North Korean Internet Hit by DDoS Cyberattack, Network Monitor Kentik Says
Key Takeaways
- •Kentik's analysis suggests a DDoS cyberattack was likely behind intermittent outages that disrupted North Korean state websites over a 32-hour period starting Tuesday.
- •More than 40 official sites using the .kp domain, including the foreign ministry and state news agency KCNA, were intermittently inaccessible, according to South Korean media.
- •Kentik's Doug Madory said the attack traffic originated from locations including Vietnam and Venezuela, but the data does not identify who was responsible.
- •South Korean security experts cited by local outlets said North Korea's unstable power supplies could have been a contributing cause of the outages.
- •North Korea's tightly controlled internet, which only a small circle of state-approved users can access, previously suffered a complete hours-long outage in late 2014 amid controversy over a Sony Pictures comedy.
SEOUL — A cyberattack was likely behind intermittent internet outages in North Korea this week that knocked several of the reclusive country's state-managed websites offline, according to analysis by US network monitoring company Kentik.
Doug Madory, Kentik's director of internet analysis, told Reuters on Friday that North Korea's internet experienced multiple waves of traffic from locations including Vietnam and the Philippines at the same time that several North Korean websites began experiencing outages over a 32-hour period that started on Tuesday.
"This traffic all started at the same time and it is coming from Vietnam and Venezuela. That's definitely a DDoS (Distributed Denial-of-Service) attack," he said.
DDoS attacks overwhelm a target by flooding it with traffic from many sources at once, leaving the network unable to respond to legitimate users.
Kentik's data showed that the sharp spikes in traffic began at around 11 a.m. local time (0201 GMT) on Tuesday. However, the data does not indicate who the perpetrators are, and Kentik only analyzed a portion of the traffic directed at North Korea, Madory said.
The outages hit more than 40 official sites using the country's .kp domain, including those of the foreign ministry and the state news agency KCNA, according to South Korean media. Because .kp sites make up much of North Korea's limited presence on the open web, the disruption intermittently cut off outside access to some of the government's principal online channels. South Korean outlets also cited security experts as saying that North Korea's unstable power supplies could have been a contributing cause.
The outage appeared unrelated to global internet issues stemming from the disclosure of vulnerabilities in the PHP programming language later in the week.
North Korea's tightly controlled internet network — accessible only to a small circle of state-approved users, while most of the population relies on a separate domestic intranet known as Kwangmyong — has been paralyzed before. In late 2014, following controversies over a Sony Pictures comedy about a fictional assassination of North Korean leader Kim Jong Un, the country experienced an hours-long complete internet outage.
— Reuters
