http://www.hstoday.us/blogs/critical-issues-in-national-cybersecurity/blog/the-axis-of-cyber-evil-a-north-korean-case-of-cyber-espionage/3072be3aacf419cc494e3910a62107b2.html ****
** ** The Axis of Cyber Evil: A North Korean Case of Cyber Espionage **** *October 10, 2013* **** By: MacDonnell Ulsch**** China, Russia, Syria, Iran and North Korea are long established cyber threats that have evolving into a post-Cold War axis of cyber evil that is escalating in intensity and should be taken seriously by any entity, government or private sector, possessing valuable proprietary information. And the stakes are getting higher. **** **** Let’s start with the Syrian Electronic Army, or SEA, which is thought by many to be funded by the Bashar Hafez Al Assad regime. Until recently, the media and diplomatic focus on Syria has been on the deployment of deadly chemical weapons, but now we are witness to cyber attacks on the institutions that have been critical of Assad and Syria: the *New York Times *, the BBC, the Qatar government, National Public Radio, and even Al Jazzera. The attacks resulted in various levels of cyber disruption, and are believed to have resulted from very sophisticated phishing attacks. **** **** Iran has also been engaged in attacking US banks’ websites for more than a year, creating operational disruption in the form of denial of service attacks, while demonstrating that US targets are not, by any measure, immune. **** **** China’s cyber attacks are well known, despite its diplomatic protestations. Transnational organized crime is equally well established. But North Korea’s recent attacks against South Korean targets are particularly interesting, because North Korea is an element of the axis of cyber evil. ** ** **** The attacks by North Korea, which were recently made public by anti-malware company Kapersky Lab, are concerning for several reasons: first, because of the selection of attack targets, and second, because of North Korea’s relationship with China; the targets included the Sejong Institute, a South Korean think tank specializing in national security strategy and Korean unification. **** **** This seems to be a clear case of political espionage. The Korea Institute for Defense Analyses is a quasi-governmental national security and defense organization, so it, too, is an understandable target for North Korea, as is the South Korean Ministry of Unification. One of the more intriguing espionage targets was South Korea’s Hyundai Merchant Marine Co. Ltd., part of the Hyundai Group, a diversified corporation. **** **** While the other targets are logical, given North Korean unification and national security concerns, the Hyundai information theft may not be as immediately obvious. It is true that North Korea maintains a merchant marine operation, but it seems unlikely that this rogue nation-state would benefit substantially and directly from cyber espionage against Hyundai Merchant Marine. South Korea ranks number eight in the global merchant marine market sector, with 1,114 vessels. North Korea, on the other hand, is 34th in the world and maintains a fleet of only 150 vessels, many of which are said to not be seaworthy, and reportedly do not stray far from home port. **** **** To put this in perspective, Germany is ranked number one, with 3,768 vessels. It seems improbable that North Korea would steal information for its own competitive positioning, given its anemic economy, deficient fleet operational status and its maritime scrutiny. **** **** What is more likely is that either North Korea was hired by China to breach South Korean interests -- perhaps the political components of the breach providing strategic cover -- North Korea, acting independently, believed that it could sell the information to China, or China launched the attack against South Korea, but making it look like the attack was originated by North Korea. **** **** Geography plays a part in the cyber attack against South Korea. Ten of the IP address ranges, according to Kapersky, originated in the Jilin Province Network and the Liaoning Province Network. Situated in the northeast region of China, Jilin and Liaoning are near the North Korean and Russian borders. The Internet Service Providers that serve the region are believed to maintain communication lines into parts of North Korea. **** **** Once a center of heavy industry, with strong Russian, Chinese and North Korean influence, this region of China has not fared well economically, and its population exceeds 100 million. Industry sectors include steel, automotive, shipbuilding, aircraft, petroleum and manufacturing. There are approximately a dozen key universities in the region, many of them with strong science and technology programs. **** **** And here is the point: China has an aggressive revitalization plan that was developed by China’s National Development and Reform Commission (NDRC). The NDRC economic development report, translated from Chinese, stated that “China’s participation in international competition, the use of domestic and foreign resources and markets to accelerate the pace of expansion of trade … to create more opportunities,” is part of China’s economic development strategy. The report also stated that “economic development is not sufficient.” However, there is a more direct link that suggests China is the beneficiary of the Hyundai information. **** **** Citing that its “high tech industries [are] inadequate,” the report documented the need for China to significantly improve its “international level of shipbuilding …” and to “accelerate the development of [its] high-tech industry.” **** **** Perhaps most indicative of China’s involvement is its stated objective to pursue, as part of its regional economic strategy, an upgrade of its “logistics management, logistics and distribution facilities” and its “integrated logistics system in Northeast China.” Of course, global integrated logistics is the business of Hyundai Merchant Marine, the South Korean espionage target. **** **** Regardless of specifics -- and we may never know exactly what occurred -- it is obvious that North Korea has global reach. It is also obvious that it has an important relationship with China. And given China’s voracious appetite for an extraordinary range of information that it will use to fuel its global economic leadership, companies possessing intellectual property and trade secrets are at extreme risk. Because most proprietary information is unregulated, and is, therefore, not subject to basic protections, the risk of compromise is heightened. **** **** This is not a call to regulate proprietary information. But every audit and risk committee member of board of directors and every CEO and general counsel should ask questions about their company’s ability to protect the very information that is anticipated to contribute to the current and future corporate value. **** **** This is not just a security problem. This is an issue of critical corporate governance, clarity of mission … and long-term reputation and market competitiveness. It is, equally, a national economic security imperative. ** ** **** *MacDonnell Ulsch is CEO & Chief Analyst of **ZeroPoint Risk Research LLC*<http://www.zeropointrisk.com/> .**** ** ** __._, __,_._,___ -- -- Thanks for being part of "PoliticalForum" at Google Groups. For options & help see http://groups.google.com/group/PoliticalForum * Visit our other community at http://www.PoliticalForum.com/ * It's active and moderated. Register and vote in our polls. * Read the latest breaking news, and more. --- You received this message because you are subscribed to the Google Groups "PoliticalForum" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
