North Korean Cyberterrorism: You’re Unprepared

December 22, 2014 - BlogSquad, Security,

It was revealed yesterday, in an announcement from the FBI, that North Korea was responsible for the recent cyber attack on Sony Pictures Entertainment.

The attack resulted in the public release of thousands of confidential (and embarrassing) email messages and documents involving Sony, its executives, popular celebrities, and many of the entertainment company’s business partners — among other misappropriations of intellectual property. This included various Sony films now freely available on pirate sites. According to Patrick Mahaffey, CEO of software consulting firm Room 5, the Sony hack “may have ushered in a new era of state sponsored terrorism against civilian targets.”

These acts have also caused the controversial cancellation of the release of Sony’s movie The Interview, the comedy drama that was the motivation for North Korea’s actions. In the movie, the characters portrayed by Seth Rogen and James Franco are enlisted by the American government to assassinate North Korean dictator Kim Jong-un. (Spoiler alert: At the end of the film, the two American spies complete their mission; there’s a viral video excerpt trending on social media if you’re curious.)

North Korea’s actions weren’t financially motivated, but rather purely political in nature. However, they were financially impacting. Kim Jung-un’s third world, impoverished totalitarian regime just cost an American subsidiary of a Japanese company $200-300 million in lost revenue—not to mention a severely tarnished reputation. To put this in perspective, Sony Pictures Entertainment, based in Culver City, California, reported $8 billion in revenue for fiscal year 2014.

On December 15, CNNMoney reported that parent company Sony’s stock had fallen 10 percent due to the incident. Then, on December 17, the FBI announced that it considered the hacking incident a national security threat. On December 19, the event elicited public statements from President Barack Obama, who said that Sony Pictures “made a mistake” in cancelling the release of the film and that the United States would respond to the attack “in a place and manner and time that we choose.”

According to Reuters: “‘North Korea’s ultimate goal in cyber strategy is to be able to attack national infrastructure of South Korea and the United States,’ said Kim Heung-kwang, a defector from the North who was a computer science professor and says he maintains links with the community in his home country.”

The general tone among Americans has been that Sony (and, by extension, Hollywood) spinelessly caved to the influence of a rogue dictator. Echoing the President’s comments, social media has been abuzz with anti-Sony sentiment, and even calls for boycotts.

I would argue that North Korea’s actions amount to a terrorist act on the part of a communist totalitarian nation, in the form of a cyber attack that, akin to an act of war, brought Japanese Sony, American-based Sony Pictures Entertainment, and American partners like Snapchat to their knees. I would also argue that this event can be—in the long run—good for us. Here’s why.

It’s easy to become too internally focused when you’re in one of the most technologically, culturally, and economically advanced nations in the world—and a shining example of democracy and progress, despite all of our internal bickering and ideological and religious contention.

Fortunately, we have organizations like the FBI, CIA, and the military’s various internal counter cyber-terrorism groups. Before you laugh and begin schooling me on how none of these organizations can be trusted (and bring up torture and waterboarding), remember “same team” (and 9/11, if you have a short memory).

This isn’t the time to be pointing out how the family dog crapped on the rug a few times. Rather, we should be thankful that Rover keeps the house safe from intruders and kills pesky rodents before they begin living in the garage or digging into that 50-lb bag of bird seed. It’s our bird seed, dammit, and Rover—rug pooping and all—helps protect it from thieves.

North Korea’s recent acts of cyber terrorism are a wake-up call not only to large corporations like Sony, but also to middle class Americans. Although I’m certainly not an expert on this topic, I don’t think it was a wake-up call to our government’s security agencies or the military. I believe they’re in the loop on this one.

We middle class consumers, however, are sloppy with our data and online accounts. Our passwords suck, most of us never backup our data, and asking us about our firewall is like inquiring about the pH balance of our lawn; we simply don’t know. And, all too often, we don’t give a damn. Again, we’re too busy dealing with social media, work headaches, and our kids to bother with the likes of password strength and data backups. As Americans, we’re pinnacle procrastinators. Watching The Voice or True Detectives is more important to us than personal data security. We prove it every day.

The revelation of North Korea’s cyber attack on Sony Pictures proves that we’re much more vulnerable than we think. If a black hat hacker anywhere, foreign or domestic, wants to steal your identity, copy or corrupt your data, or blackmail or embarrass you, even a moderately talented cyber thief can do so with relative ease. The reason it hasn’t happened to you is because you haven’t been targeted. At least, not that you’re aware.

According to Daniel Solove, a research professor of law at George Washington University Law School, “All of our personal data is at significant risk. At home or at work, your personal data is at risk. Whether in the cloud, or on your computer, or in an email, your data is at risk. The internet wasn’t built for security; it is a very risky zone, like wandering a minefield.”

Computer and networking technology, along with the common skills of hackers, have evolved to the point that, regardless of motive, these cyber bad guys can swoop in, steal or corrupt your data, and leave almost no trace. You may have been hacked and have no idea. The IT departments of major retailers like Target, Home Depot, and Neiman Marcus have been hacked and suffered the theft of point-of-sale data for tens of millions of customers. And, in some cases, they barely learned that it happened. If $100 million IT departments are vulnerable, what do you think can happen to you and me?

The reason most of us haven’t had our data or personal home networks compromised is simply because we’re not big targets—not because our data or networks are secure. If a frustrated, psychotic co-worker, spurned lover, mean ex-husband, angry neighbor, or pissed-off friend really focused on messing with your data, they could do so with relative ease. It just might involve hiring a savvy teenage nerd to make it happen. Don’t assume, because a person doesn’t possess computer skills, that they can’t be responsible for a data attack on you and your family.

Statistics from a variety of sources indicate that the majority of Americans never (as in never) backup their data. Surveys and metrics also indicate that our passwords—even for things like bank and investment accounts—are pathetically weak. Do you have any “password1234” passwords in your collection? How about a derivation of your name (or your pet’s name)? Do you use the same password, or a slight variation, on all of your accounts? I know; it makes them easier to remember. It also makes you extremely vulnerable to hacking.

There’s plenty of books and resources available to help you improve your data security. I won’t push my book, because the point is simply to get you to improve your personal data security, not necessarily buy something from me. But do something.

Cyber terrorism and hacking activities, from governments, large corporations, and individuals, are only going to increase. We’re all susceptible, from Sony Pictures to your next door neighbor. However, there are many things you can do to help prevent digital disaster that results in identity theft, public embarrassment, and financial loss.

Learn about what you can do. Make a plan. Execute it. Maintain your efforts. Be diligent.

Take it seriously.

Did you, or one of your friends, ever run a car out of gas? Wasn’t there a feeling of incredible stupidity and regret? Wasn’t there a realization that a brief stop at a local gas station could have been made oh-so-easily, preventing the embarrassment and expense of your negligence and oversight?

Well, get ready. Because the Sony Pictures hack by North Korea is only the beginning. Organizations and individuals that aren’t prepared will, sooner or later, suffer.

Try not to be one of them.

Curt Robbins