Diplomacy won’t stop North Korean hacking, South Korean officials say

Two top South Korean cybersecurity experts cautioned Thursday that their country is not prepared to stem the tide of North Korean hacking, regardless of two recent summits with Pyongyang that have taken place.

Top South Korean cybersecurity experts don’t expect Donald Trump’s diplomacy to slow down North Korean cyberattacks.

Speaking through interpreters at a Brookings Institution event Thursday, two of South Korea’s leading cybersecurity experts said that they’re no longer able to cope with the sheer volume of attacks emanating from the North.

In the past decade, every well-known South Korean organization has been hacked or targeted by North Korea, noted SangMyung Choi, chief of South Korea’s Computer Emergency Response Team.

At the Washington, D.C., event, Choi showed off a slide deck that warned “there is no place that is not hacked” and “we are in the real cyberwarfare.”

“A lot of these attacks have not been [revealed] to the South Korean public, but today I confess to you that it’s been very prevalent,” Choi said. Since May 2018, he revealed, North Korean-backed hackers have launched spearphishing and watering hole attacks in forged documents related to the April inter-Korean and June U.S.-North Korea summits.

After the North-South summit in April, “I thought that perhaps the cyberattacks would come to a stop,” Choi said. “But they never actually did.”

Choi traced the trajectory of the North’s hacking army, from the fledgling days of its creation and cultivation under Kim Jong-il in the early 2000s to its current state, boasting teams worldwide.

In the past few years, Choi said, Pyongyang has netted significant espionage victories through various digital operations. For example, in 2017, hackers breached the South Korean defense ministry’s computer network and discovered joint U.S.-South Korean war plans.

Choi, along with other panelists, explained that North Korea’s lucrative involvement in state-administered cybercrime, which ranges from bank heists to cryptocurrency theft, would keep it from totally abandoning the practice.

Chris Painter, an Obama-era cyber diplomat, said he wasn’t surprised that hacking didn’t come up in Singapore, and that he too expected North Korean cyberattacks to continue. “I think it is too much of a capability they have to abandon,” he told CyberScoop.

North Korea’s brazen hacking on the world stage qualifies it as a rogue nation, said Jong-in Lim, a South Korean cybersecurity expert and former special advisor to the president. The South, which bears the brunt of the attacks, can’t keep up, Lim said. After each wave, the “government did create reactive policies. But they were not effective in halting North Korean advances.”

The South must improve its organization, information-sharing, and responses to adequately contain, deter, and deflect North Korea in cyberspace, Lim told the audience. And for a genuine, lasting peace treaty on the Korean Peninsula, the North Koreans must assent to drawing down their offensive cyber operations, Lim and Choi claimed.

For now, Pyongyang has an incentive to keep up the offensive.

“We really don’t have enough firepower to counteract or provide penalties for these attackers,” Lim said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure