Marc Rogers

I love comments about the "anti-hacker community" though the underlying link to marco's blog (as this entire article is just commentary on original source material) http://marcrogers.org/2014/12/21/why-i-still-dont-think-its-likely-tha… gives his entire opinion. I dont think its news to most of us here that the NK connection to the hack is circumstantial; Sony's security has been penetrated by non-state actors before, and without a lot of effort from what I can tell.

Those "experts" were not experts in attribution, and the consensus is that they were wrong. One is from Norse, a widely discredited and now defunct security firm, ironically infamous for their false attributions. Two are journalists. Enough said. One is Seth Rogen the actor. Enough said. One is Sabu from LulzSec, a script kid turned FBI snitch, who is way out of his league commenting on this. One is Marc Rogers, who I don't know personally, but I doubt he maintains his skepticism today. In any case, a security expert to be certain, but not an expert in attribution and not privy to the evidence (only some of which has ever been made public). Worth noting that he published followup blog posts to the wikipedia-linked citation that walked back his skepticism quite a bit (http://marcrogers.org/2015/01/24/wrapping-up-the-whole-sony-thing-for-… - "In my eyes, the preponderance of evidence definitely suggests North Korean involvement or someone trying very hard to make it look like North Korean involvement."). He basically settled on it being plausible, but concerning, and acknowledged that he wasn't privy to the evidence.

At the moment that I'm writing, not one of the ten highest-ranked comments here addresses any of the technical detail or substance in the counterarguments which white hat experts have raised. Bruce Schneier is one of these skeptical experts. http://motherboard.vice.com/read/the-best-thing-we-can-do-about-the-so… The IP address blog post by Dr Krypt3ia makes the FBI look silly beyond words. http://krypt3ia.wordpress.com/2014/12/20/fauxtribution/ The Marc Rogers post makes a lot of sense to me. http://marcrogers.org/2014/12/21/why-i-still-dont-think-its-likely-tha… I remember a time when a discussion like this on Hacker News would have concerned itself with the technical details of the analysis, in an honest attempt to discern the truth of the matter, rather than a bunch of opinionated political rambling, and although that was a very long time ago, I still consider that type of discussion more worth our time here.

> Not that Lenovo is a bad company persay The argument can certainly be made though. At least regarding their consumer laptop decision circa 2015 when, in addition to the quality issues, they were shipping the Superfish ad-ware which was installing a notably insecure self-signed root certificate to deliberately Man-in-the-Middle HTTPS connections so it could inject display ads. See: - https://marcrogers.org/2015/02/19/lenovo-installs-adware-on-customer-l… - https://blog.erratasec.com/2015/02/extracting-superfish-certificate.ht…

(posted in another thread, but applies here too) From https://marcrogers.org/2018/08/13/open-letter-to-the-hacker-... (linked in the article): "Yes hotel staff NEED to check rooms but if we, who can change the very building blocks of life, can’t come up with a safer way to do this then we really aren’t trying hard enough." No, they don't. They have thousands of security cameras set up, and I'd be shocked if they didn't have technologies like facial recognition built in. They have the ability to do a background check on every guest who checks in. They also have people working the front desk who likely get training to see if you're a "bad guy" or not. So with all that, please explain why this additional search, which is a massive violation of privacy (and apparently the Constitution) is necessary?

From a corporate perspective, Hortensius approved the bundling of adware (so he's ok with it) from what he thought was a reputable third-party software company. He was wrong! http://marcrogers.org/2015/02/19/will-the-madness-never-end-komodia-ss…

Crazy, the default language is 'ko'. I thought only South Koreans used that? http://marcrogers.org/2014/12/18/why-the-sony-hack-is-unlikely-to-be-t…

It's discussed here http://marcrogers.org/2014/12/21/why-i-still-dont-think-its-likely-tha…

>The fact that the code was written on a PC with Korean locale & language actually makes it less likely to be North Korea. Not least because they don’t speak traditional “Korean” in North Korea, they speak their own dialect and traditional Korean is forbidden. This is one of the key things that has made communication with North Korean refugees difficult. I would find the presence of Chinese far more plausible. http://marcrogers.org/2014/12/18/why-the-sony-hack-is-unlikely-to-be-t…

"It is not clear how the United States determined that Mr. Kim’s government had played a central role in the Sony attacks. " I really don't think North Korea has the sophistication to do this. This is perfect explanation: http://marcrogers.org/2014/12/18/why-the-sony-hack-is-unlikely-to-be-t…

Marc Rogers makes a convincing case that North Korea was almost certainly not behind the attack, and that a disgruntled (former?) employee was. His analysis makes the terrorism threat seem even hollower. http://marcrogers.org/2014/12/18/why-the-sony-hack-is-unlikely-to-be-t…