73: WannaCry

JACK: Hey, it’s Jack, host of the show. Listen, you might not be ready for this episode. There’s
a few prerequisites I recommend you do first. First, we’re gonna be talking about the Shadow
Brokers in this episode and I already covered them in Episode 53, so I highly encourage you
to check that episode out first – which is just called Shadow Brokers – before this one. Second,
I made Episode 71, 72, and 73 to be listened to in that order,
and since this is Episode 73, maybe check out the two episodes before this first. Of course,
you don’t have to; this episode still stands on its own anyway,
but that’s my recommendation. Okay, so with that out of the way, let’s jump right into it.
TONY: My name is Tony Bleetman. I’m an emergency physician and in 2017,
I was working as a freelance senior emergency physician in a number of hospitals in the UK.
JACK: Why did I take up this physician’s precious time to come on a show which talks
about hacking? [MUSIC] Because he was at the center of one of the biggest ransomware attacks
in history. The date was May 12, 2017, which is a date Dr. Bleetman will remember for a long time.
TONY: I remember pitching up for a shift at a hospital in London at about noon. As
I walked into the office, the WannaCry screen had come up on the computers.
JACK: Specifically, the computers in the hospital were stuck on a red screen which said, ‘Oops,
your files have been encrypted. Send $300 worth of Bitcoin to this address to decrypt
them.’ This is a typical ransomware message. See, if your files get encrypted and you don’t
have the key to decrypt them, your files are no longer readable. Some hacker gained
control over the hospital’s computers and was demanding Bitcoin to unlock them. Now,
this ransomware which was encrypting the files was called WanaCrypt,
spelled W-A-N-A, but people quickly just started calling this ransomware WannaCry.
TONY: I just walked into the situation and within a very short time, people understood
that this was a cyber-attack affecting the health service,
and communication between friends and hospitals confirmed that.
JACK: This WannaCry ransomware not only took over the computers in this hospital,
but was hitting other hospitals in UK’s NHS, their National Health Service.
TONY: My take on this is quite simple; that when the technology lets us down in any circumstance,
we have to fall back on old fashioned, well-worn, well-proven basic medical techniques. We just had
to rely more on clinical judgment and rely a lot less on information systems.
JACK: The NHS had to make a lot of adjustments to stay operational.
TONY: If you think about the process of a patient attending an emergency department,
someone has to register them, someone has to order blood tests, and someone has to order x-rays
and CT scans. Someone has to communicate with their own family doctor once they’ve finished,
and one has to transfer information around the hospital. When that’s all missing, you have no
computerized registration of patients, your IC package that tells you where patients are at any
time is not working, so we had to compensate for all these things by doing old fashioned things.
When a patient came in, they were registered on paper. We had a big whiteboard on the wall and so,
we could write down the names of patients and identify their location within a rather large
department. Because we didn’t have computerized blood results from blood tests from the lab,
every half an hour we sent a runner to the labs to have a manual printout of the blood
tests and deliver them to the department by hand. We had to look at x-rays on portable
machines because we couldn’t see them on computers. Things that involved hi-tech
interventions were suspended or we found old fashioned alternatives.
JACK: Now, this ransomware was targeting Windows computers and specifically,
Windows computers that were connected to the network. Not all Windows computers in the hospital
are actually part of the network, [MUSIC] partly because of this exact reason. Some systems like CT
scanners were just not plugged into the network with an ethernet cord or anything like that.
TONY: Well, one of the things that we learned is that when your computers are not networked – I
mean, a CT scan had its own internal hard drive, so we relied on that. It was limited
to a certain amount of memory every day, so we had to restrict the number of scans that we ordered.
What it meant was, because – we had to [00:05:00] fall back on machines that were not connected to
the network, so standalone diagnostic machines that were not connected to the network were
unaffected, so we could run some basic blood tests on isolated machines, and we could run CT scans on
machines that were not affected by the virus. It was quite useful. If machines are autonomous and
not connected to the wider network, which we used to think was a hindrance than a problem,
it actually saved their function because they were not taken out by the WannaCry virus.
JACK: The NHS had to cancel 6,912 appointments because of this. But as of right now,
it doesn’t look like anyone died due to this attack. While battling with this problem,
the hospital was learning how wide-spread this was.
