All language subtitles for cyberwar.s01e02.720p.hdtv.x264-w4f_Track02

BEN: It was one of the most
devastating attacks

in corporate history.

VOICE: This is voice of Korea.

We've never seen an
attack like this before.

BEN: It forced a major
Hollywood studio

to shut its networks down.

Security hands you a memo,

and it says there was
a system disruption.

The US government was
quick to blame North Korea.

And we can confirm that North
Korea engaged in this attack.

But hackers and computer experts
questioned the narrative.

It's not even a warm gun.

It's barely a gun.

Was it really North Korea,
or was it someone else?

♪

It all started on
November 21st, 2014,

when Sony executives
got an extortion email

from an unknown group ,
the so-called God'sApstls.

Sony reported it to the FBI.

But three days later,
all hell broke loose

when a group calling themselves
the Guardians of Peace

appeared on Sony Computers.

Sony Pictures co-chairs
Amy Pascal and Michael Lynton

scrambled to contain the
damage, but it was too late.

Over the next three weeks,
a mountain of data

including movies, salaries, and
private corporate information

was dumped onto the internet.

But what really captured
everyone's imagination

were the private emails
of Sony top dogs.

Everybody is suddenly
reading Amy Pascal's

personal emails and
professional emails,

which were also in many
instances very embarrassing.

As the editor-at-large of
The Hollywood Reporter,

Kim Masters remembers
the cringe across Tinseltown.

There was a sense of instant
fear throughout Hollywood

because everybody
knew, first of all,

that they were
probably vulnerable.

I think simultaneously
a lot of executives

in the industry thought,
"Yeah, but I don't know

if I put some of this
stuff in an email."

Producer Scott Rudin
called out Angelina Jolie

for being a spoiled brat.

Sony exec Clint Culpepper
bad-mouthed Kevin Hart.

Worst of all, Pascal and Rudin
gossiped about what flicks

the first black president of
the United States might be into.

It was so extreme
and so emotional,

and sometimes in some
cases so inappropriate.

But the breach went
beyond salacious emails.

Sony employees
watched helplessly

as their social security
numbers, medical records

and more were released
online for everyone to see.

I met someone who
was on Sony's lot

the day the attack went down.

She was a senior coordinator
for the studio's digital TV

department, and eventually
quit because of the hack.

Celina was the only
Sony employee I spoke to

who was willing to go on camera.

When did you find out
your personal information

was actualy leaked though?

We got a memo saying
that unfortunately

a cyber hack attack happened,
and they got everybody's

information, and-- but
they didn't specify who.

They just basically--
anybody that ever worked

for Sony at anytime in
their lifetime possibly

had a chance of their
stuff being hacked.

So if you could just break
down specifically how

you went about finding your
name and finding out that

you were, you know,
personally affected by it.

I literally went to Google
and searched "Sony hack 2014",

and then I saw just
like a tree directory,

like old school style DOS,

and you saw just
different file names.

And they named the files
like "Celina's offer letter",

and they were named specifically
what that document was.

So it wasn't hard to
find out your information

was put out there.

What were some of the things
that were going down?

Like, 'cause obviously
you can't use computers.

That's everything.

Did everything just revert
to like the stone age?

Like what happened?

We started saying
we're working "analog".

You literally had
to write stuff out.

But yeah, there was a lot
of drinking and partying

and eating, 'cause
that's all you could do.

And I mean, Sony already
paid for their Christmas party,

so we had it, and it was huge,
and it was awesome.

And then Michael Lynton
and Amy Pascal stood up

and gave a speech, and
then Amy Pascal kinda

challenged the hackers.

Challenged the hackers? How?

In her speech, she was like oh,
this wasn't gonna get us down.

Like, "We're gonna beat
you guys," and all that stuff.

Pascal's defiance
didn't save her,

and she was eventually
forced to resign.

But from early on, the real
question everyone asked

was why would hackers
target Sony Pictures?

The media had an answer...

You want us to kill the
leader of North Korea?

Yes.

Wha?

...a movie starring Seth Rogan
and James Franco with a plot

hinging on assassinating the
real life leader of North Korea.

President Kim Jong-un!

The Interview was, you know,
just a raunchy stoner comedy.

I don't think anybody
would argue it was high art

or Oscar material.

With The Interview set
for a Christmas release,

a rambling message
posted online threatened

terrorist attacks on
the movie's premiere

in any theatres daring
to screen the film.

Sony Pictures
pulled the movie.

We had no alternative
but to not proceed

with the theatrical release
on the 25th of December.

And then, out of nowhere,
President Obama named the perp.

The FBI announced today that...
and we can confirm that

North Korea engaged
in this attack.

