Reports: Cyberattacks traced to NKorea

October 30, 2009 By JAE-SOON CHANG , Associated Press Writer

(AP) -- The North Korean government was the source of high-profile cyberattacks in July that caused Web outages in South Korea and the United States, news reports said Friday.

The IP address - the Web equivalent of a street address or phone number - that triggered the Web attacks was traced back to North Korea's Ministry of Post and Telecommunications, the chief of South Korean's main spy agency reportedly told lawmakers.

The ministry leased the IP address from China, Won Sei-hoon of the National Intelligence Service told lawmakers Thursday, according to JoongAng Ilbo newspaper. South Korea's Yonhap news agency carried a similar report.

The spy agency declined to confirm the reports. Two lawmakers on parliament's intelligence committee contacted Friday also refused to confirm the reports. The Unification Ministry, which monitors North Korea, said it cannot comment on intelligence matters.

The July attacks, in which floods of computers tried to connect to a single Web site at the same time to overwhelm the server, caused outages on prominent government-run sites in the U.S. and South Korea. Affected sites include those of the White House and the South's presidential Blue House.

North Korea immediately was suspected of involvement in the attacks but there has been little concrete evidence.

South Korean media reported at the time that North Korea runs an Internet warfare unit that tries to hack into U.S. and South Korean military networks to gather confidential information and disrupt service, and that the regime has between 500 and 1,000 hacking specialists.

Computer experts say the Web attacks like those waged in July are not difficult to launch.

"Many different parties could pull this off. This was not a particularly complex ... attack to launch," Rod Beckstrom, former head of the National Cybersecurity Center in the U.S., said Friday during a visit to Seoul.

"It's definitely credible that anyone who had $50 million or a quarter-million dollars or a fairly limited amount of funding could hire hackers to go and perpetrate such an attack," Beckstrom said.

Beckstrom was in the South Korean capital for a meeting of the Internet Corporation for Assigned Names and Numbers, a U.S.-based nonprofit organization overseeing Internet addresses that he heads.

North Korea could have launched the attacks in an attempt to "collect quality information" from the South or "to put psychological pressure on the South," said Kim Yong-hyun, a North Korea expert at Seoul's Dongguk University.

Ties between the two Koreas frayed after South Korea's President Lee Myung-bak took office last year pledging to get tough with nuclear-armed Pyongyang. However, inter-Korean ties have improved in recent months.

©2009 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.