Group or state apparently behind cyber attacks: S. Korea

(ATTN: RECASTS lead, headline; UPDATES throughout; ADDS background throughout)
By Sam Kim
SEOUL, July 8 (Yonhap) -- A group or a state appears to be behind cyber attacks
mounted this week on more than two dozen Web sites, including those of the U.S.
and South Korean presidential offices, South Korea's national intelligence agency
said Wednesday.
"The attacks appear to have been elaborately prepared and executed at the level
of a group or a state," the National Intelligence Service (NIS) said in a
statement.
It did not specify which group or state may be involved.
Some 12,000 personal computers in South Korea and 8,000 abroad were apparently
exploited as vehicles for the attacks, the NIS said.
No classified information has been leaked from the South Korean government during
the attacks, which affected the sites of Cheong Wa Dae and the defense ministry
in Seoul among others, the NIS said.
The attacks were first detected at around 6:50 p.m. Tuesday, it said, adding
"malicious programs" were found targeting 26 U.S. and South Korean Web sites,
including that of the White House.
The so-called distributed denial-of-service attacks involve hacking into personal
computers and using them to jam Web sites by increasing data traffic beyond their
capacity.
The NIS said the South Korean government is handling its routine tasks without
difficulties as it has run its own internal network since 2005.
The agency has ratcheted up its monitoring alert since the attacks, and
dispatched special agents to the defense ministry and the presidential office to
assist their recovery.
Other South Korean institutes affected by the attacks included the National
Assembly and such major lenders as Shinhan Bank and Korea Exchange Bank.
U.S. institutes, including the U.S. Treasury Department and Secret Service, were
also attacked over the weekend, and some of them were reportedly still affected
as of Wednesday afternoon.
The NIS said it is working with U.S. authorities to track down the attackers,
while South Korean defense officials have declined to comment on speculation that
North Korea could be involved.
According to South Korea's Defense Security Command (DSC), North Korea operates a
cyber warfare unit that specializes in hacking into South Korean and U.S.
military networks.
South Korea's defense networks are attacked an average of 15,000 times a day by
hackers and hit with viruses another 80,000 times, the DSC said in a statement
last month.
Eleven percent of the attacks are "sophisticated attempts to extract military
intelligence," while the rest are relatively easier to head off, it said.
The two Koreas remain technically at war with each other as their 1950-53 Korean
War ended in a truce rather than a peace treaty.
Most attacks by North Korean hackers are believed to take place via China, which
has also been suspected of attempting to extract information from South Korean
government computers.
In May, South Korea and the United States forged a tentative agreement to bolster
cooperation in fighting cyber terrorism and participate in joint anti-hacking
exercises and conferences.
South Korea plans to set up an independent cyber warfare command by 2012 to deal
with cyber attacks as part of its long-term defense reform plan.
samkim@yna.co.kr
(END)