Impoverished North Korea falls back on cyber weapons

As one of the world's most impoverished powers, North Korea would struggle to match America's military or economic might, but appears to have settled on a relatively cheap method to torment its foe.

According to the US government, Kim Jong-Un's autocratic pariah state was behind a cyber attack that humiliated Hollywood studio Sony Pictures and forced it to cancel a movie mocking him.

President Barack Obama vowed that the United States will respond to the hacking, but cyber attacks are difficult to deter and easy to deny—as Pyongyang has done in this case.

The US Federal Bureau of Investigation said the Sony hack had been traced to North Korea in part through its similarities to attacks launched last year against banks and media outlets in South Korea.

The malicious code that infected Sony Pictures was identified as a customized version of the known hacking tool "Destover."

Similar code had been used in the cyber attacks in South Korea, which were traced to North Korea, and against corporations in the Middle East, including oil giant Saudi Aramco.

The virus spreads quickly, sucks up data and then destroys computer hard drives to cover its tracks.

"North Korea has been in everyone's sights for years for trying to develop cyber war capabilities," said Tim Stevens of the War Studies department at King's College London.

"It's a relatively cheap option. There are reports that they are running a hacking unit out of China with at least the tacit consent of the PLA," he said, referring to China's People's Liberation Army.

Obama said that the US has no evidence that North Korea received assistance from another country in mounting the attack, but its own Internet capabilities are not known to be fearsome.

"The interesting thing is that, if North Korea develops a strong capability, it will be much easier for them to carry out attacks than for other countries to retaliate," Stevens said.

Obama said the United States "will respond proportionately" but did not say how, and Stevens warned it would be hard to target.

"Their Internet infrastructure is so rudimentary that it would be hard to cause many problems for North Korea. So it's a strategic win-win for them," he told AFP.

Many experts questioned the true extent of the North's skills, but Yang Moo-Jin of Seoul's University of North Korean Studies said it had a track record in the style of assault directed at Sony.

"Its cyber-attacking abilities are good enough to hack into government and private websites in South Korea, and other countries in general," he said.

According to Yang, North Korea has in recent years trained thousands of hackers in secret government and military programs.

Elite cyber squad

South Korean intelligence believes North Korea runs an elite cyber-warfare unit with at least 3,000 personnel, and regards its ability to launch hacking attacks to be a major security threat.

In recent years, hackers have deployed malware and virus-carrying emails against South Korean military institutions, commercial banks, government agencies, TV broadcasters and media websites.

In October, the South's National Intelligence Service (NIS) said the North tried to hack more than 20,000 smartphones using malware disguised in mobile gaming apps to disseminate propaganda.

The NIS said more than 75,000 hacking attempts were made against South Korean government agencies between 2010 and September this year—many of them believed to be from Pyongyang.

While Internet capabilities are essentially non-existent for citizens in North Korea, the military has reportedly cultivated cyber assault capabilities for more than five years.

Children with outstanding science or math skills are said to be enlisted into a military unit that promises more privileged lifestyles.

Sony workers may have been targeted with "spearphishing" attacks—bogus emails that appear to come from trusted sources and include web links or attached files which, if opened, infect computers.

In addition to receiving threats, Sony has seen the release of a trove of embarrassing emails, scripts and other internal communications, including information about salaries and employee health records.

© 2014 AFP