HackDig : Dig high-quality web security articles for hacker

South Korea claims North hacked nuclear data

2015-03-17 21:45

The South Korean government issued a report today blaming North Korea for network intrusions that stole data from Korea Hydro and Nuclear Power (KHNP), the company that operates South Korea's 23 nuclear reactors. While the government report stated that only "non-critical" networks were affected, the attackers had demanded the shutdown of three reactors just after the intrusion. They also threatened "destruction" in a message posted to Twitter.

In many ways, the cyber-attack bears hallmarks of the attack on Sony Pictures last year: the hackers have demanded an unspecified amount of money, claimed to be part of an activist group, and are threatening the release of more data if their demands—which include the shut-down of three nuclear plants—are not met. The malware used in the attack was spread in a wave of 5,986 phishing attacks, sent in e-mails to 3,571 KHNP employees. And the first release of data included personal information on 10,799 KHNP employees.

According to a statement issued today by the Republic of Korea's Seoul Central District Prosecutor's Office, "The malicious codes used for the nuclear operator hacking were the same in composition and working methods as the so-called 'kimsuky' malware that North Korean hackers use." The malware was compiled, like that used in the Sony attack, on a computer that was configured for the Korean language.

Last week, partial blueprints of nuclear power plants, including the hot water systems of the reactors at the Kori nuclear power plant in Gori, South Korea, were leaked via a Twitter account named "Who am I = No Nuclear Power." The profile for the account claimed the author was "president of anti-nuclear reactor group from Hawaii." This was the sixth posting of information since December 15 of last year. Other data released so far included what amounts to a random collection of technical data, including a manual for running Monte Carlo simulations and documents on reactor design.

In a recent Twitter post, South Korea's Yonhap news agency reports the attacker "'congratulated' the KHNP for finding 7,000 viruses but claimed 9,000 more were awaiting his or her order." The attackers also claim to have data about South Korea's indigenous nuclear power reactor program and are threatening to sell it.

"Need money. Only need to meet some demands... Many countries from Northern Europe, Southeast Asia and South America are saying they will buy nuclear reactor information. Fear selling the entire information will undermine President Park (Geun-hye)'s efforts to export nuclear reactors," the posting said.

In addition to identifying the malware used in the attack, the South Korean government's investigation traced Internet traffic related to the attack back to addresses for a network in northeast China near the North Korean border. The government had earlier requested assistance from the Chinese government in identifying the source of the attack.

Source: /atad-raelcun-dekcah-htron-smialc-aerok-htuos/30/5102/ytiruces/moc.acinhcetsra

Read:3257 | Comments:0 | Tags:Law & Disorder Risk Assessment Technology Lab

“South Korea claims North hacked nuclear data”0 Comments

Submit A Comment



Blog :

Verification Code:


Share high-quality web security related articles with you:)


Tag Cloud