It was the first time
a president has blamed

a nation state for a major
cyber attack on American soil.

The US retaliated
with sanctions.

The White House didn't
discuss the evidence,

but the FBI came forward
with some details.

Brett Leatherman is an agent
in the FBI's cyber division.

Based on what's
publically known,

the hack seems to have
gone down in four phases.

First: spear phishing,
which the FBI said

was likely how the
hackers got into Sony.

Somebody within a company or
organization would receive

an email that looks like
it's a legitimate email

that might contain an attachment
or a link to a website.

Once you click on that link,

it would take you
then to a website,

or it would launch malware on
your computer that would allow

somebody to then
compromise your system.

Next, the hackers
gained broader access

to Sony's networks.

So they're looking for a user
with escalated privileges,

and it could be an admin,
or it could be a CEO or CFO

who needs access to your network
in an administrative capacity.

So admin credentials are key

in going laterally
through a network.

With their almost
god-like access to Sony,

the hackers moved to
phase 3: data theft.

It probably took them months
to steal everything

they eventually released online.

And then came the grand
finale: data destruction.

The unique thing
about the Sony attack

was the destructive
nature of the malware.

The hackers launched malware,
or malicious software,

that destroyed Sony
computers from within,

wiping data off its systems.

But that still doesn't
explain how the government

attributed the attack
to North Korea.

BEN: Whoever hacked
Sony Pictures' networks

stole sensitive data, then
smashed whatever they could

on the way out.

But to this day,
one question remains:

How was the US government
so sure it was North Korea?

So I can't comment on
ongoing FBI investigations.

So why is the
investigation ongoing?

A cyber investigation
is a long-term effort

to just not only attribute...

if there's a particular country
involved, not just attribute

who that country might be,
but also to attribute

threat actors behind
the actual compromise.

Because there's other
groups that are involved

in these kind of attacks.

So there are other groups who
kinda jump on the bandwagon

for their own benefit.

And that was the case with Sony.

Possibly.

That may have been
the case with Sony,

but in general I think
we frequently see that

with major cyber events.

Beyond the FBI, the
National Security Agency,

one of America's spy powers,
was reported to have evidence

it was North Korea.

But the NSA won't
confirm or deny anything.

Well actually, I think the
government was more forthcoming

in the Sony hack than
is usually the case.

You know, historically the
government wouldn't really

attribute it at all
to a nation state.

Michael Chertoff was the
secretary of Homeland Security

under President George W. Bush.

He and former NSA and CIA
director Michael Hayden

now run a private
consulting firm.

And then you have the government
pretty clearly saying

North Korea was responsible
for the Sony hack.

And I think that was a decision
that the risk of revealing

a little bit about sources
and methods was outweighed

by the importance of
saying to the bad actors,

"We know it's you,
and there's a limit

to our willingness
to tolerate this."

So in your expert opinion,

do you think that was
a good decision?

I think it probably
did make sense.

I think if you look at actually
the way North Korea operates,

there is a small group
of privileged individuals,

which include people who are--
have technical skills that are

useful to the regime,
that are well resourced,

and are quite capable.

I mean, they may not be the
A Team, but they're the B Team,

and the B Team can do
a lot of damage.

I had an idea who
Chertoff's B Team could be:

a North Korean military agency
known as Bureau 121.

But North Korea can
barely keep the lights on,

so could they really
have an elite hacking unit?

- Martyn.
- Hi.

- How're you doing?
- I'm good, how are you?

Good.
(Radio distortion)

Sounds like you're calling...

You're trying to access
some aliens or something.

- Almost, North Korea.
- Almost.

Martyn Williams is a reporter
who's been to North Korea,

and has written extensively
on their tech capabilities.

What do we know about
Bureau 121, the actual

hacking collective of the
cyber warriors of Kim Jong-un?

Like what do we know about them?

Because nobody seems
to know anything,

like who they are, what they do.

I mean, welcome to the world
of looking at North Korea.

Nobody knows anything about
anything in the country.

Very little
information gets out,

except what you can
hear on the radio.

There are snippets that
come out through defectors.

It seems that what they're
doing is taking the...

the kids that are
really good at science

and really good at
mathematics from the...

from high school, putting
them into good universities,

and then after universities,
training them.

Some of that training apparently
takes place in Pyongyang.

A lot of it we see
taking place overseas.

We've heard that
hacking and hackers

are obviously a new focus.

Why do you think that is?

It's much cheaper.

A room full of hackers is way
cheaper than a jet aircraft,

or keeping tanks in
operation, or submarines,

or things like that.

So if they can start being a
power on the internet, then

it's a cheap way of projecting
their power across the world.

I wondered what Bureau 121,

the hermit kingdom's military
hacking unit, is really like.

