WORLDPOST

U.S. Tried Stuxnet-Like Campaign Against North Korea's Nuclear Program: Report

05/29/2015 03:15 pm ET | Updated May 29, 2015
ASSOCIATED PRESS

By Joseph Menn

SAN FRANCISCO, May 29 (Reuters) - The United States tried to deploy a version of the Stuxnet computer virus to attack North Korea's nuclear weapons program five years ago but ultimately failed, according to people familiar with the covert campaign.

The operation began in tandem with the now-famous Stuxnet attack that sabotaged Iran's nuclear program in 2009 and 2010 by destroying a thousand or more centrifuges that were enriching uranium. Reuters and others have reported that the Iran attack was a joint effort by U.S. and Israeli forces.

According to one U.S. intelligence source, Stuxnet's developers produced a related virus that would be activated when it encountered Korean-language settings on an infected machine.

But U.S. agents could not access the core machines that ran Pyongyang's nuclear weapons program, said another source, a former high-ranking intelligence official who was briefed on the program.

The official said the National Security Agency-led campaign was stymied by North Korea's utter secrecy, as well as the extreme isolation of its communications systems. A third source, also previously with U.S. intelligence, said he had heard about the failed cyber attack but did not know details.

North Korea has some of the most isolated communications networks in the world. Just owning a computer requires police permission, and the open Internet is unknown except to a tiny elite. The country has one main conduit for Internet connections to the outside world, through China.

In contrast, Iranians surfed the Net broadly and had interactions with companies from around the globe.

A spokeswoman for the NSA declined to comment for this story. The spy agency has previously declined to comment on the Stuxnet attack against Iran.

The United States has launched many cyber espionage campaigns, but North Korea is only the second country, after Iran, that the NSA is now known to have targeted with software designed to destroy equipment.

Washington has long expressed concerns about Pyongyang's nuclear program, which it says breaches international agreements. North Korea has been hit with sanctions because of its nuclear and missile tests, moves that Pyongyang sees as an attack on its sovereign right to defend itself.

U.S. Secretary of State John Kerry said last week that Washington and Beijing were discussing imposing further sanctions on North Korea, which he said was "not even close" to taking steps to end its nuclear program.

north korea rocket
People watch a TV news program showing rockets launched by North Korea, at Seoul Railway Station in Seoul, South Korea, Sunday, March 23, 2014. (AP Photo/Ahn Young-joon)

SIEMENS SOFTWARE

Experts in nuclear programs said there are similarities between North Korea and Iran's operations, and the two countries continue to collaborate on military technology.

Both countries use a system with P-2 centrifuges, obtained by Pakistani nuclear scientist A.Q. Khan, who is regarded as the father of Islamabad's nuclear bomb, they said.

Like Iran, North Korea probably directs its centrifuges with control software developed by Siemens AG that runs on Microsoft Corp's Windows operating system, the experts said. Stuxnet took advantage of vulnerabilities in both the Siemens and Microsoft programs.

Because of the overlap between North Korea and Iran's nuclear programs, the NSA would not have had to tinker much with Stuxnet to make it capable of destroying centrifuges in North Korea, if it could be deployed there.

Despite modest differences between the programs, "Stuxnet can deal with both of them. But you still need to get it in," said Olli Heinonen, senior fellow at Harvard University's Belfer Center for Science and International Affairs and former deputy director general of the International Atomic Energy Agency.

NSA Director Keith Alexander said North Korea's strict limitations on Internet access and human travel make it one of a few nations "who can race out and do damage with relative impunity" since reprisals in cyberspace are so challenging.

When asked about Stuxnet, Alexander said he could not comment on any offensive actions taken during his time at the spy agency.

David Albright, founder of the Institute for Science and International Security and an authority on North Korea's nuclear program, said U.S. cyber agents probably tried to get to North Korea by compromising technology suppliers from Iran, Pakistan or China.

"There was likely an attempt" to sabotage the North Korean program with software, said Albright, who has frequently written and testified on the country's nuclear ambitions.

north korea rocket
North Korean missiles are displayed during a military parade past Kim Il-Sung square marking the 60th anniversary of the Korean war armistice in Pyongyang on July 27, 2013. (Ed Jones/AFP/Getty Images)

OLYMPIC GAMES

The Stuxnet campaign against Iran, code-named Olympic Games, was discovered in 2010. It remains unclear how the virus was introduced to the Iranian nuclear facility in Natanz, which was not connected to the Internet.

According to cybersecurity experts, Stuxnet was found inside industrial companies in Iran that were tied to the nuclear effort. As for how Stuxnet got there, a leading theory is that it was deposited by a sophisticated espionage program developed by a team closely allied to Stuxnet's authors, dubbed the Equation Group by researchers at Kaspersky Lab.

The U.S. effort got that far in North Korea as well. Though no versions of Stuxnet have been reported as being discovered in local computers, Kaspersky Lab analyst Costin Raiu said that a piece of software related to Stuxnet had turned up in North Korea.

