News

Korean Peninsula A to Z

Issues

S. Korean Military Suffers Massive Hacking Conducted Presumably by N. Korea

Hot Issues of the Week2016-12-11
S. Korean Military Suffers Massive Hacking Conducted Presumably by N. Korea

North Korea appears to have carried out cyber-attacks on the South Korean military's Cyber Command earlier this year.

The Ministry of National Defense announced on Monday that it investigated the September hacking incident and found that the attack compromised not only the external Internet but also the intranet service of the ministry.

The ministry said that North Korea is believed to be behind the attack, citing that the malicious code and an IP address traced back to China were the same ones used by the North previously.

The latest revelation differs from the ministry's previous statement, in which it said that chances for the intranet service to be hacked was very low as it is had been separated from the server that manages the external Internet.

The ministry also said that some classified military information has been lost.

According to the ministry, the hacking was not a onetime incident but a long-term scheme that began more than a month earlier. On August fourth, hackers first attacked a military computer connected to the external Internet and turned it into a zombie PC. They then analyzed the vaccine program installed in the computer to find the loopholes of the anti-hacking system of the South Korean military.

The vaccine routing server turned out to be the conduit for hacking into the military network. The server was automatically updating vaccine programs installed in each terminal, during which outsiders could implant malicious codes in the server and spread them into the connected terminals.

Around three-thousand-200 computers within the Cyber Command were infected with the viruses, including two-thousand-500 connected with the external Internet and 700 connected to the intranet.

Even the computer belonging to Defense Minister Han Min-koo was infected, although classified military information remained intact.

In response, the military said it has banned the automatic update of security programs installed in its computers, and has instead ordered its software engineers to manually update them.

Experts said the military should handle classified information with extra care and block Internet access whenever they work with such information on computers.

Some are calling for more investment in South Korea’s cyber warfare capability, pointing out a growing gap in the area between the two Koreas.

Latest News