South Korea facing North Korean cyber attack campagin

South Korea is facing an increasing onslaught of cyber attacks from North Korea. Below is a list of the most recent significant incidents. This is a useful tactic for North Korea as it is difficult for South Korea to respond.North Korea has little Internet infrastructure to attack via computer network operations(CNO) and it would take an extreme North Korean attack involving loss of life to prompt South Korea responding militarily. South Korea, one of the most networked countries on Earth, has to just play defense and take the hits.

June 2012, South Korean Newspaper JoongAng Ilbo
In June 2012 cyber actors linked to North Korea attempted to destroy the newspaper's article database and the editing system which moves articles through the paper's intranet. Link. Previous blog entry.

April 2011, South Korean National Agricultural Co-operative Federation(NACF, Nonghyup Bank)
In April 2011 cyber actors linked to North Korea destroyed 100s of the Nonghyup Bank's internal computer servers disrupting banking services for millions of customers for over a week. Link.

March 2011, DDoS against South Korean websites
In March 2011 an advanced DDoS attack was launched against a number of South Korean websites, the computers used by the botnet which launched the attack were rendered unusable after the attack by overwriting the hard drive's Master Boot Record(MBR). Link.
The attacks in March were also linked to a covert North Korean operation to import computer games containing malware into South Korea. Link.

July 2009 DDoS against South Korean and US websites
In July 2009 several waves of DDoS attacks targeted South Korean and US websites. Link.

Further reading

"Increasing concerns regarding cyber warfare capabilities of North Korea", Security Affairs Blog
"North Korea's cyber warfare strength grows", Bloomberg News
"North Korea's IP address space",  North Korean Tech blog

JoongAng Ilbo cyber attack

In June 2012 the South Korean newspaper JoongAng Ilbo(중앙일보) was hit by a major cyber attack (해킹, 차원 다른 악의적 수법으로) which attempted to destroy the papers article database, editing and distribution system. News reports indicate that this attack was likely carried out by North Korean state actors and follows a threat made by North Korea earlier this year against several South Korean news outlets. In addition the attack left the following image on the paper's website joongang.co.kr

The text in yellow is a message from the hackers written using SQL and is as follows .

select count (*) from tbTarget // 1000000
select domain, d-day, method from tbTarget WHERE seqnumber = 2048 //www.joongang.co.kr, 2012-06-09, APT
select domain, d-day, method from tbTarget where seqnumber = 2049 //???.??????.???,2012 -??-19,???? < br /> select domain, d-day, method from tbTarget where seqnumber = 2050 //???.?????.???,2012 -??-29,??
select count (*) from tbHacker // 10000
select name, birthday, sex from tbHacker where age < 5 //IsOne, 2011-06-09, woman

There is a purported SQL query followed by the supposed result. This is threatening further attacks on the 19th and 29th day of an unknown month in 2012. The hacking group is calling itself "IsOne".

Only seven cyber attacks. The term is widely over used.

Many analysts misuse the term cyber attack, making it seem that operations better classed as espionage or vandalism are more dramatic than they really are. According to the Department of Defense, Computer Network Attack(CNA) consists of actions taken through the use of computer networks to disrupt, deny, degrade, or destroy information resident in computers and computer networks, or the computers and networks themselves(see Joint Pub 3-13). I would be even more strict that the DoD and suggest that denial of service operations have to be extremely significant for them to be classed as an attack. A bank or government website being unusable for a few days is hardly in the same class of operation as destroying information throughout an organization to cripple its operations.

I would argue that there has been only 7 publicly known cyber attacks in history and 3 of them are probably by North Korea. It is not surprising that all the attacks relate to significant real world conflicts.

June 2012, South Korean Newspaper JoongAng Ilbo
In June 2012 cyber actors linked to North Korea attempted to destroy the newspaper's article database and the editing system which moves articles through the paper's intranet. Link.

April 2012, Iranian Oil Ministry
Unknown cyber actors launched an attack against the Oil Ministry to destroy key ministry information. Link.

March 2012, Al Qaeda forums knocked offline
Unknown cyber actors disabled several major Al Qaeda online forums, the forums remained offline for many weeks. Link.

February 2012, BBC news
In early 2012 cyber actors linked to Iran launched an attack against the BBC's Persian language service, the attack seemed to be coordinated with Iranian satellite jamming efforts. Link.

April 2011, South Korean National Agricultural Co-operative Federation(NACF, Nonghyup Bank)
In April 2011 cyber actors linked to North Korea destroyed 100s of the Nonghyup Bank's internal computer servers disrupting banking services for millions of customers for over a week. Link.

March 2011, DDoS against South Korean websites
In March 2011 an advanced DDoS attack was launched against a number of South Korean websites, the computers used by the botnet which launched the attack were rendered unusable after the attack by overwriting the hard drive's Master Boot Record(MBR). Link.

2008-2010 Natanz, the Iranian centrifuge plant
According to the New York Times the US launched a cyber attack against Natanz to destroy centrifuges. Link.