So with the help of an
interpreter, I made contact with

a defector who claims he was
a North Korean army lieutenant.

Jang Se Yul defected to South
Korea almost a decade ago,

but still keeps tabs
on old friends.

You were working with and
you were training with hackers?

Do you know anyone
in Bureau 121,

and are you in
contact with them?

What's the worst thing
that North Korea could do

to the US in the cyber realm?

Mr. Jang said the Sony
hack might be a sign

North Korea is
preparing for war.

But as I dug into the
case, I discovered that

many highly regarded hackers
and security experts

doubt North Korea was
behind the attack at all.

BEN: Just weeks after
Sony Pictures was hacked,

the FBI released vague evidence
pointing to North Korea.

But hackers and computer experts
almost immediately poked holes

in the FBI's case.

Do I think the North
Koreans started it?

No, I don't think so.

One of the most vocal doubters
is Marc Rogers, a malware expert

and self-described
former black hat hacker.

First of all, the agenda
changed substantially

at several points
throughout the hack.

That kind of implies
multiple different actors to me.

They started out
trying to extort money.

I can't see any reason
why North Korean hackers

would try and do that.

Then they had kind of a
ramble about unemployment

and job losses in Sony.

I don't see how that benefits
the North Korean regime.

I think they were
attacked by an opportunist,

and then I think that evolved.

You ended up with other groups
piling in and exploiting it.

And then as the media started to
suggest maybe a potential link

between this hack
and The Interview,

I think the hackers
latched onto that.

And they ran with it
because it was both

a convenient cover for them,
and, well, you know,

a lot of hackers like to do
things for the amusement.

"For the lulz," as they say.

That's probably what
brought North Korea in,

and it was much later on
I think that North Korea

actually was involved,
if they were at all.

If Marc was right, his theory
fit what the FBI had hinted.

Sony might have been the
victim of a hacking party.

But who could've been involved?

In 2011, the notorious
hacktivist collective Anonymous

attacked Sony websites.

They said they were
defending George Hotz,

AKA geohot, the first guy
to jailbreak an iPhone

when he was just 17.

This is the world's
first unlocked iPhone.

BEN: George.

A few years later, he
jailbroke a PlayStation 3.

That didn't sit well with Sony.

Yo, it's geohot!

And for those that don't know,
I'm getting sued by Sony!

(Rapping)

Hi, Sony!
How are you doing?

I haven't seen you in a while.

Uh, you know, suing me
was kinda... kinda dick,

but it all worked out
in the end, so yeah.

That's what I think of Sony.

The main reason that I got into
the iPhone and PlayStation:

it was a cool puzzle.

These companies are
spending millions of dollars

to build really cool puzzles
for me, and it's real!

This isn't some puzzle

constructed by
somebody to solve.

This is a puzzle constructed
by somebody to not solve,

and that's why
it was so alluring.

That's why it still is.

VOICE: We are Anonymous.

BEN: Sony's lawsuit
against George made

a lot of hackers angry,
including Anonymous.

VOICE: We do not forget.

BEN: They launched a
denial-of-service attack,

sending so much traffic to
Sony's websites they crashed.

VOICE: You should
have expected us.

BEN: And then someone hacked
into the PlayStation Network

itself, gaining access to
the credit card information

of 77 million users.

Sony was forced to apologize,

but no one has ever been
formally accused of the breach.

It wasn't even about
the breach, right?

Companies get
breached all the time.

It was really about how
Sony responded to it.

Sony responded by taking the
PlayStation Network offline,

and it was down for a month.

So now you have
77 million people

who were trying to
play Call of Duty,

and being like, "What's
going on here, man?" right?

So do I think that the lawsuit

and what happened with me
made them a target?

Probably not.

Do I think that what happened
in the fallout with Anonymous

and them taking the
network offline for...

Maybe, you know.

That's more plausible.

The PlayStation saga
isn't the only event

that might've
pissed hackers off.

In 2005, security experts
found suspicious software

on CDs produced by Sony BMG,
the company's music division.

I went to see Dan Kaminsky,
a legend among hackers.

He's famous for finding
and helping fix a major flaw

in the internet's backbone.

He also played a pivotal role
in uncovering the BMG fiasco.

So if you took that disk that
was just supposed to be music,

it would install a little
program on your computer,

and that program did two things.

First, it made it so your
computer could no longer

copy music, and second it hid,
'cause it was pretty sure

that this was not what
the user wanted.

And so once it was in, it
sure didn't want the user

to hit the uninstall button.

And somebody figured out,

"Hey, wait a second, what
is this software on this,

what's supposed to
be an audio CD?"

They looked at it,
and like this is malware!

What is Sony doing putting
out custom malware on CDs?

