China, Russia, Iran--now <i>North Korea</i> is the "cyber boogeyman"? Attribution is an incredibly difficult problem. Color me skeptical. Does anyone know where the rumors of North Korean direction started?<p>Any explanation below seems more likely to me than it really was a North Korean operation (yes, pure rank speculation):<p>1) it was made up by Sony to make them look somehow less incompetent†,<p>2) it was made up by some media organization to drive clicks, or<p>3) the initial investigation revealed suspicious activity from IPs in/linked to North Korea--which could, among other explanations, just mean the attacker owned their boxes and launched attacks from there<p>† ...And boy does their image need improvement! The attackers were supposedly able to exfiltrate a rumored 100TB of extremely-sensitive corporate data before anyone noticed?! After the rootkit fiasco, the epic SOE break-in, and now this--I can't imagine anyone wants their data anywhere <i>near</i> Sony's networks (nor, perhaps, Sony's software anywhere near <i>their</i> networks).