As North Korean internet suffered massive outage yesterday, it is difficult not to wonder whether this is the ‘proportional response’ President Obama warned about. While, massive DDoS of DPKR’s network seems almost too blunt instrument, considering sophisticated capabilities of targeted operations available to NSA, it would be appropriate as a “warning shot” – showing how easily (in matter of less than week) whole Korean internet infrastructure can be disabled. It has to be noted though that officially American administration ruled out possibility of demonstration strike. Regarding if North Korea is really source of the attacks, jury is still out. According to FBI, evidence strongly backs this theory, however some researchers, including Bruce Schneier, remains unconvinced. Those opinions however, often does not fully embrace the fact that FBI press release may purposefully present very general overview of evidence gathered, in order to not give heads up to actual attacker.
Until more informations will be available two issues may already discussed – to some degree who could be responsible for Korea’s internet outage and whether it is proper to engage in cyberwar over attack on corporation.
Regarding first question, recent write-up about state of DPKR‘s internet access and hosts identified reveals interesting state of DPRK’s network and perhaps potential attractive targeted attack for hackers. Legal status of such activities also remains in grey area – it is hard to judge whether authorities would decide to prosecute someone trying to breach into North Korean network, even if strictly speaking most provisions included in criminal codes does not differentiate between targets of breach. Also given possibility that Sony attacks originated from Korea, countries might not want to have leading back to them. Revealed IP address include even login page for Cisco router (http://126.96.36.199/) – possibly tempting target for anyone curious. However, scale of the outage suggests rather organised effort and no hacker group yet claimed responsibility. Interesting theory involves China intervention – perhaps escalation of affairs caused its involvement in order to prevent further embarrassment.
In latest Edward Snowden’s profile prepared by Wired two new informations related to US cyberwarfare activity were revealed. First is that NSA caused internet blackout in Syria while trying to deploy exploit in one of Syria’s main routers. Unfortunately instead of accomplishing their goal operatives made router completely unresponsive – effectively cutting off country from foreign internet connections. Combining secret nature of NSA activities with increased rebel activity during that period (November of 2012) the narrative presented by media was naturally much different. Pretty much every major news network claimed (often backed up by source from intelligence / cyber security companies) that Syria’s government is responsible for blackout, and furthermore that it was a deliberate effort in order to prevent global coverage of atrocities that are about to happen. There are two side of this – it might be argued that given unstable situation and callousness of Al-Assad’s regime, government sponsored blackout was the most probable course of action. On the other hand this case brutally reveals how much and to what extend informations about cyberwarfare in all its aspects (be it hacker attacks, cyber espionage, ddos attacks or anything else executed from behind the keyboard) are based on speculations and probability scales. Make no mistake – it is not strictly fault of news networks, or rather it is but there is little they can do about it. In case of rising superpower of news media, the internet outlets of various forms what matters most is page visit counter. While this phenomena is certainly not limited to cyberwarfare reporting, combination of lack of sources, clandestine nature of operations and limited technical knowledge of news staff makes reports even sketchier and more sensationalistic than usual. After all nothing makes a better headline than a cyberattack straight from Tom Clancy’s novel.