TONY: We switched on the news and we spoke to friends in other hospitals, and it was obvious
very, very early on that this was a national – if not international – problem across the
country. Some of the things that we relied upon; trauma centers were temporarily closed, so we had
to deal with any trauma cases coming in because the surgeons in the trauma centers were unhappy
to operate without CT scans that they could see in the operating room. For a short while,
trauma centers weren’t receiving patients, or some of them weren’t, and half the trauma
centers were also not receiving patients because they were computerized as well.
JACK: The BBC was playing an interview with Amber Rudd, the Home Secretary of the UK. Here’s a clip.
AMBER: We’re working very hard to make sure that we help the NHS put their systems back
in order. So far, we’ve had reassurance from them that no patient data has been
compromised. The National Cyber Security Center is working with them to end the disruption,
to contain it, and to make sure that we learn lessons from it.
HOST: Can you give us the figures as you understand them at this
stage about how many hospitals, how many trusts are affected?
AMBER: Well, we understand that forty-five have been affected out of several hundred. Most of them
are being very cautious about this. Some of them are making changes, some of them aren’t. Some of
them are managing to carry on with their daily work despite these difficulties. But can I also
just point out that this particular attack, this cyber-attack, hasn’t been particularly
focused on the NHS? It’s been a worldwide attack. It’s affected a hundred countries,
different organizations, but it’s just in the UK that it’s been particularly impacted on our NHS.
JACK: [INTRO MUSIC] The WannaCry ransomware that was unleashed on the world was ripping
through thousands of computers, causing destruction everywhere. This is the
moment that all IT and security teams both fear and prepare for.
(INTRO): These are true stories from the dark side of the internet. I’m
Jack Rhysider. This is Darknet Diaries.
JACK:
Okay, so what do we know at this point? It’s May 12th, 2017 and the world is being hit by
a huge ransomware campaign. The NHS is one of the bigger networks to be hit by
this. The new is reporting on this. Now, when something hits the world on a scale like this,
it gets the attention of a lot of security researchers. The whole security community is
buzzing about this. For instance, FireEye was one of the companies that began researching WannaCry.
JOHN: My name is John Hultquist. I’m the senior director for intelligence analysis at FireEye.
JACK: FireEye is a threat intelligence company. They spend all day, every day,
investigating emerging threats and they provide many tools and services to help companies detect
and respond to cyber-attacks. FireEye is a major player in this space and have been called to
investigate many high-profile cases. Now, by this time, Twitter was going crazy talking about this.
This was a huge attack, hitting companies all over the world. While companies like FireEye
can’t investigate every new piece of malware, this one was big enough to pay attention to.
JOHN: Yeah, I think that there was good evidence to believe that this was hitting
several organizations simultaneously. We had reason to believe it was going to hit even more
of our customers. Usually, in circumstances like that, we spin up a community and protection event.
That’s where we basically bring all the power of FireEye, [MUSIC] all the different divisions
together literally into a single chatroom, and we start trying to break down the problem
as fast as we can. One big piece of that with this was getting our hands on the malware and
starting to – have the reverse-engineers start ripping it [00:10:00] apart to look for clues
as to what was going on, because we thought that this was ransomware. We didn’t know who
it belonged to. We were just trying to figure out why it was moving so quickly at some point.
We were essentially asking a bunch of questions that took us a while to answer.
JACK: Now, FireEye wasn’t the only group looking into this. When something like this hits,
a lot of companies have to investigate. For instance, this was looking like it was hitting
Windows machines specifically, so Microsoft would absolutely have to investigate this,
too. But think about all the antivirus companies or threat detection systems that are out there.
These companies would all pay attention to an attack like this so that they can find a way
to detect and block stuff like this from happening to their customers. Dozens of major companies were
all scrambling to get a copy of the WannaCry ransomware. On top of that, you have a lot of
independent security researchers who are good at reverse-engineering who also try taking a look.
This was an exciting time for the security research community. This was something brand-new,
and it was hitting hard and spreading fast. It’s exciting, like when your favorite author
publishes a new book or a favorite video game launches a new level to try. There’s
this magical moment in time where there’s just no blog posts about this, there’s no news stories,
and nobody understands what’s happening. So, people everywhere are racing to get
some answers. Since nobody knows anything about this malware, everyone has to start from square
one. You might be the one who finds the hidden key that unlocks this whole mysterious malware.
It’s adventurous and exciting to be part of the investigation even if you’re just an
independent researcher. Now, another person who was researching this was Matt Suiche.
