DDoS paralyzes North’s Internet

North Korea’s Internet network went completely dark for more than nine hours on Tuesday after U.S. President Barack Obama threatened to respond “proportionally” to Pyongyang for its alleged cyberattack on Sony Pictures.

Connections to key North Korean websites were lost for hours starting in the early morning but came back online later in the day. Access to the Internet sites of the Rodong Shinmun, the mouthpiece of the ruling Workers’ Party, and the state-run Korean Central News Agency was denied throughout Tuesday morning, but it was restored in the afternoon after more than nine hours, the Ministry of Unification in South Korea said.

Starting Saturday, connections to most of the websites operated by one of the world’s least-wired nations became unstable. Starting at 1 a.m. on Tuesday, the reclusive Communist country was completely offline.

Doug Madory, director of Internet analysis at Dyn Research, told international media that the situation was consistent with a DDoS (distributed denial of service) attack on North Korea’s routers. A DDoS attack refers to attackers flooding a network with traffic until it crashes due to an overload.

Arbor Networks, a network security company, said at least six of the DDoS attacks on the North originated from the United States.

And yet, exactly who pulled the plug of the North’s Internet was not immediately confirmed. The U.S. government was vague on the question.

“We aren’t going to discuss, you know, publicly operational details about the possible response options or comment on those kind of reports in any way except to say that as we implement our responses, some will be seen, some may not be seen,” State Department deputy spokeswoman Marie Harf said.

U.S. Secretary of State John Kerry telephoned China’s Foreign Minister Wang Yi Sunday and asked for Beijing’s cooperation in punishing Pyongyang for the Sony cyberattack.

Almost all North Korean routers are operated through China Unicom, China’s state-run telecommunications provider.

Last week, the U.S. government vowed to launch a “proportional response” to Pyongyang’s suspected hacking of Sony Pictures Entertainment over the controversial film “The Interview.” The satirical movie features a plot to assassinate North Korean leader Kim Jong-un, and Pyongyang has reacted furiously to it.

Earlier this month, Sony canceled the theatrical release of the movie after a group of hackers made terror threats.

While North Korea denied its role in the hacking, the FBI said last week the Communist country was linked to the attack. Obama has called the hacking an “act of cybervandalism,” and also added, “We will respond proportionately.”

While Obama has denied that the United States and North Korea are at war in cyberspace, the South Korean military beefed up its cyber security posture. According to a source from the Joint Chiefs of Staff, the information operational alert level against North Korea known as Infocon was up by one notch.

“Recently, the blueprints of our nuclear power plants were leaked and the North was accused of hacking Sony,” said the source. “To prepare for the escalated cyber threats, we upgraded the Infocon.”

Over the past years, North Korea was named as a culprit in major cyberattacks against South Korea.

In 2009, the North had attempted to hack the websites of the Blue House and the National Assembly. It paralyzed the banking network of Nonghyup in 2011 and attacked broadcasters and financial firms last year.

The Joint Chiefs of Staff said it will create a cyber warfare division starting Jan. 1, next year. “Until now, we had passive missions focused on defense and attack surveillance by the Army’s Cyber Warfare Command, but we will transform our posture to more aggressive operations,” the source said. “The Army’s command will be controlled by the Joint Chiefs of Staff.”

The military said the plan will ready the South Korean military for cyberattacks in emergency situations. To this end, an independent command office will be created by 2016 and the manpower will be increased to 1,000 from the current 600.

BY SER MYO-JA [myoja@joongang.co.kr]