South Korea finds Chinese code used in cyber attack

Investigation: South Korean computer researchers, left, check the shutdown computer serves of Korean Broadcasting System (KBS)


The biggest cyber attack on South Korean computers in two years used malware from China, an initial investigation focusing on possible links to North Korea has found.
About 32,000 servers were damaged in Wednesday's attack on broadcasters and banks, the Korea Communications Commission said.
President Park Geun-hye set up a team to investigate whether North Korea was responsible after computer shutdowns hit companies including Shinhan Bank, Nonghyup Bank, Munhwa Broadcasting Corporation, YTN and Korean Broadcasting System.

Advertisement

The attack occurred amid increasing friction over North Korea's nuclear weapons program. Kim Jong-un's regime, which detonated an atomic device last month, has threatened to attack the US with nuclear weapons and said on Thursday that US bases in Guam and Japan were within range.
''Discovering that the code was from China makes it more likely that the attack was from North Korea, because a lot of North Korean hackers operate there,'' said Ryou Jae-cheol, a professor of computer engineering and securities at Chungnam National University. ''Who else would be making this kind of attack at this scale and timing other than North Korea?''
The Chinese Foreign Ministry did not immediately respond to faxed questions seeking comment.
The commander of US forces in South Korea, General James Thurman, told Congress last March that North Korea had ''growing cyber warfare capability''.
The North ''employs sophisticated computer hackers trained to launch cyber infiltration and cyber attacks against'' South Korea and the US, General Thurman said.
Malware code was distributed through targeted organisations' servers, destroying their computers' ability to boot, the Korea Communications Commission said on Wednesday.
''This is the biggest and most serious cyber attack in two years,'' an official at the commission, Shin Hong-sun, said. ''There haven't been simultaneous attacks on more than one target since 2011.''
South Korea blamed the North for an attack on about 40 websites in 2011. The South also blamed the North for an attack on Nonghyup a month later that stopped almost 20 million clients from using ATMs and online banking services. South Korean police believe the most recent cyber attack by the North was last June, against the JoongAng Ilbo newspaper.