Sony Hack Was Not an Inside Job, Says Security Expert Kevin Mandia

Last year’s Sony hack was clearly the work of North Korea and not that of a disgruntled insider, according to FireEye president Kevin Mandia.

“Definitely not an insider,” Mandia said at Code/Enterprise in San Francisco. “Nope.”

While he said it is governments, not security firms, that are in the best position to assign blame, Mandia said the Sony hack was clearly the work of a government. Mandia noted that this was the first time a U.S. president publicly blamed another country for a cyber attack.

Over the course of several weeks as details in last year’s Sony hack emerged, critics questioned whether it was possible for North Korea to carry out the attack as the FBI has alleged.

Attribution — the business of determining who carried out an attack — is always sticky in high-profile cyber incidents. Attackers often leave behind false clues meant to confuse investigators by pointing to someone else. Ultimately it was the FBI which determined that hackers working on behalf of North Korea carried it out. Part of the reason they knew came from the fact that the U.S. National Security Agency had penetrated the China-based networks that North Korea’s cyber warriors tend to use.

“A media and entertainment company got hacked by a nation-state,” Mandia said. “I don’t think there are too many companies that could withstand that.”

Sony Pictures Entertainment was the victim of the worst known cyber attack in corporate history that first came to light on Nov. 24. Motivated in part by plans to release an R-rated comedy called “The Interview,” about two bumbling TV reporters tapped to assassinate North Korean leader Kim Jong-un, the attackers brought the operations of Sony Pictures’ computer networks to a halt and proceeded to disclose mountains of sensitive corporate information including executive emails and numerous business documents, all of which are now fully searchable courtesy of Wikileaks.

FireEye’s Mandiant incident response unit was called in to help the company investigate the attack and begin the process of recovering. Mandia likened it to his aunt being attacked by a UFC fighter. “It was an unfair fight.”

He said the Sony attack represented a combination of factors not seen all at once in prior attacks. He said you had a government attacking a private sector company, releasing private information and then “blowing up the house” on the way out.

That was a wake-up call to all companies. “Everyone in this room recognizes the risk profile just changed.”

This article originally appeared on Recode.net.

We're here to shed some clarity

One of our core beliefs here at Vox is that everyone needs and deserves access to the information that helps them understand the world, regardless of whether they can pay for a subscription. With the 2024 election on the horizon, more people are turning to us for clear and balanced explanations of the issues and policies at stake. We’re so grateful that we’re on track to hit 85,000 contributions to the Vox Contributions program before the end of the year, which in turn helps us keep this work free. We need to add 2,500 contributions this month to hit that goal. Will you make a contribution today to help us hit this goal and support our policy coverage? Any amount helps.

One-Time Monthly Annual

$5/month

$10/month

$25/month

$50/month

Other

$

Yes, I'll give $5/month

Yes, I'll give $5/month

We accept credit card, Apple Pay, and Google Pay. You can also contribute via