战略与国际研究中心-What-Do-We-Know-About-Past-North-Korean-Cyber-Attacks-and-their-Capabilities__2页_187kb

KOREA CHAIR PLATFORM: Summary of North Korean Cyber Attack Capabilities

Core Content

This report, authored by Jenny Jun, Scott LaFoy, and Ethan Sohn, provides an analysis of North Korea's cyber operations capabilities, focusing on their strategic implications. It is part of the CSIS Korea Chair for the NK Cyber Strategy Project, a yearlong research initiative.

The document outlines North Korea's history of cyber attacks, particularly against South Korean targets, and explores the possibility of their involvement in the 2014 Sony Pictures Entertainment cyber attack, which remains unconfirmed.

Main Points

North Korea's Cyber Operations Against South Korea

• Early Incidents: North Korea has conducted several cyber attacks against South Korean institutions.
• 2011 Attack: On April 12, 2011, North Korea allegedly launched a cyber attack that paralyzed online banking and credit card services of Nonghyup Agricultural Bank, affecting 30 million customers.
  • This attack used a disc wiping tool, marking the first known use of such a method by North Korea.
  • 273 out of 587 servers were destroyed, with some online services taking over two weeks to recover.
• 2013 Attack: On March 20, 2013, North Korea launched a similar but more advanced attack using disc wiping tools.
  • The attack targeted multiple banks and broadcasting agencies simultaneously.
  • It was preceded by an extensive advanced persistent threat (APT) campaign, indicating a coordinated and strategic approach.

North Korea's Cyber Operations Against the United States

• Limited Incidents: There is limited open-source evidence of North Korea targeting U.S. government or private entities with disruptive or destructive cyber attacks.
• 2009 Incident: A single DDoS attack on U.S. government websites in July 2009 was reported, but it had minimal impact and was not considered sophisticated.
• Alleged Targets: North Korea has been accused of targeting U.S. and European organizations for information exfiltration, such as nuclear warhead miniaturization and ballistic missile technology.
  • These allegations, made by the North Korea Intellectuals Solidarity (NKIS), have not been substantiated with technical evidence.

Technical Capabilities and Infrastructure

• Cyber Units: North Korea is believed to have a dedicated, permanent cyber unit focused on strategic targets.
• Training and Resources: They maintain a competent computer technology base, including institutions such as the Korea Computing Center (KCC) and the Pyongyang Informatics Center (PIC), as well as universities like Kim Chaek University of Technology and Kim Il Sung University's School of Computer Science.
• Military Institutions: There are also military-related institutions that train individuals for cyber operations.

Future Potential and Capabilities

• Current Limitations: There is no evidence that North Korea has developed highly sophisticated malware like Stuxnet, which is both destructive and clandestine.
• Potential Evolution: The report suggests that North Korea may be working towards more advanced and destructive cyber operations, such as supply chain compromises or attacks on SCADA networks.
• Strategic Implications: The report emphasizes that the key question is not whether North Korea's capabilities match those of the U.S., Russia, or China, but whether they are "good enough" to achieve their intended objectives.

Key Information

• Sony Pictures Attack: The 2014 attack on Sony Pictures Entertainment is a subject of ongoing investigation and has not been conclusively attributed to North Korea.
• Ad Hoc vs. Organizational: If the attack is attributed to North Korea, it could indicate a shift from ad hoc operations to a more organized and dedicated cyber strategy.
• Open Source Analysis: Due to limited open-source information, it is difficult to assess the full extent of North Korea's cyber capabilities.

Conclusion

The report underscores the evolving nature of North Korea's cyber operations, highlighting their increasing sophistication and strategic focus on South Korean targets. While their capabilities against U.S. entities remain limited, the possibility of future more advanced and destructive attacks cannot be ruled out. The report calls for further research and monitoring to better understand the trajectory and implications of North Korea's cyber strategy.