Skip to main content

Hacking attack on South Korea traced to China, officials say

By Michael Pearson. K.J. Kwon and Jethro Mullen, CNN
March 21, 2013 -- Updated 0241 GMT (1041 HKT)
STORY HIGHLIGHTS
  • NEW: Attack traced to IP address in China, officials say
  • North Korea has staged similar attacks in the past, expert says
  • Banks, broadcasters targeted; government networks unaffected, Yonhap reports
  • South Korean military steps up its cyberdefense efforts in response

Seoul, South Korea (CNN) -- The suspected cyberattack that appeared to target South Korean banks and broadcasters Wednesday originated from an IP address in China, South Korea's Communications Committee said in a statement Thursday.

The attack damaged 32,000 computers and servers of media and financial companies, the committee said.

South Korean officials are analyzing the cause and are working to prevent any further damage, the committee said.

The attack infected banks' and broadcasters' computer networks with a malicious program that slowed or shut systems down, officials and the semiofficial Yonhap News Agency said.

Suspicion immediately fell on North Korea, which has recently renewed threats to go to war with the South amid rising tensions over Pyongyang's nuclear weapons and missile testing and international efforts to stop them.

South Korea's military stepped up its cyberdefense efforts in response to the widespread outages, which hit nine companies, Yonhap reported, citing the National Police Agency.

Government computer networks did not seem to be affected, Yonhap cited the National Computing and Information Agency as saying.

Experiencing a potential cyberattack
Cybersecurity concerns for China, U.S.

A joint team from government, the military and private industry was responding, a presidential spokeswoman said, according to Yonhap.

A South Korean official close to the investigation told CNN that malicious computer code spread through hacking caused the outages.

How the hackers got in and spread the code remains under investigation, and analysts are examining the malware, the official said.

U.S. flies B-52s over South Korea

Wednesday's attack is consistent with what North Korea has done in the past, said Adam Segal, a cybersecurity expert with the Council on Foreign Relations.

"It's happened before in similar circumstances where there have been tensions on the peninsula," Segal said.

South Korea has accused the North of similar hacking attacks before, including incidents in 2010 and 2012 that also targeted banks and media organizations.

The outages come amid heightened tensions on the Korean Peninsula, with the North angrily responding to a recent U.N. Security Council vote to impose tougher sanctions on Pyongyang after the country's latest nuclear test last month.

Last week, North Korea invalidated its 60-year-old armistice with the South. It has threatened to attack its neighbor with nuclear weapons and has also threatened the United States.

The armistice agreement, signed in 1953, ended the three-year war between North and South but left the two nations technically in a state of war.

The saber-rattling prompted the United States to deploy B-52 bombers to conduct high-profile flyovers of its South Korean ally and announce that it would deploy new ground-based missile interceptors on its West Coast against the remote possibility that North Korea could strike the United States with long-range weapons.

Under threat, South Koreans mull nuclear weapons

Last week, North Korea complained that it was the victim of "intensive and persistent virus attacks" from the United States and South Korea, according to KCNA, the official North Korean news agency.

Yonhap said Wednesday's outages affected three broadcasters, four banks and two insurance companies.

The three broadcasters -- KBS, MBC and YTN -- reported varying levels of trouble containing the virus. While the networks remained on the air, cable network YTN said editing equipment had been affected and it expected to experience broadcasting problems, Yonhap reported.

Computer networks stopped working entirely at three banks -- Shinhan, Nonghyup and Jeju -- around 2 p.m. Wednesday, Yonhap reported, citing the National Police Agency. Another financial institution, Woori Bank in Seoul, reported it was able to fend off a hacking attack about the same time.

The banks that were affected reported problems with a variety of systems, including Internet banking, ATMs and telecommunication services, and some branches stayed open late because of the slowdown, Yonhap said.

CNN's K.J. Kwon reported from Seoul, Jethro Mullen reported from Hong Kong and Michael Pearson wrote from Atlanta. Judy Kwon and Hilary Whiteman in Hong Kong contributed to this report.

ADVERTISEMENT
Part of complete coverage on
November 27, 2014 -- Updated 1521 GMT (2321 HKT)
The first human trial of an experimental Ebola vaccine has produced promising results, U.S. scientists said.
November 27, 2014 -- Updated 1415 GMT (2215 HKT)
Darren Wilson, the police officer who fatally shot unarmed black teen in August abandoned home after address made public.
November 25, 2014 -- Updated 2236 GMT (0636 HKT)
HBO -- backing a documentary based on "Going Clear," a book about Scientology and Hollywood -- isn't taking any chances with legal side.
November 26, 2014 -- Updated 1935 GMT (0335 HKT)
Grandmaster Nguyen Van Chieu has devoted his adult life to spreading the word about Vietnames martial art, Vovinam.
November 27, 2014 -- Updated 1136 GMT (1936 HKT)
England cricketer Nick Compton shares insight into "drive and courage" it takes to face fears as top batsman.
November 27, 2014 -- Updated 0059 GMT (0859 HKT)
Ferguson police officer Darren Wilson says he was just doing his "job right" when he shot and killed black teenager Michael Brown.
November 24, 2014 -- Updated 0118 GMT (0918 HKT)
The interior of the Formosa Boulevard Mass Rapid Transit Station in Kaohsiung, in southern Taiwan.
Stunning stations where your first priority won't be finding the nearest exit.
November 25, 2014 -- Updated 2318 GMT (0718 HKT)
Turkish President Recep Tayyip Erdogan says women's "nature is different," sparking fury.
November 24, 2014 -- Updated 1043 GMT (1843 HKT)
A 30-year-old woman has been charged with attempting to kill a baby police say spent five days down a drain before being discovered by cyclists.
November 21, 2014 -- Updated 0121 GMT (0921 HKT)
If it wasn't for a comic's skit, Bill Cosby would still be America's favorite father, says expert.
November 24, 2014 -- Updated 0051 GMT (0851 HKT)
Where do hip young things hang out in Taiwan?
November 21, 2014 -- Updated 1550 GMT (2350 HKT)
Obama orders the most sweeping overhaul of U.S. immigration in decades, prioritizing the deportation of "felons, not families."
November 18, 2014 -- Updated 2106 GMT (0506 HKT)
Fighters loyal to ISIS are now in control of Derna, a city on Libya's Mediterranean coast.
November 21, 2014 -- Updated 2319 GMT (0719 HKT)
China and likely other countries have the capacity to shut down the U.S. power grid, says the NSA.
November 19, 2014 -- Updated 1945 GMT (0345 HKT)
The founder of a U.S. nonprofit that works with returning soldiers is named CNN's Hero of the Year.
November 27, 2014 -- Updated 1703 GMT (0103 HKT)
Each day, CNN brings you an image capturing a moment to remember, defining the present in our changing world.
Browse through images from CNN teams around the world that you don't always see on news reports.
ADVERTISEMENT