Cyberattacks Traced To North Korea

SEOUL, South Korea — The North Korean government was the source of high-profile cyberattacks in July that caused Web outages in South Korea and the United States, news reports said Friday.

The IP address – the Web equivalent of a street address or phone number – that triggered the Web attacks was traced back to North Korea's Ministry of Post and Telecommunications, the chief of South Korean's main spy agency reportedly told lawmakers.

The ministry leased the IP address from China, Won Sei-hoon of the National Intelligence Service told lawmakers Thursday, according to JoongAng Ilbo newspaper. South Korea's Yonhap news agency carried a similar report.

The spy agency declined to confirm the reports. Two lawmakers on parliament's intelligence committee contacted Friday also refused to confirm the reports. The Unification Ministry, which monitors North Korea, said it cannot comment on intelligence matters.

The July attacks, in which floods of computers tried to connect to a single Web site at the same time to overwhelm the server, caused outages on prominent government-run sites in the U.S. and South Korea. Affected sites include those of the White House and the South's presidential Blue House.

North Korea immediately was suspected of involvement in the attacks but there has been little concrete evidence.

South Korean media reported at the time that North Korea runs an Internet warfare unit that tries to hack into U.S. and South Korean military networks to gather confidential information and disrupt service, and that the regime has between 500 and 1,000 hacking specialists.

Computer experts say the Web attacks like those waged in July are not difficult to launch.

"Many different parties could pull this off. This was not a particularly complex ... attack to launch," Rod Beckstrom, former head of the National Cybersecurity Center in the U.S., said Friday during a visit to Seoul.

"It's definitely credible that anyone who had $50 million or a quarter-million dollars or a fairly limited amount of funding could hire hackers to go and perpetrate such an attack," Beckstrom said.

Beckstrom was in the South Korean capital for a meeting of the Internet Corporation for Assigned Names and Numbers, a U.S.-based nonprofit organization overseeing Internet addresses that he heads.

North Korea could have launched the attacks in an attempt to "collect quality information" from the South or "to put psychological pressure on the South," said Kim Yong-hyun, a North Korea expert at Seoul's Dongguk University.

Ties between the two Koreas frayed after South Korea's President Lee Myung-bak took office last year pledging to get tough with nuclear-armed Pyongyang. However, inter-Korean ties have improved in recent months.

Comments

[LMPE]

North Korea has computers? Last I heard that country barely has anything.

[shamanbart]

This story begs the question -- why are we allowing internet traffic from known hostile nations? Yes, the internet was devised to be apolitical, to be open to all countries regardless of political stances for scientific purposes. However, since now governmental, military, commerical sites and services are connected to the internet, should the same open posture be the rule?

It's possible that the benefit of allowing N. Koreans to access American sites is higher than the benefit of trying to block them. If that's the case, shouldn't we at least attempt to create some blocks or hurdles for access to sensitive sites and services?

The internet seems to be a monolithic system that's resistant to structural change. Now that's it's in place, no one wants to modify the way it works to prevent abuse, improve performance and enhance security.

A solution is to build an additional two internet backbones -- one for business transactions, one for national govermental use, both with restricted authenticated access. We have no one but ourselves to blame when private records are stolen, DOD attacks crash governmental sites, security breaches cause secrets to be compromised.

[RedDogBear]

Its impossible to block Internet traffic from "hostile nations" unless we want to close it down and make it a US specific network or if we somehow get control of all the computers everywhere in the world. Suppose we block access to North Korea. Nothing stops North Korea from getting a server in China and doing whatever they want. For that matter, if they really want to get sneaky they can send their cyber spies to Canada, have them set up a little cyber terror shop there.

But the risks from all this are way overblown. You say: "A solution is to build an additional two internet backbones -- one for business transactions, one for national govermental use, both with restricted authenticated access." Guess what? Such networks already exist and have existed long before the Internet. For example every time you use your ATM card you are plugging into a global network of computers running very specialized software to validate and process your transaction. Those servers are completely cut off from the Internet. There are similar private networks for all sorts of military and industry applications that are either physically cut off from the Internet or blocked by software called firewalls.

[RedDogBear]

"The internet seems to be a monolithic system that's resistant to structural change"

Actually that is wrong. The Internet is the most distributed (i.e. non centralized, non monolithic) network in the history of computing. It was originally designed by scientists looking to create a network that could survive nuclear attacks, so that there were no central points of failure. Hence it is quite flexible and changing all the time. You don't see the changes precisely because it is so flexible so parts of it can be changed without impacting the network as a whole. The Internet of 10 years ago would choke on all the video, music, and other traffic that it handles now.

