A new kind of war has emerged after the Sony hack: Cyberwar is now much more visible. We had heard about its existence from Snowden and various other security experts. But it has never been so clear. The HuffingtonPost published a very interesting article about North Korea's online evolution and we bring it to you.
Most North Koreans have never seen the Internet, but Washington suspects it is behind the devastating hack of Sony Pictures Entertainment, as well as several devastating cyber intrusions into South Korea in recent years.
Experts say the Sony Pictures hack was the most expensive cyberattack ever inflicted on an American company. Sensitive documents and terrorist threats forced Sony to cancel the release of the film “The Interview.” Rumors have it that the studio is on the verge of collapse as embarrassing revelations from tens of thousands of emails have been leaked, irreparably exposing the company.
Let's take a look at the country's suspected cyberwarfare capabilities as experts believe the authoritarian nation has a cyber program:
North Korea's CyberArmy
A former North Korean defector spy chief says the number of professional hackers the country employs is between 1,000 and 3,000. The numbers come from Seoul's intelligence agency in 2010 and a North Korean government document leaked in 2009. So everyone agrees that North Korea trains hackers at top schools to launch cyber attacks, mainly in South Korea.
Defector Kim Heung Kwang said that hackers are trained at the university in the industrial city of Hamhung, North Korea. Hackers are funded and sent to study abroad (China and Russia).
In 2009, then-leader Kim Jong Il ordered a “cyber-reinforcement” and Pyongyang acquired 3,000 hackers, Kim said, citing a North Korean government document. The document’s accuracy cannot be confirmed.
Kim, who has lived in Seoul since 2004, believes more have been recruited since then, and some are using China as a base to infiltrate networks abroad.
Simon Choi, a senior security researcher at anti-virus firm Hauri Inc. in Seoul, said North Korean hackers have honed their skills by carrying out various attacks in South Korea. Choi, who analyzes malicious code from North Korea, said the country's capabilities have improved and it is able to disguise malware as harmless computer code.
Cyberattacks of the past
South Korea has accused North Korea of carrying out at least six high-profile cyberattacks since 2007, with many unsuccessful attempts to break into corporate and government computer systems. In six cases, hackers destroyed hard drives, crippled banking systems and disrupted access to websites. Some of these attacks were so devastating that in one case a South Korean bank was without online banking services for more than two weeks.
The first attack by North Korea took place on July 7, 2009, in the form of a denial-of-service attack on dozens of South Korean and U.S. government websites. The hackers caused heavy traffic from tens of thousands of “zombie” computers that they had managed to infect with malware. Initially, South Korea pointed the finger at North Korea. Some experts later said there was no evidence that Pyongyang was behind the attack, but South Korea continues to see the attack as a prelude to a growing cyber threat from the North.
A similar intrusion was carried out on March 4, 2011. Hackers attacked approximately 40 South Korean websites. Targets included websites from the South Korean presidential office, the foreign ministry, the national intelligence agency, US forces in Korea, and major financial institutions.
A month later, the South Korean bank Nonghyup was the victim of a damaging cyberattack. It took the bank more than two weeks to recover and resume online banking and ATM services. South Korean authorities concluded that North Korea was responsible for the attack on April 12, 2011.
One of the most devastating attacks occurred in 2013. On March 20, a cyberattack hit 48,000 computers and servers, disrupting the country's banks for 2-5 days. Officials said no bank records or personal data were compromised, but executives at three television stations were unable to log into their systems for several days.
Three months later, on the anniversary of the start of the Korean War, dozens of government and media websites were hit by malicious code and denial-of-service attacks.
What will be North Korea's next step?
Experts believe that for impoverished North Korea, expanding its cyber warfare is an attractive option because it is cheaper. Developing malicious code is much faster than building nuclear bombs or other weapons of mass destruction. Moreover, online attacks can be carried out anonymously.
It is also a battle that North Korea has little to lose. Unlike South Korea, where commerce and many aspects of daily life depend on the Internet, North Koreans are not. In South Korea, a website hack or disruption of online banking can cause major disruption.
“North Korea has very few computers with Internet connectivity. South Korea has a huge IT infrastructure that could suffer from attacks,” said Choi, the security expert. That provides ample targets for North Korean hackers, he continued.
Closure
Everything the world knows about North Korea's cyberwarfare capabilities comes mainly from defectors from North Korean intelligence agencies who fled the country before 2007, when the first major cyberattack on South Korea took place.
North Korea's nuclear capabilities are a point of pride for the isolated nation, but the country has never openly admitted the existence of state-trained hackers.
North Korea has repeatedly denied Seoul's accusations of cyberattacks on South Korea. In the case of Sony Pictures, North Korea said it was not them, but expressed sympathy for those who did it.
Source: secnews.gr
