Hacking attack targeting North Korea?... 'kp' domain site massive access failure for half a day (comprehensive)

(Seoul = Yonhap News) Reporter Bo-ram Yoon, Chae-rim Ha, and Ha-young Kwon = North Korean authorities' websites using the 'kp' domain, including the North Korean Ministry of Foreign Affairs and the Korean Central News Agency, suffered a series of access failures for half a day on the 20th.

About 40 major websites using the North Korean national domain 'kp', including the Ministry of Foreign Affairs, Korean Central News Agency, Democratic Joseon, and Naenara, were inaccessible or unstable for about 8 hours from around 11 am to 7 pm on this day.

As of 8 PM, connection is smooth.

According to 'Telecom Observer', a site specializing in communication network observation, instability was observed in North Korea's Internet routing system on this day.

Stillian, a domestic security company, analyzed that this connection failure was likely caused by an attack on a specific communication line or a failure of the line itself, rather than a simple traffic surge.

The explanation is that the servers that manage North Korea's website addresses are all concentrated in one Chinese communication line band, so if there is a problem in this band, several sites will stop working at the same time.

Park Chan-am, CEO of Stillian and former white hacker, said, "As of 6 p.m., the North Korean band route was alive, but the Chinese line side band where the name server (a server that connects domain addresses to IP addresses) is located was not connected."

Representative Park added, “We believe it is either a DDoS (Distributed Denial of Service) attack targeting the line in question or a failure of the line itself, but it is difficult to determine yet.”

However, it has been reported that no specific hacking targeting North Korea has been detected so far.

In the past, there was a case where an external hacker group intensively attacked the KP domain, resulting in a large-scale access failure. At the end of 2014, after the U.S. government identified North Korea as the mastermind behind the Sony Pictures Entertainment hacking incident, North Korea's Internet network was completely shut down due to an external attack.