FBI Director: Sony's ‘Sloppy’ North Korean Hackers Revealed Their IP Addresses
Andy Greenberg / Wired :
Context & Ripple Effects
The FBI formally attributed the Sony Pictures breach to Pyongyang in mid-December, and independent reporting has since corroborated that picture — [[a:824691|sources traced the hackers mainly to North Korea, including a Japan-based group of ethnic Koreans]] — while technical teardowns showed the attack mixing crude and capable tooling. Director Comey's public explanation of *how* the FBI reached its conclusion is the missing piece: he is arguing the attribution rests on hard evidence, because the attackers reused infrastructure and let their traffic slip.
First-order effects
- Comey's disclosure shifts the debate over FBI attribution from assertion to evidence: critics who doubted the North Korea conclusion now have a stated technical basis — exposed IP addresses tied back to known DPRK infrastructure — to accept or attack.
- Sony gets firmer official backing for its breach narrative, while the attackers lose anonymity as a defense; the FBI's parallel bulletins show the same group remains active, having threatened an unnamed news organization.
Second-order effects
- Security researchers will pressure-test Comey's claim against their own telemetry — the earlier finding that the malware used slapdash code cuts both ways, supporting sloppiness but complicating any narrative of elite state capability.
- Rival intelligence agencies and private threat-intel firms face pressure to publish comparable attribution evidence or risk looking less rigorous than the FBI on a case every board and insurer is now citing for cyber policy.
Third-order effects
- If FBI-style public attribution — naming infrastructure and method, not just a suspect country — becomes standard, state-sponsored hacking loses plausible-deniability cover and governments gain a template for responding with sanctions or indictments rather than silence.
- The episode hardens a norm that attacks on media companies are treated as national-security events, pulling entertainment firms deeper into intelligence-community coordination.
The trend: State-sponsored hacking is entering an era of public, evidence-based attribution, where attackers' operational mistakes get aired by government officials themselves.