Hackers 'might not be N Korea'
2009-07-09 19:12
San Francisco - Cyber security analysts raised doubts on Wednesday that the North Korean state launched recent attacks on US government and South Korean websites, saying industrial spies or pranksters could be the villains.
More than two dozen websites in the US and South Korea, including that of the US State Department, were attacked in recent days.
South Korea's spy agency has said North Korea may be behind the attacks, while the US government has said it is too soon to make such claims - and internet security experts agree.
The implications of a state-sponsored attack are severe, said SecureITExperts' Mark Rasch, who led the US Department of Justice computer crimes unit from 1983 to 1991.
"There's no difference between dropping a logic bomb and dropping a TNT bomb in the law of war," he said, but added that while North Korea could have been behind the manoeuvres, they did not appear to be coming from computers physically located in the reclusive Asian country.
"This is not something that your average 'script kitty' can do. On the other hand it doesn't require it to be state-sponsored," Rasch said.
The relatively simple "denial of service" attacks aim to overwhelm computers with requests for information. They are designed primarily to disrupt systems rather than penetrate and obtain data, analysts said. They are also difficult to trace.
The attacks could have been a "shot across the bow" by North Korea, the computer equivalent of its recent missile launches, but could also have been conjured up by hackers looking to make quick money or secure bragging rights.
They also could mask malicious activity like inserting spyware or malware computer programs that could later be activated, analysts said.
Mercenaries for hire
The attacks began on July 4th, the US Independence Day holiday.
But Rodger Baker, Stratfor's director of East Asia analysis, pointed out the date is also close to the anniversary of the death of North Korea's founder Kim Il Sung and North Korean missile launches, which might lend some credence to speculation that the country was behind the attacks.
Other analysts shied away from pinpointing North Korea and said the attacks could be financially motivated.
"There's a trillion dollars in economic losses sustained due to hacking every year, not just financial data theft but also industrial espionage," Core Security Technologies' Tom Kellermann said.
"You're seeing a massive community of mercenaries for hire who are leveraging their computer skill sets, particularly in this global recession, the laid off IT professionals et cetera that are leveraging their attack capabilities and their technological experience to break in and out of systems."
Analysts struggled to explain why North Korea would launch such an unsophisticated attack. Despite its financial strains, the country has a cyber warfare unit and a "hacking academy", Kellermann said.
"In our experience, state-sponsored events are under the radar," said Mandiant executive Mike Malin.
"If you were going to launch a sophisticated attack, you wouldn't warn people with this kind of attack. This woke up all the network defenders and you lose the element of surprise," said James Lewis, a fellow at the Centre for Strategic and International Studies.