MATT: My name is Matt Suiche. I’m the founder of Comae Technology. It’s a
small startup focused on incident response. Back in May 2017, most of people in InfoSec,
we also – that there was a ransomware that was targeting a bunch of companies,
and people were all posting screenshots all over Twitter. Then the first thing
everyone was trying to do was to get samples of that ransomware.
JACK: Matt is a French security researcher, also an entrepreneur. He’s developed a few
companies at this point, but the one he’s building now is called Comae.
It specializes in memory forensics. This new ransomware interested Matt,
and he grabbed a sample of the malware and began investigating.
MATT: Well, the thing to keep in mind for malware and especially ransomware; they’re very easy to
analyze because they are very redundant. What they do is always the same thing. Most of the
time there is no obfuscation. You can get a clear idea of what malware or ransomware is doing fairly
quickly, like around an hour. It’s not like you have to analyze a root key, anything like this.
You can get a very good idea of the big picture of what they do. The idea was just trying to
understand what it was doing to be able to write a short writeup, because everyone was
panicking around it. Usually, when it’s something like this, especially as a small startup, it’s
interesting to release something before everyone else because large companies will not be able to
publish blog posts as quickly because of their own internal cycles for publishing anything. That one,
the idea was first to analyze what it was doing, how it works, kind of like what it was doing.
JACK: Now, malware like this is precompiled which means if you look at the program itself,
it just looks like gibberish. It’s machine code. A computer understands what to do with it,
but it’s not human-readable. You have to use a reverse-engineer tool like IDA
Pro or Ghidra [MUSIC] to convert it to assembly link which is human-readable,
but it’s very rudimentary. Like, put this data in the memory, then move it from here to there,
and then remove the data from the memory. You don’t see if L-statements and things that make
sense, so because it’s so low-level, it requires a lot of skill to know how to
reverse-engineer a program to figure out what it does, which in my opinion is pretty hard
to do. But Matt’s good at this, so he dove into the code and saw something remarkable.
MATT: On the exploitation bot, so, what was pretty interesting is – and having even before analyzing
it, people had a strong suspicion around it anyway – is oh, it was using the DoublePulsar on
EternalBlue that was leaked a few months before by the Shadow Brokers.
JACK: The exploit this malware was using was EternalBlue. Now, let’s back up a second;
one month before this WannaCry outbreak, the Shadow Brokers gave the world
EternalBlue. You remember Shadow Brokers, right? If not, go check out Episode 53. But
the [00:15:00] story goes that someone hacked into the NSA and stole hacking tools and exploits the
NSA uses, then slowly released these tools to the public. Now, what’s strange here is a month before
EternalBlue was released, Microsoft patched it. We’re not sure if NSA warned Microsoft
or if Microsoft found it themselves. Regardless, the patch came out and then Shadow Brokers gave
this exploit to the world to use however they want. Now, we still don’t know who the Shadow
Brokers were, but they would send messages sometimes. At one point, they called out
MalwareJake for being part of Equation Group, or NSA. But there was more to that tweet. It read…
MATT: The Shadow Brokers is not in habit of outing Equation Group members,
but had made exception for Big Mouth. It was to MalwareJake and then it was saying,
‘Keep talking shit. M. Suiche, you’re next.’
JACK: Yeah, the Shadow Brokers had mentioned Matt by name in the very tweet they practically doxxed
MalwareJake as being part of Equation Group. Was this also saying Matt was part of Equation Group?
MATT: That one, yeah, was nothing. I was like well,
that’s kind of flattering but I’m French, you know?
JACK: Matt is not former-NSA or Equation Group, and he didn’t even have to explain
this since the Shadow Brokers later clarified this in a tweet saying yeah, they know he’s
not ex-NSA since he’s French-born. Why were the Shadow Brokers talking about him? Well,
it’s kind of a mystery, actually. First of all, [MUSIC] Matt was really fascinated with
the Shadow Brokers and what they were releasing to the world. So,
he was screenshotting everything the Shadow Brokers posted, and was blogging about it a
lot. During the whole Shadow Brokers ordeal, Matt gave a talk at Black Hat about them.
MATT: Before we start, please raise your hand if you have never heard of the Shadow Brokers.
JACK: On top of that, Matt has a fairly large Twitter following, so it’s possible the Shadow
Brokers were just seeing what people were saying about them. They saw Matt’s post and liked him.