Kaspersky had previously reported that the software, digitally signed with one of the same stolen certificates that had been used to install Stuxnet, had been submitted to malware analysis site VirusTotal from an electronic address in China. But Raiu told Reuters his contacts had assured him that it originated in North Korea, where it infected a computer in March or April 2010.

Some experts said that even if a Stuxnet attack against North Korea had succeeded, it might not have had that big an impact on its nuclear weapons program. Iran's nuclear sites were well known, whereas North Korea probably has at least one other facility beyond the known Yongbyon nuclear complex, former officials and inspectors said.

In addition, North Korea likely has plutonium, which does not require a cumbersome enrichment process depending on the cascading centrifuges that were a fat target for Stuxnet, they said.

Jim Lewis, an advisor to the U.S. government on cybersecurity issues and a senior fellow at the Center for Strategic and International Studies, said there are limitations to cyber offense.

A cyber attack "is not something you can release and be sure of the results," Lewis said. (Editing by Tiffany Wu)

  • ASSOCIATED PRESS
    In this June 20, 2014 photo, a North Korean man stands in front of a row of homes in the town of Kimchaek, in North Korea's North Hamgyong province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 20, 2014 photo, an exclamation point punctuates a long propaganda slogan in a field in North Korea's North Hamgyong province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 19, 2014 photo, residents of a small roadside town walk towards the main road in North Korea's North Hamgyong. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 19, 2014 photo, a North Korean man pushes his bicycle to a village in North Korea's North Hamgyong province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this Monday, June 16, 2014 photo, North Korean men ride in a farmer's wagon in North Korea's South Hamgyong province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 20, 2014 photo, North Korean people rest next to the railroad tracks in a town in North Korea's North Hamgyong province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this Saturday, June 21, 2014 photo North Koreans walk in front of an apartment building in North Korea's South Hamgyong province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 21, 2014 photo a monument of a fist holding a bayonetted Kalashnikov rifle stands on a roadside in North Korea's South Hamgyong province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 20, 2014 photo, exhaust fumes, like fog, spills out of the long Hamgwan Tunnel near Hamhung in North Korea's South Hamgyong province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 15, 2014 photo, an apartment block stands behind hotel room curtains on the main street in Hamhung, North Korea. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 15, 2014 photo, the remains of lunch sits on a restaurant table in the city of Wonsan, North Korea. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 14, 2014 photo, portraits of the late North Korean leaders Kim Il Sung and Kim Jong Il are illuminated on a building side as the sun rises over Pyongyang. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 16, 2014 photo, statues of animals playing musical instruments stand along the roadside south of Samsu, North Korea in Ryanggang province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this Monday, June 16, 2014 photo, walks with a pink umbrella along the roadside south of Samsu, North Korea in Ryanggang province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 16, 2014 photo, farmers walk in a rainstorm with their cattle near the town of Hyesan, North Korea in Ryanggang province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 16, 2014 photo, boys play soccer in the town of Hyesan in North Korea's Ryanggang province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 16, 2014 photo, North Korean men share a picnic lunch and North Korean-brewed and bottled Taedonggang beer along the road in North Korea's North Hwanghae province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 16, 2014 photo, a fishing boat crosses the Samsu reservoir near the town of Samsu in North Korea's Ryanggang province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 17, 2014 photo, a deer's hoof used as a door handle, hangs from the front door of the home where North Koreans say the late leader Kim Jong Il was born around Mount Paektu in North Korea's Ryanggang province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 17, 2014 photo, a North Korean man holds a hand drawn map of the areas around Mt. Paektu as he and colleagues drive in Samjiyon in North Korea's Ryanggang province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 17, 2014 photo, a North Korean man sits by a cooking fire he built to roast potatoes and chicken in the town of Samjiyon, in North Korea's Ryanggang province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 17, 2014 photo, a North Korean man takes shelter in the rain next to long propaganda billboards in the town of Samjiyon in North Korea's Ryanggang province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 18, 2014 photo, the Associated Press vehicle climbs the slopes of Mount Paektu in North Korea's in North Korea's Ryanggang province. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In June 18, 2014 photo, a boulder lies on a path near the peak of Mount Paektu in North Korea's Ryanggang province. North Koreans venerate Mount Paektu for its natural beauty, but more importantly because it is considered the home of the North Korean revolution. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 19, 2014 photo, smoke stacks of a factories stand behind a compound wall along a street in the city of Chongjin, North Korea. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this Thursday, June 19, 2014 photo, North Korean women sit in their small food stalls in front of apartment blocks on the outskirts of Chongjin, North Korea. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 19, 2014 photo, a hotel employee walks in the lobby of a hotel that accommodates foreign visitors in Chongjin, North Korea. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 21, 2014 photo, a row of bicycles are parked next to the sea Wonsan, North Korea. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 21, 2014 photo, a group of young North Koreans enjoys a picnic on the beach in Wonsan, North Korea. (AP Photo/David Guttenfelder)
  • ASSOCIATED PRESS
    In this June 21, 2014 photo, a man works on his car as others sit next to the sea Wonsan, North Korea. (AP Photo/David Guttenfelder)
Suggest a correction
Comments

CONVERSATIONS