The Marmot’s Hole

As anyone who plays CNC Generals could tell you, China has some pretty good hacker units. Personally, I could never win a game without ‘em, and the Internet Center in Zero Hour is seriously sweet. However, PLA hackers are apparently useful for other things other than beating up on noobs in multiplayer — they can also be used to pick the intelligence pockets of the Republic of Korea. Korean media is reporting that at least one of the Chinese hackers who broke into 10 different Korean national agencies — including the Korea Institute for Defense Analyses, the Korea Atomic Energy Research Institute and the Agency for Defense Development — is a serving member of the People’s Liberation Army. But first, a word of caution — the National Intelligence Agency’s Cyber Security Center is cautioning against media reports claiming that some or any of the hackers have been confirmed as Chinese military. According to the center, reports claiming that Korea has been victimized by a PLA cyber attack are not only reporting speculation as fact, but could also cause unnecessary feelings of insecurity and hurt investigations by hindering cooperation between the relevant authorities. There, I said it. Back to the fun stuff.

NoCut News quotes an unnamed intelligence official as saying on Thursday that, “Among the Chinese hackers, some have been confirmed as Chinese soldiers.” He explained that a comprehensive report on the incident is being written. Meanwhile, a police official said one of the hackers was a fourth-year student at a PLA-run foreign language school. The school in question seems to be something of a military academy, training soldiers in languages and computer skills needed by the PLA. NoCut also reports that the place serves as an officer training school for outstanding soldiers.

The Chosun Ilbo (Korean) ran a pretty good piece on China’s “crack hacking units” and extolled the prowess of Chinese information warfare. If you don’t read Korean, check out this piece from the FEER.

Anyway, Korea is apparently asking for China’s help in tracking down the individuals involved in the attack. Feel free to laugh now.

USFK denied reports that its computer network had been breached as well. A CFC official said, however, that hackers try to break into CFC’s Internet website “hundreds of times a day,” but they’ve yet to be successful.

The Korea Times reports that North Korea hands are suggesting North Korea may be behind the cyber attacks:

The allegation of the North’s involvement was brought up a day after the National Intelligence Service (NIS) confirmed the identities of Chinese hackers who were suspected of attacking the computers within 10 government agencies in South Korea.

“We don’t rule out the possibility of the North’s connection with the cyber attacks against us,” a source in the Defense Security Command (DSC) told The Korea Times. “But we first have to wait and see until we get an investigation result as South Korea has already asked Interpol to begin probes into this case.”

They point out North Koreans may be enrolled at the afore mentioned language school:

It is highly possible that a number of students from North Korea are attending classes in the college-level school as it grants admission to civilians too, North Korea watchers said. The source in the DSC added that there are even South Korean military officers attending the school.

I don’t know about the North Korea connection — most of the Korean language stuff I’m reading is pointing fingers at China, and the Chinese military in particular. Again, nothing has been confirmed, but if it does prove to be a PLA operation, one would have to wonder why China would risk the diplomatic fallout from something like this. I mean, the hackers used viruses to carry out their attack — they were going to be discovered eventually. Still, given the extent to which China controls its Internet, I don’t see how it’s possible that a major attack on a neighboring country like this could have been organized without the Chinese authorities at least knowing about it. Besides, all is fair in love and information warfare — if you present a target, you will be attacked. I can only hope Korea’s own very talented core of hackers are plotting retaliation — U.S. and Japanese websites have been hacked, bombarded and otherwise abused by Korean netizens for much less, and you’d hope a cyber-rape of this magnitude would motivate those same hackers to get to work. I don’t like “people’s cyber-warfare,” but if Korean netizens are going to engage in it, now would be the optimal time to do so.

What this means, of course, is that not only may have China ripped off very valuable state secrets from Korea — and the Chosun Ilbo piece quotes one police official as saying the damage done in terms of intelligence stolen was severe — but also that the MIC will probably have other things on their minds besides figuring out how to restore access to Blogspot and Typepad blogs.

Other English pieces here and here.