[hypnotoad72]

North Korea, China, Russia, India, Brazil, Mexico, California­... can happen from anywhere.

[ziploked]

"news reports said".... "reportedly told lawmakers" .... "declined to confirm the reports"

Is this a news report or pure speculation?

[lazercat2008]

Latest gossip from the war department. (Now working out of Cheneys basement.

[satanlite]

That is an attack on the US. 'ill Kim need to be spanked.

[hypnotoad72]

I don't think so. He has cooties. I ain't touchin' it...

/ducksforcover

[Pem3]

That is what the studded paddles are for.

[fcsakes]

Big surprise.

[MSaxe]

Would anyone be surprised if our intelligence or defense departments were running probes, tests and war games against the NK cyber systems? I wouldn't.

In fact, our intelligence community would be malfeasant if they weren't. I would suspect we could knock out their information infrastructure in 10 minutes if they got close to ours. If not, we better get some better hackers into the CIA and NSA.

[Jake the Snake]

Somebody needs to put a cap in Kim Jong Il A$$!!!!

[MajorKong]

Let's just suppose for a moment that somebody did.

Do you really think the military junta that would replace him would be any nicer?

[escobar]

We just keep pounding the war drum...Let­'s all be afraid of this great powerful boogyman..­.hack them back then....Or do they still use pens and paper?
South Korean anti-union activities worry me more.

[lazercat2008]

Time for a full retaliation people, get out your commodor 64s.

[MaxPowerXP]

IPv4 is incompatible with the Juche ideal

[jalaroc]

NK is the all around bad apple. far far worse than saddam ever was. Besides these cyber attacks, they also engage in massive insurance fraud where, through third parties and other cut outs, they buy insurance for industrial complexes or whatever then they either actually burn it down or they claim it was damaged and collect 10s of millions from insurance companies. Since these claims are in NK, the insurance companies have to go through north korean courts to fight them and guess which side the courts take? Even though insurance companies are wise to the scheme, they still get taken because of the practice of selling slices of risk for high premiums, which obscures the nature of the contract and who bought it. Then there are the concentration camps....f­ace it. if NK had made a play for bush's father, we'd have taken them out instead saddam.

[escobar]

HA HA nice satire....­yes I feel sorry for the poor dumb insurance companies too.

[jalaroc]

grin...not satire. I don't feel particularly sorry for them. They hang themselves because they see the fat juicy premiums and don't do their homework before accepting the policy. I was illustrating that NK has always been a pain in the collective neck in a multitude of areas.

[middleofthemiddle]

Perhaps we should hug Kim Jong Il some more. Maybe the President can go bow down before him as well. I'm sure that will do the trick.

[Cloball]

Or Dubya could go hold hands with him.

[iheardthisbefore]

Another NeoCon kneejerk..­....yeah, forget diplomacy.­....let's bomb 'em.

What a simple world of black and white viewpoint you have.

[satanlite]

When you say "president" you really meant Bush, I'm sure.

[audadvnc]

This whole post smells wrong. I do not doubt that cyberattacks may have been routed through the NK IP address specified. I doubt very much that NK was the only player here, as the Western intelligence agencies would not publicize it. My guess is that some 3rd party (starts "C", ends "A", with an "I" in the middle?) is behind the project (original cyberattacks AND press leaks) to make NK look bad.

[xtiangodloki]

Just because the attacks are traced to NK does not mean that NK originated the attacks. Hackers typically go through hoops trying to hide their true origins, including sending their traffic through "hostile" nations like China and N.Korea where they know it's difficult to trace any further.

[MinasTirith]

Which of course means that in our efforts to gin up more hatred or to continue to rattle the bones of fear in that closet, we (As in the US) could easily have made the attack appear to have come from NK.

For that matter, why even lend the appearance when you can simply create the 'press release' about it whole cloth, and fabricate it to read whatever you'd like it to say that will forward your beliefs or agenda?

If We The People had any real idea of how much we've been on the receiving end of misinformation campaigns we, as a nation, have aimed at us... 'We' would be collectively even more appalled than only 'some' of us now are, as we slowly awaken from our slumber to find ourselves in an almost constantly fabricated reality.

[JoeGdr]

I knew the Canadians were up to no good!

[erasmus888]

This Canadian should spank you for that comment.