Will Sony Pictures become a "sacrificial lamb"?

(Baonghean) - The attack on Sony Pictures Entertainment was shocking not only because of its rare scale but also because of the mysterious whereabouts of the "author". Even with the involvement of the FBI and private cybersecurity companies, the only thing that has been clarified so far is how the attack was carried out.

Specifically, the hackers used malware - a software installed in the information system without the user's knowledge. This sophisticated software bypassed Sony Pictures' security barriers and paralyzed the entire system after stealing a lot of important data. On December 10, an FBI agent commented: "The sophistication of this spyware is extremely high. It is beyond the control and protection of 90% of the security solutions that private businesses use today. It can even bypass the state's security network. This proves the organized and determined nature of the hacker group". Mandiant - a cybersecurity company invited by Sony Pictures to participate in the investigation also shared the same opinion: "This is an unprecedented and staged crime, carried out by an organized group of people". Of course, these assessments are extremely favorable to Sony Pictures in the face of accusations from employees within the corporation itself about carelessness in security work. Only the statement about the "unprecedented" nature has raised doubts among experts - many opinions say that hacker attacks that steal large amounts of information like this happen regularly, but are not always made public and cause great shock to public opinion.

Poster of Sony Pictures Entertainment's The Interview - postponed due to terrorist threats from hackers.

The biggest question now is: Who is behind this crime of the century? From the beginning, the hackers have been careful to hide their identities. The threatening emails are sometimes signed by a "leader" but their origins and sources are always changing and uncertain. The posting of stolen information is also done on websites that allow anonymity, such as Pastebin. It is not even clear how many hackers are involved or where the attack originated. On December 1, the group sent an email to the CSO information website, stating: "We are an international organization, including famous figures from the political world and many countries such as the US, UK, France. We are not under the control of any country." The only information the group revealed about their identity was just a name: Guardians of Peace (GOP).

However, one of the biggest theories right now is that the attack is related to North Korea, for two reasons. First, the hackers' particularly harsh attitude towards the movie The Interview, directed by Seth Rogen and produced by Sony Pictures. The action comedy revolving around a plot to assassinate North Korean President Kim Jong-un, was scheduled to be released on December 24. However, in response to the hackers' threat of violence, Sony Pictures announced that it would postpone the release of the movie on December 17 - a week before its scheduled release. Accordingly, a threatening email was sent from the GOP, describing The Interview as a "dangerous" movie that would "end regional peace and start a war". Immediately, this move by the hackers opened up a hypothesis for the White House, as it bore many similarities to Pyongyang's attitude towards The Interview. Because, other than political reasons, it is difficult to find a more satisfactory explanation for this somewhat "strange" behavior - if this is indeed a non-governmental organization as the GOP claims.

Second, on the technological front, cybersecurity firm Kaspersky has pointed out similarities in the structure of the spyware used in the attack with those used in the 2013 “Dark Seoul” campaign, which is believed to have been carried out by North Korea against South Korea. However, this is not enough of a reason to make an assertion. The aforementioned programming structures were also identified in an attack on a Saudi Arabian business in 2012. This means that Iran is currently a “strong” suspect, in addition to North Korea, although Iran’s motives for this attack are still unclear.

However, this is only a temporary hypothesis and there is no evidence convincing enough for the US to point the finger at North Korea. Many traces in the investigation even show that the attack could have been carried out from a 5-star hotel in Thailand and used a server located in Bolivia. However, US authorities have not commented much on this information. Because, for high-level hackers, deleting their location and IP address on the global network is completely possible. Security company Mandiant also raised the hypothesis of China's involvement in this attack. Thierry Karsenti - Technical Director of Check Point Software Europe commented: "With a few hundred thousand dollars on the black market, you can absolutely hire people capable of exploiting vulnerabilities in the programming code of large enterprises. Any cybercriminal can benefit from stealing information from Sony".

That is why the White House, despite making a statement that the attack on Sony Pictures appeared to be "sponsored by a country", still left open the possibility that this country was North Korea. Because, if the damage to Sony Pictures could be purely financial, the involvement of the US government would push the scope of the incident further. There are no borders in the world of information technology - that is indisputable, but in the real world we live in, the borders still exist very much. It is a wall that divides the world into uneven areas and the US is trying to avoid being isolated. Pushing an "unpredictable" North Korea away would mean creating an opportunity for rivals like Russia or China. Even though the US has re-evaluated its long-standing tense relationship with Cuba, would they "sacrifice" an entertainment corporation to achieve the policy of "more friends, less enemies" to have both sides?

Thuc Anh(According to Le monde)