North Korean website has had access problems for two days... Line problem? Cyber ​​attack?

(Seoul = Yonhap News) Reporter Bo-reum Yoon and Ha-young Kwon = Access disruptions to major media outlets such as North Korea's Rodong Sinmun and Korean Central News Agency and websites of organizations such as the Ministry of Foreign Affairs have continued for two days until the 21st.

42 major websites using the North Korean national domain '.kp', including the Ministry of Foreign Affairs, Korean Central News Agency, Democratic Joseon, and Naenara, are either inaccessible or in an unstable state as of 5 p.m. on this day.

Access to those sites was not normal for about 8 hours from 11 a.m. to 7 p.m. the previous day, but was restored around 8 p.m.

However, three hours later, around 11 PM, connection problems such as service interruptions began to appear again and have not been resolved to this day.

Connection was not possible at all, or even when connected, disconnections occurred every 1 to 2 minutes. On the 21st, normal connection was confirmed 11 times, lasting approximately 1 to 18 minutes each time.

It is known that connection is not smooth not only in Korea but also in other countries such as the United States. North Korean authorities have not announced any related information.

The exact cause of this incident has not yet been confirmed, but it is being raised that it could be a problem with the line itself or a cyber attack.

The domestic security industry analyzed public routing data, which is Internet path information, and the Domain Name System (DNS), which converts domain names into IP addresses, and confirmed the intermittent pattern of repeated recovery and failure in North Korea's Internet.

The name server (DNS server) in charge of North Korea's top-level domain (.kp) is currently responding, but the lower-level name server in charge of addresses of individual sites is still not responding, making the connection unstable.

The industry believes that this phenomenon suggests that a problem may have occurred in communication lines or network equipment.

Park Chan-am, CEO of Stillian, said, "North Korea has an unstable power supply, so border routers or exchange equipment may turn off and on intermittently, causing the same situation as it is now." He added, "In fact, the North Korean internet failure that occurred in June of last year was assessed to have been caused by an internal problem rather than an external attack."

Given that the outage continued for more than a day, it is difficult to view it as a one-time temporary failure, and some say that the possibility that it was a DDoS (distributed denial of service) attack targeting a specific communication line cannot be ruled out.

This is because connection failures can be repeated even if the attacker stops and resumes the attack to avoid detection.

In particular, security experts explain that the servers that manage North Korean websites are all concentrated on a single Chinese communication line, and if there is a problem in this band, several sites will fail at the same time.

When asked whether they had detected a hacking trend targeting North Korean websites, a government official said, "Currently, there is no information to confirm whether it is a cyber attack."

Previously, North Korea suffered a DDoS attack in 2022 and suffered a website access failure. At the end of 2014, shortly after the U.S. government identified North Korea as the mastermind behind the Sony Pictures Entertainment hacking incident, North Korea's Internet network suffered an external attack and was completely paralyzed.