MATT: I was flattered though about it because it’s like oh, it’s kind of cool that they’re
mentioning me because it means everything; all my blog posts, all the analysis I did of all
their release – because that’s how they would know me. Otherwise, there is no way they would
have mentioned me. Even at some point, they were kind of saying – I know they’re calling me French.
Oh yeah, because I gave a keynote at Black Hat the same year. I was giving an overview of what the
Shadow Brokers were doing. I was saying oh, you should come, we should have a beer. He’s like oh,
I will only come if you speak at Defcon. I will be in the first row. An interested part of me still
do thinks they are American, but it’s kind of hard to prove. But yeah, they were friendly. They’re
like oh, Suiche seems to be a friendly guy. They were definitely very entertaining. Also, a lot
of the way they speak – because the grammatical mistakes, you can tell they are completely fake.
JACK: Well, the way they type might be a fake accent or something,
but the Shadow Brokers releasing EternalBlue to the world was not fake. It was a very
serious vulnerability which exploited the way Windows file sharing works,
or SMB. [MUSIC] If you have a vulnerable version of SMB running on your computer,
a person could easily take remote control of that computer. So, exactly one month after
EternalBlue was released, WannaCry was launched which used that exploit, which is one reason
why this ransomware infected so many machines; because it was using a wicked-good exploit that
just came out not too long ago. What’s more is that this ransomware was a self-propagating worm.
When it would infect one computer, it would then look to try to infect every other computer in
that local network. This meant if it could just get a small foothold in a network, it could then
spread to a large amount of computers inside your network. A worm like this using a vulnerability
like that is going to spread quickly, and it did. Now, again, this exploit was patched in Windows
about two months earlier, so anyone who had automatic updates on or were installing the latest
security patches for Windows were not affected by this. But as it turns out, a lot of Windows
computers in the world don’t update as frequently as they should, and this creates a problem.
JOHN: Yeah, it’s really interesting. There were patching issues; people hadn’t caught up with the
patching cycle. There’s no doubt about that. But there are some places that were targeted – or,
not necessarily targeted, but that were hit that patching was difficult.
I think that probably the most well-known target was the [00:20:00] NHS in the UK.
People who work in the medical arena will tell you there’s a lot of equipment there that is just
old and it can’t be patched, or can’t be patched because it simply will not function correctly.
It’s not always as simple as just patch.
JACK: [MUSIC] In fact, this got so big and impacted so many old computers that
Microsoft released even more patches. At this point, Windows XP was no longer supported by
Microsoft and they stopped making security patches for it. But a few days after WannaCry came out,
Microsoft released a patch for XP, which is very, very rare for them to release patches after they
stopped supporting that version entirely. Now, when ransomware hits your computer,
it encrypts all the files on it and asks you to pay to unlock them. Some victims were paying the
$300 or $600 in Bitcoin to get their files back. But there was a problem. This didn’t seem to work.
A lot of people were reporting they paid but didn’t get a valid key to decrypt their files. In
fact, if you analyzed the malware, it just didn’t seem to contain the proper methods for restoring
the files at all. These victims who were paying were getting burned twice. Now, at this point,
security researchers were starting to think maybe this isn’t ransomware. Maybe this is
disguised as ransomware and really has other intentions like destroying
a target or a network or something. A lot of questions were starting to rise up. Do
you have any – do you have some general tips for if someone gets hit with ransomware like this?
JOHN: I think every situation is different. It’s important,
I think, if possible, to have a sense of who’s doing that, right? In this case,
it was pretty clear it looked like nobody was going to get their machines
unlocked. Obviously, the tip in that case is don’t pay because it would be an absolute waste
of money. But there are a handful of operators that we know pretty well and I think they all
behave differently. You have different prospects based on who you’re dealing with and what your
specific situation is. Usually, the advice is consult an expert on your specific situation.
JACK: Were there any of your customers that
were trying to consult you that were big companies that were getting hit?
JOHN: Oh, absolutely. I think at the time we were advising that this is
not something that a; a criminal actor that we’re familiar with,
and there didn’t seem to be a payment – the payment mechanism didn’t seem fully operational.
JACK: At this point, John’s team had developed a way to detect and block
this activity in their clients’ networks. They understood this malware fairly well,
but they still had more to figure out.
