weapons to enhance its existing power.

Though North Korea has been the prime suspect of the recent Sony Pictures hack last November according to the FBI, there is still great room to doubt such a claim. Especially after the new revelations from Edward Snowden and the reports from Der Spiegel, with the voice of Jacob Appelbaum and others, suspicion has been raised and nobody believes that North Korea is to blame for everything turning bad in the world. It is customary on behalf of the NSA to be linked to tactics of unauthorized surveillance, with the example of last year's report proving that the Agency has backdoors for a number of different devices toward collecting data.

A new wave of documents, leaked by Edward Snowden and published by the Der Spiegel magazine, demonstrates how the NSA has used its servers as hacking platforms (i.e. FOXACID) to hack in the system of foreign governments by implanting a malware. Other components involved in the attacks are Turbine and Turmoil, belonging to the Turbulence family exploitation systems. According to Snowden, the NSA also secretly tapped into South Korean network espionage on North Korean networks to collect information.

"Spurred by growing concern about North Korea's maturing capabilities, the American spy agency drilled into the Chinese networks that connect North Korea to the outside world, picked through connections in Malaysia favored by North Korean hackers and penetrated directly into the North with the help of South Korea and other American allies, according to former United States and foreign officials, computer experts later briefed on the operations and a newly disclosed N.S.A. document." reports The New York Times.

The NSA hackers compromised the North Korean systems by spreading malicious code through spear phishing campaigns:

"The N.S.A.'s success in getting into North Korea's systems in recent years should have allowed the agency to see the first "spear phishing" attacks on Sony — the use of emails that put malicious code into a computer system if an unknowing user clicks on a link — when the attacks began in early September, according to two American officials."

One of the hacking scenarios described in the documents leaked by Snowden describes how the NSA's Tailored Access Office hijacked a botnet known by the codename "Boxingrumble" that initially was used to target the computers of Chinese and Vietnamese dissidents and was being used to target the DOD's unclassified NIPRNET network.

"The NSA was able to deflect the attack and fool the botnet into treating one of TAO's servers as a trusted command and control (C&C or C2) server. TAO then used that position of trust, gained by executing a DNS spoofing attack injected into the botnet's traffic, to gather intelligence from the bots and distribute the NSA's own implant malware to the targets." reports ArsTechnica.

Based on the new leaks from the world-renowned whistleblower Edward Snowden, the NSA is preparing the USA for digital wars. The Agency has been building its defensive line and asking for people who enjoy breaking things to join their cause. As it seems, thorough preparation is taking place for the digital wars to come – the Internet is certain to play a crucial role to the wars of the future, after all. In order to prevail, they have been aiming to the establishment of the innovative and extremely powerful D weapons (with D referring to Digital), after the Atomic, Biological and Chemical ones of the past.

James A. Lewis is an expert in cyberwarfare working at the Center for Strategic and International Studies in Washington. He commented on the determination and certainty of Barack Obama to accuse North Korea of the recent Sony hack:

"Attributing where attacks come from is incredibly difficult and slow. The speed and certainty with which the United States made its determinations about North Korea told you that something was different here — that they had some kind of inside view."

Such haste and lack of doubt surely raise an eyebrow as to how the United States of America have managed to get solid proof of North Korea's guilt on the matter.

Der Spiegel brought to public attention another top secret document, which reveals that the NSA obtained data from places like North Korea. The document sheds light on the methods used by spying agencies worldwide, with information collected one way or another and data transferred to various destinations. As a result, all the revelations agree that the NSA has been accurate and to the point toward penetrating one of the most powerful systems in the world and that the data collected is meant to help in cases of cyberwarfare.

http://securityaffairs.co/wordpress/32592/intelligence/

« Understanding digital intelligence from a British Perspective
Hacking Paranoia: Switzerland Cashing In By Marketing Itself As A 'Safe Haven' For Storing Data »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

RISA

RISA

RISA solutions help to secure networks, improve overall network security, and achieve government regulatory compliance.

SafeUM Communications

SafeUM Communications

SafeUM Secure Messenger is an encrypted secure communications protection mechanism for instant messaging.

Globalscape

Globalscape

Globalscape is a leader in secure data exchange solutions.

Original Software

Original Software

Original Software offers a test automation solution focused completely on the goal of effective software quality management.

Early Warning Services

Early Warning Services

Early Warning is committed to providing awareness, education, and enablement around fraud prevention.

Redborder

Redborder

Redborder is an Open Source network visibility, data analytics, and cybersecurity Big Data solution that is scalable up to the needs of enterprise networks and service providers.

Calero Software

Calero Software

Calero is a leading global provider of Communications and Cloud Lifecycle Management (CLM) solutions designed to simplify the management of voice, mobile and other unified communications services.

Atlant Security

Atlant Security

Atlant Security is a cyber and IT security company offering consulting and implementation services.

CryptoDATA

CryptoDATA

CryptoDATA develops products and services based on Blockchain technology, that ensure user security and data encryption, applicable in various fields.

Frontal

Frontal

Frontal is a specialized unit in Blockchain and Web3.0 cybersecurity. Securing Digital Assets, Cryptocurrency, DeFi, Blockchain and Web3.0 ecosystem.

Glasstrail

Glasstrail

Glasstrail are single-minded about helping organisations gather intelligence and manage vulnerabilities in their attack surface before adversaries exploit them.

ERCOM

ERCOM

Ercom, a subsidiary of the Thales Group, is a French company known for its mobility security solutions.

Xcelerate Solutions

Xcelerate Solutions

Xcelerate Solutions is a leading defense and national security company, providing integrated solutions in three service areas – Enterprise Security, Digital Transformation, and Strategic Consulting.

MergeBase

MergeBase

Reduce software supply chain risk with MergeBase proven Software Composition Analysis (SCA).

Cyber Brain Academy

Cyber Brain Academy

At Cyber Brain Academy, our mission is to provide high-quality IT certification training for the cyber security workforce.

Apex iQ (ApexiQ)

Apex iQ (ApexiQ)

ApexiQ is a continuous asset assurance platform that empowers you with the confidence to make better data-driven decisions and take automated action to reduce your risk.