Identity-theft specialist Robert Siciliano questions the FBI's claim that North Korea hacked Sony in 2014, arguing that proxy servers and IP spoofing make attribution nearly impossible. He says Sony's real problem wasn't just security technology but employee training to stop phishing attacks, and once a stolen film leaks, there's no putting it back.
Chapters
Talking about this, for more, we're going to reach out to Robert Siciliano. He is an identity theft expert with Hotspot Shield, joining us live from Boston tonight. Thanks very much for joining us. It's been a quiet day. We heard President Obama say, look, Sony made a mistake. We can't have a society where dictators someplace start imposing censorship. A lot of people say Sony caved, and now the second-guessing started instantly. But let's take a closer look at this hacking. Has the world underestimated North Korea or the DPRK?
So the— I honestly believe that the jury really is still out in regards to whether or not they actually did this. Just because the FBI says it's so doesn't necessarily mean that's the truth. You know, it's very difficult ever to determine who the actual hackers are with any of the major breaches that we've seen over the past decade. Think Target, think Home Depot. It's very difficult to determine who the who these hackers are, and to determine beyond a shadow of a doubt is, again, you know, not something that's easily done. And it's very easy for the FBI to point the blame at, you know, North Korea. They have nothing to lose. The FBI has nothing to lose by saying that that's the case.
Yeah, Robert, I got to follow up on that, though. You're in the minority right now saying that North Korea could not be behind this. Do you think the FBI would have some other reason to do this, or is it just that difficult to pin it down?
It is that difficult to pin it down. And while they do have what they say is some evidence in regards to IP addresses and so forth, bad guys, criminals, they use proxy servers. And proxy servers essentially are servers that can be used all around the world. They can reroute the communications. They can make it look like it came from anywhere. You know, that's the nature of technology that we're using today. And when criminals mask their positions, they're doing just that. They're using half a dozen or more servers that, you know, make it difficult to pinpoint who did it, and they can leave all kinds of breadcrumbs behind that make it look like it was in fact, you know, a foreign nation.
Okay, we're gonna move on. Now, Obama said that the US will act appropriately. What do you think he means by that? More bills in Congress, more congressional back and forth between lawmakers here, or will there be some real teeth to the US response?
Well, the options that the US have right now in regards to this are not And none of them are good ones. To take action, you know, would mean, you know, harming a nation-state because of a hack. You know, I can't see how the U.S. has anything good that they can— that can come out of this. At this point, I think that, you know, everybody involved just, you know, wants to make sure that it doesn't happen again. And it's going to happen again. You know, the technology is flawed. It's not 100% secure. And all of these corporations that are being affected, they certainly have to step it up.
What about Sony? Their CEO says they did not cave, his words, but it's hard to think this has been anything but catastrophic for them. And how do they pick up the pieces and move forward?
Any major corporation that faces threats by criminal hackers when they expose data is always under the microscope as a result. And so it is, it is in their best interest to make sure that something like this doesn't happen again. And often it is the worst thing that can happen to these organizations that sometimes is the best thing which means that they then put their, you know, best foot forward, the right people, the right technologies to make sure that these things don't happen again.
You know, this happened to Sony, but right now I can imagine every other Hollywood film media company is going crazy. They're thinking, how can we ramp up our security? What kinds of things do you think they're going through, and what would you recommend?
So there are a number of, you know, excellent technology firms out there that have multiple layers of hardware and software and the right information security professionals to implement it. And when you are a, you know, major corporation such as the ones that have been breached over the past few years, there are just so many points of entry. Often it's hacking the humans that are the biggest vulnerabilities. It's emails that are received where links are clicked and viruses are launched. That is the biggest problem. So really it's educating the employees as to what they can and can't do and better detection as to how these breaches are occurring on the inside.
Okay, the FBI says it was the DPRK. You have your doubts, but regardless, uh, the word came out late today in a message: Keep this movie from being distributed ever. Keep it from being pirated. Now, that's gonna be virtually impossible. This has to be the movie everybody wants to get a look at now, just to see how explosive, for lack of a better term, it could be to watch it. How can they keep something like that from getting on the market? And do you think this could actually be some kind of tool that whoever is doing this hacking moves forward with and really does lash out again.
Yeah, it is very difficult to keep anything digital from being exposed. You know, when it's digital, it's repeatable, which means it can be copied and pasted, and it's forever. Chances are, you know, men will see this film, and more than likely it'll be, you know, interesting, to say the least.
And perhaps the most publicity that these two Seth Rogen and Franco will ever get for one of their films. Robert Siciliano, thanks very much for joining us here. We appreciate it.