JOHN: [MUSIC] I think at that point we were – I mean, from my side, I’m the intelligence guy – we
were really trying to determine who’s doing this? What’s the motive behind this? Is this
a state actor? Is this a destructive attack? Can we find some sort of breadcrumbs that will take us
back to other incidents? That’s usually what we’re looking for. We’re trying to take your one, single
incident and connect it to a cluster. Hopefully, we can learn from a cluster of other incidents.
Sometimes they’ve made mistakes in their other incidents, they’ve taught us something about them,
they’ve not – they’ve used infrastructure that maybe we recognize there and then we
can tie them back even further. We’re working diligently to find those clues.
JACK: Well, John and his team were busy trying to figure out who did
it. I think at this time, Matt was trying to figure out how to decrypt
the file somehow. Some other people were looking into different parts of the code for other things.
Another security researcher named Marcus Hutchins was looking at the malware and saw something
that’s fairly unusual for ransomware. He found that upon infecting a machine,
one of the first things this ransomware does is try to go to a specific URL,
a website. It’s a forty-character-long URL which just looks like gibberish. WannaCry would check
if that URL exists and if it did, it would stop running immediately. It would not encrypt the
computer. It would not try to propagate. It would just halt. This is called a kill switch.
Whoever made this ransomware wanted a way to stop it if they had to, and I can imagine a
scenario where this could be useful. Suppose whoever wrote this malware was working for
a nation state and if they released this to the world and it accidentally infected their
own country, yeesh, what a mess they’d have. If that started happening, the [00:25:00] hackers
had a way to halt the entire thing worldwide by just making that URL active. [MUSIC] But
when Marcus Hutchins found this URL in the code, he did a WHOIS lookup on it to see who owned it,
and the domain was not registered. This was odd. You would think that whoever wrote this
malware would have registered the kill switch in case they needed to use it. But it wasn’t
owned by anyone. What’s Marcus do? He registers the domain himself and makes the URL active.
Instantaneously, the ransomware stopped infecting machines worldwide because as soon as a new
computer would be infected, it would check to see if this domain was up. If so, it would stop. Any
computers that were already infected were still infected, and any computers that couldn’t get
to the URL would still become infected, but the number of new computers getting their hard drives
encrypted almost completely stopped. Registering this kill switch turned off this attack. Marcus
single-handedly stopped one of the largest ransomware outbreaks in history. He saved the
world from hundreds of thousands more infections and billions of dollars more in damages. He became
a bit of a legend for doing this. Here’s Marcus in an interview with The Telegraph a few days later.
MARCUS: I’ve had people sort of inundating with messages thanking me, saying I’m a hero. I mean,
I sort of just registered this domain for tracking and I didn’t intend for it to blow up and me to
be all over the media. I was just doing my job and I don’t really think that I’m a hero at all.
JACK: Quite suddenly, all this stopped. The malware completely lost its teeth and
was just fizzling out quite abruptly. But a few days after that, a new variant of
WannaCry started spreading, infected one computer after another, and spreading in
the same manner the first variant did. Matt Suiche immediately jumped on this version.
MATT: I got the sample from @benkow_, analyzed it in a text like, less than a
minute, because once you’re familiar with the malware, it’s quite a straightforward thing.
JACK: Matt had a hunch that in order to start this ransomware back up,
all they would have to do is just change the domain name of the kill switch and it would start
working again. This would be easy to change. He wouldn’t even have to recompile the code;
just change one character in the binary. So, this was one of the first things Matt looked for,
whether the kill switch was there and what domain was it using? Sure enough,
the kill switch was there, but this time it had a new domain name. Still a long forty-character
string, but just a couple letters had changed. Well, Matt checked to see if that domain was
registered, and to his astonishment, it wasn’t. So, he quickly got to work.
MATT: [MUSIC] Extract the domain name and registered it, then I started to
also build a platform around it to be able to collect data on the infection.
JACK: Very quickly, he started seeing computers hitting his domain, checking if the kill switch
was on or not. So, he began collecting data on this which gave him a firsthand
look of what this malware was doing, where it was infecting machines, and how big it was getting.
MATT: It is quite cool but the thing is, that one was not the main one. Even though it got
registered very early, no major infection happened. I think it was between – even
below one hundred at that point. It was in the low-hundred infection hit.
JACK: Because Matt was paying close attention and knew where to look in the code, this malware
didn’t have a chance to spread exponentially. Matt stopped it before it did any significant damage.
