Critics say new evidence linking North Korea to the Sony Hack is still flimsy

Despite assertions from FBI Director James Comey that he has very high confidence in the attribution to North Korea and a statement by Director of National Intelligence James Clapper that North Korean General Kim Youn Choi was directly responsible for ordering the attack, security experts still doubt the veracity of the claims based on the evidence provided so far.

This includes a new detail from Comey that the attackers failed to use proxy servers through which to route some of their activity and mask their real IP addresses. As a result, Comey said, they unintentionally revealed that they were using addresses known to be “exclusively” used by North Korea. The new claim builds upon previous evidence cited by the FBI that components used in the Sony hack are similar or identical to components used in the so-called DarkSeoul attacks that struck South Korea last year and another claim that an IP address “associated with known North Korean infrastructure” contacted one of the command-and-control servers used in the Sony hack.

Critics have already responded to the previous evidence, so let’s examine the new information, with the understanding that this is not all the evidence the FBI possesses. Indeed, there may be signals intelligence obtained by the NSA or other intelligence agencies that provides better proof than what has been disclosed so far. Though, even accounting for this possibility, officials still haven’t explained why, if the attack was perpetrated by North Korea over the film The Interview, the initial communication between the hackers and Sony employees didn’t discuss the movie, but instead demanded money in an apparent extortion attempt over unspecified demands.