So what I did was a trick
called DNS cache snooping.

I do this scan, and like

a half million networks
had seen this thing.

And so I took that information,

got flown out to Sony BMG
headquarters, and I'm like,

"Hey guys, so
here's what you did,

and here's it
all over the world."

Is it that kind of
behaviour though

that has made them a target?

It certainly didn't
make them any friends.

Given Sony's history as
a major hacking target,

did North Korea really
attack Sony Pictures?

Or was it just a
freelance hacker?

BEN: Some of the smartest
hackers in America

were telling me they didn't
believe North Korea

attacked Sony, and that
a lot of people might've had

the motive to do it.

But Kurt Baumgartner thinks
North Korea really is to blame.

Kurt analyzes malicious code
and comes up with defensive

solutions for one of the world's
biggest security companies.

He showed me how the Sony hack
bears a striking resemblance

to DarkSeoul, a 2013 cyber
attack on South Korean banks

which was widely blamed
on North Korea.

So what we've got here are
two different HTML pages

that are basically threats
from the attackers.

So on one side, this is
the 2013 DarkSeoul attack,

and the audio from their video.

(Evil laughing)

And then over here, we have
basically the Sony hack.

(Gunshots)

(Laughing)

Right, really sophisticated.

It does seem like the graphic
arts team of a hermit nation.

It's pretty low...
pretty low tech.

There were other similarities

between DarkSeoul
and the Sony hack.

The word "security" is actually
misspelled in the exact same way

in the code used
in both attacks.

In this case, it was
pretty clear to us

that the same shared code base
has been used in both events.

And both the Sony and DarkSeoul
attacks were wiper events;

they wiped or destroyed data
from their victim's systems.

These types of attacks
are extremely rare.

They just don't happen.

There might be five
major wiper attacks in...

that I know of.

But the skeptics say the
similarities Kurt showed me

don't actually add up.

When we talk about the
similarities here, DarkSeoul,

that was attributed to a group
of South Korean hackers

which they called
the DarkSeoul Gang,

and was never formally
linked to North Korea.

The reality is it boils down to
just a few fragments of code

in each of the
pieces of malware.

It's not nothing that
the software is related.

It's just not wildly compelling.

It's not a smoking gun.

It's not even a warm gun.

It's not-- It's barely a gun.

A tube-shaped object!

Malware has a
history of being shared.

And once that
code gets out there,

you will end up
with multiple variants

that all have the
same parentage.

They all look very similar,

but they're being run
by different people.

The malware's code did
contain IP addresses,

which indicate a
computer's location.

The FBI says they were
linked to North Korea,

but that's not
conclusive either.

Could you fake your IP
being in North Korea?

Break into a machine
in North Korea.

Break into a machine in Russia

breaking into a machine
in North Korea.

Break into a machine in China

breaking into Russia
breaking into North Korea.

These are all things
you totally can do!

Bouncing around the world
happens in milliseconds.

And so people ask, "Is it
North Korea that did this?"

This is a thing that
four people could do.

Four out of 7 billion.

This isn't an attack that
requires nation state intent.

It's an attack that requires
a couple of guys being bored.

My sources were telling me
that the attack on Sony Pictures

wasn't even that sophisticated.

So maybe the company
should've had better security.

Ultimately it doesn't matter
whether the hackers came from

North Korea or North Dakota.

What matters is that Sony
could see this attack coming,

and it didn't do enough
to prepare for it.

Matthew Preusch is an attorney
who represented Sony employees

in a class action lawsuit
against the studio.

Sony just didn't do what a
reasonable company should've

done to protect the private
information on its system.

It should've been stored in
a way that was encrypted,

and that was segregated
from other information

so it was much, much harder
for the hackers to find.

Sony Pictures declined to
comment on these allegations,

and settled the lawsuit
out of court.

But it's undeniable
that employees' private

and exploitable data will
live online forever.

Have you ever received
an apology from Sony?

No.

They kinda made you feel
like it was your fault,

that you weren't protecting
yourself already to begin with.

So I mean, I didn't do anything
wrong but show up to do my job,

thinking this corporation knew
exactly what they were doing.

And then finding out that
they don't is really...

it's really frustrating.

I mean, it sucks that we're
collateral damage, but...

I mean, that's how war is, and
so this is basically what it is.

It's like a nerd war now.

As the dust settled,

the Sony hack claimed
the job of an executive,

and a stoner flick lost
its Christmas release.

But the real victims
are Sony's employees.

Whether it was North Koreans
or bored hackers,

all the competing theories about
who did it prove one thing:

definitively attributing
a cyber attack

can be almost impossible.

And in a world where it's not
only easy to hack a corporation

but easy to hide,
all of us are vulnerable.