But that technique is no sure bet. There are ways to convert bitcoins into cash on the sly through third parties. And even finding a real person might be no help if they’re in a jurisdiction that won’t cooperate.
___
TELL-TALE SIGNS
James Lewis, a cybersecurity expert at the Center for Strategic and International Studies in Washington, said U.S. investigators are collecting forensic information — such as internet addresses, samples of malware or information the culprits might have inadvertently left on computers — that could be matched with the handiwork of known hackers.
Investigators might also be able to extract some information about the attacker from a previously hidden internet address connected to WannaCry’s “kill switch.” That switch was essentially a beacon sending the message “hey, I’m infected” to the hidden address, Weaver said.
That means the very first attempts to reach that address, which might have been recorded by spy agencies such as the NSA or Russian intelligence, could lead to “patient zero” — the first computer infected with WannaCry. That, in turn, might further narrow the focus on possible suspects.