But two days after that, another variant was released, and this time it was a security team
at a company called Check Point that saw the new kill switch and nobody had registered that domain,
either. So, Check Point registered it. Quite quickly too, which meant not many machines
got infected with that version, either. Then, a few days later, a fourth variant showed up,
and this time it did not have a kill switch which meant there was no easy way to stop it.
This one had the potential of ripping through millions of computers and infecting them,
but I don’t think this one was very aggressive because we didn’t really see it do anything.
It never really got in the wild and spread. I guess by the time this variant was released,
antivirus companies had already detected it and put out signatures for it,
and people were patching their computers more, or at least closed that port on the network. So,
even without a kill switch, this new variant did not have a substantial impact. Since then,
this malware has significantly died down. We have the people who found these kill switches
and registered them to thank for stopping this from engulfing a large portion of the internet.
MATT: But that kill switch, I kept for around a year. It had a few million hits pretty easily,
enough that one of us – well, I don’t really want to just manage it [00:30:00] on my own because the
platform and everything. I was like well, I’m not really sure of what to do with this data anymore
at this point because I don’t think it’s of any interest for anyone. I reached out to Microsoft
Domestic Team, and I was like oh, do you guys want that kill switch from WannaCry? I think it would
be in better hands if it’s with you, you know? Just so you can keep archiving it or something.
They were okay for it. Actually, they had to step back and say well, the legal department
says it’s too much of a risk. We cannot take it. At the end of the day, they didn’t take it.
The people from the Chronicle security at Google said to take it and then I just gave it to them.
But I thought it was quite funny that Microsoft could not take it because of legal, you know?
JACK: [MUSIC] The estimate is that WannaCry infected 230,000
computers in 150 countries. How many of those infected people paid up? 330 which,
added up, means whoever did this made $140,000 worth of Bitcoin.
Who did this? Well, let’s listen to a statement given by the US Department of Justice.
DOJ: We have unsealed criminal charges against a North Korean computer programmer for participating
in a conspiracy that conducted sophisticated cyber-attacks around the world on behalf of
the North Korean government. Members of the conspiracy are responsible for some of the
most damaging and most well-known cyber intrusions in history including the cyber-attack targeting
Sony Pictures, the cyber-heist of Bangladesh Bank, and creating the WannaCry ransomware.
JACK: There you go; North Korea did this. Specifically,
they’re charging the same person for the Sony hack, Bangladesh Bank hack,
and this WannaCry ransomware. Park Jin Hyok is the person named in the indictment. In fact,
he’s now one of FBI’s Cyber’s Most Wanted. As people investigated this further, they
found there were earlier versions of WannaCry that hadn’t been effective because they weren’t using
EternalBlue which hadn’t been released yet. But on May 9th of 2017, a company called RiskSense
published a proof-of-concept using EternalBlue as an exploit. They even included source code and
explained how to use it. Three days later, the new version of WannaCry with EternalBlue was released.
It looks like the same code was used in this malware, so it seems to me that someone in
North Korea saw the blog post by RiskSense, copied the code from it into their existing
WannaCry ransomware, and released it on the world three days later.
It’s hard to point fingers here. Yeah, North Korea is who pulled the trigger on all this. Okay,
but they may not have done that if they didn’t see the blog post by Risk Sense. But Risk Sense
wouldn’t have published that blog post if it wasn’t for the Shadow Brokers releasing
EternalBlue to the world. But Shadow Brokers wouldn’t have released
EternalBlue if it wasn’t for the NSA creating it to begin with, and EternalBlue would have
never existed if Microsoft just would have caught the bug during development and testing.
It’s a weird series of events that led up to this massive ransomware campaign,
but then was ultimately stopped because they forgot to register the domain of the
kill switch. [MUSIC] The Department of Justice showed how they found artifacts in the different
variants of the WannaCry malware which led them to believe it was launched by someone in North Korea.
But I’m willing to bet that they’re leaving out some key evidence which squarely points
to North Korea behind this. The thing is, if the US shows what evidence they have, it might burn
their spy channels into North Korea. They have to be very careful on how much they reveal. The
indictment reads like a typical digital forensic analysis; you see IP addresses, malware analyzed,
user agents, and so many more details that they were able to collect. When the DOJ followed
all these threads, it led them to North Korea. Who’s this Park Jin Hyok guy in the indictment?
