What sort of evidence might be used in linking, say, the Sony hack to North Korea? While I am curious about what was used in this particular case, my question is meant to be a more general question about what sort of things might be act as a tipoff in general situations like this.
Things I speculate:
- Using the user agent string from a web request as a sort of fingerprint. This seems like it has a relatively small amount of information and would be fairly spoofable.
- Seeing the language of compilation or comments (the most publicized bit of evidence in the Sony hack). This again gives very little information and is easy to fake.
- Tracing an IP. Even if this is done successfully, it seems like a competent hacker would be using some form of redirection to hide themselves. (I found one site claiming that the Sony hack had an IP traceable to SE Asia, but that's still pretty broad and circumstantial)
- Finding a distinctive sequence of commands in some malware that links it to some previous malware (e.g. how antivirus often works). However, it's turtles all the way done, and I'm unclear how the original malware could have been linked to North Korea (or wherever else).
I see this very related question, but the only concrete tidbit from those answers is that if you can see the available wireless networks on a hacker's computer, you could use that information to localize. Getting that information seems fairly unlikely though.
There's this question about investigating hacks, but its answer only deals with the series of steps in recovering from the hack.
That all said, I've only seen one reasonably credible news source questioning that the FBI and the US government settled on North Korea. Thus, I assume I must be missing some reasonable ways that the hack could be traced.
I totally understand that the public probably doesn't have all the details on the hack (and possibly never will). I'm looking instead for what sorts of things would serve as convincing evidence and might reasonably have been found.