Well, a journalist for ZDNet, Catalin Cimpanu, really helped me understand
this better because he mapped it out and started connecting the dots. This
guy Park went from North Korea to China in 2013 to study programming. Specifically,
Java, PHP, and Visual C++. At the time, Park was working for a company called Chosun Expo Joint
Ventures which is supposedly a company handling e-Commerce and lottery services for North Korea.
In 2014, Park returned to North Korea and shortly after his return, North Korea launched a bunch of
hacking campaigns. Not to mention, most of the malware used in North Korea was written
in the same programming language Park had studied in China. [00:35:00] Now,
to carry out these attacks, the hackers had to get servers to use for command and control.
Obviously, they didn’t want to use a server in North Korea, so they rented a server from
somewhere else in the world. Now, to rent the server, you had to have an e-mail address. So, the
Department of Justice began submitting warrants to figure out what e-mail addresses were registering
these servers. On top of that, there were some phishing attacks which also used e-mails. The
DOJ was able to get these details and compile all these e-mail addresses during their investigation.
Let’s take a look at these e-mail addresses. I count thirty different e-mail addresses in the
indictment. Most of them are Gmail accounts, with a few being Hotmail and AOL. Well, since
Google is a US-based company, the DOJ can get a warrant and then ask Google for information about
these Gmail accounts. From there, they’re able to see what accounts they were connected to and what
IP addresses were logging into them, and what browsers were used, and all this kind of stuff.
Six of these accounts had used the name Kim Hyon Woo. As you dig into that,
you start seeing connections to Park. Like, both Kim and Park’s accounts had access to the same
files and sent mail between each other. The DOJ saw enough evidence to believe that Kim Hyon Woo
was an alias of Park Jin Hyok. So, Kim wasn’t even a real person. Then when they followed the clues,
they saw that Kim was the person who registered so many of these servers and sent phishing e-mails.
They know this because they see commonalities in IP addresses and access to those Gmail accounts,
and the browsers used to access them, and connected accounts. All these
things together make it clear that the same person owned all these e-mail addresses. So,
it seems that over the course of four years during which Park used thirty different e-mail addresses,
he made a few mistakes where he accidentally connected his real name to his fake persona.
That’s how the feds figured out who was behind this. The FBI also followed the money. All that
Bitcoin, where did it go? Well, it was held in a crypto-wallet at first and then transferred to a
Bitcoin exchange. I’m assuming the FBI got logs from the exchange which showed them that whoever
accessed the wallet was running Firefox Version 52.0 on Windows 7. At the Bitcoin exchange,
they transferred the Bitcoin to Monero, which is another type of cryptocurrency. This has
extra security features like the amount of coins sent are hidden and a random one-time address is
created for each transaction. Once the money is converted to Monero, it’s extra-hard to track,
if not impossible. What else do we really know about these North Korean hackers?
Well, it’s hard to get any good information out of there since it’s so secluded, but I looked
into this and found some extra stuff. First, the intelligence agency of North Korea is known as the
Reconnaissance General Bureau. This is a military branch that conducts clandestine operations. Now,
within the Reconnaissance General Bureau is another branch called Bureau 121,
and Bureau 121 is where we believe North Korean hackers are working from. People in the security
community call the North Korean hackers The Lazarus Group. There are a couple North Korean
defectors that have helped us understand what goes on there in pretty good detail. First is
Kim Hueng-kwang. He was a professor at the university at the capital. He says students
study computer hacking in this school and then are hand-picked to go to work at Bureau 121.
There’s also a defector named Jang Se-yul. He went to school to study computer science
at the same college where Bureau 121 recruits people from. He says Bureau 121 has about 1,800
people working in it, and those people are considered elite members of the military.
They’re trained just like any other hacker would be; they learn how different operating systems
work, how to program, how to use attack tools, and everything in between. North Korean’s main
attack targets seem to be South Korea, Japan, and the United States. But as you heard, they
have no problem unleashing huge attacks in other parts of the world. Now, when North Korean hackers
wage their attacks, they often physically travel out of North Korea to do it. They’ll go to Nepal,
India, Kenya, Mozambique, or China to wage their attacks because the internet in North Korea is
pretty locked down, and there’s so many people watching what goes in and out of North Korea.
Stuff can just be easily tracked if they do anything from there so they physically get
out of the country, then proxy around from there. There are actually quite a few North Koreans who
are able to leave the country. I mean, North Korea competes in the Olympics and has a whole
cheering squad and everything. North Korea attends United Nations meetings. North Korea has dozens of
embassies all over the world, [MUSIC] and North Korea also sends hackers to other countries to
hack. Currently, India seems to be the preferred place from which to launch their attacks.
North Korea always fascinates me which is why I wanted to do this three-part series
on them. At the same time, I think places like the US are trying to hack into North Korea too,
mainly to see how advanced their weapons systems are and to monitor that.
[00:40:00] But it’s just so weird to think about the differences of why the US hacks North Korea
and why North Korea hacks the US. The US is hacking into North Korea to keep an eye on
their intercontinental ballistic missiles, but North Korea hacks into the US to try
to stop a movie from being made which makes fun of North Korea. Whenever we see a cyber-attack,
the hackers usually fall into one of three categories. It’s either hacktivism, like
doing it for a bigger cause, cyber-crime, which is doing it to make money, or nation state hacking,
like, doing it to spy. But the motives for North Korea seems to fall squarely in the
center of all three of these. The Lazarus Group are hacktivists, criminals, and spies.
But I think this is the perfect military strategy for North Korea. I mean, they’ve
made millions of dollars from their hacking activities, and they’ve gotten away with it.
They cause lots of damages to their enemies. Look how much damage they did to Sony,
all without firing a single bullet or missile. The whole time, they can deny they did anything.
Hacking seems to be the perfect weapon for North Korea since they can do it all remotely,
hide under the cover of the internet, face a lot less consequences for their actions,
and do it all at a fraction of the cost of kinetic warfare. In July 2020, the European Union imposed
sanctions on North Korea. The report specifically mentioned that the Lazarus Group is who carried
out the attacks on Sony, did the Bangladesh Bank heist, and conducted WannaCry. It says
that there’s now a travel ban in effect because of that, as well as some assets being frozen.
This is the first time ever that the EU has imposed sanctions on another country
because of a cyber-attack. While I think it’s totally insane what North Korea has done,
trying to steal billions of dollars, trying to threaten the free speech of a movie studio, and
trying to destroy a large number of computers with WannaCry, I actually think this isn’t peak-crazy
for what North Korea might do next. My guess is that I think we’ll see even more destructive
attacks that may even result in loss of life. They obviously have the capability to cause
some serious destruction, and they never seem to have any remorse for the damage they cause.
We know they can be provoked to carry out physical attacks, so I think it’s just a matter
of time before we see them unleash some kind of cyber-attack that causes major physical havoc.
2017 was a busy year for information security professionals; to go from the
Shadow Brokers releasing EternalBlue, then seeing WannaCry use it like this,
and then the very next month, in June, is when NotPetya hit Ukraine which also used
EternalBlue. The month after that, Equifax was breached. Hopefully these major attacks help
us wake up to the dangers that many companies face while doing business online. Hopefully,
we all learn from this and take our security a little bit more seriously,
because we never know how crazy the hacker might be on the other end of that connection.
(OUTRO): [OUTRO MUSIC]
A big thank you to Dr. Tony Bleetman for coming on the show and telling us his story. Thanks John
Hultquist, the senior director for intelligence and analysis at FireEye, and thanks Matt Suiche,
CEO of Comae. You can find links to these people and what research they’ve done in the show notes
or at darknetdiaries.com. Please remember, a lot of time and energy goes into making
these episodes and I bring them all to you for free. If you’re getting value by listening,
please consider donating to the show through Patreon. By supporting the show,
it ensures we have enough resources to continue to bring you more great content.
Oh, and as a thank-you, if you join Patreon, you get access to bonus episodes,
too. So, check those out. Learn more at patreon.com/darknetdiaries. Thanks. Also,
you’re invited to the Darknet Diaries Discord where you can chat with other listeners of the
show. I like to pop in on there sometimes, too. To join us, visit discord.gg/darknetdiaries. This
show is made by me, the slow coder, Jack Rhysider. Sound design and original music was created by the
always-encrypted Garrett Tiedemann, editing help this episode by the devilish Damienne,
and our theme music is by the raucous Breakmaster Cylinder. Even though when I meet up with my
other tinfoil hat-wearing friends, I secretly use aluminum foil, this is Darknet Diaries.