2024.07.03. The Fair Economy — The Kim Jeong-eun regime in North Korea is carrying out various cyberattacks targeting the world. It employs not only sophisticated attacks by specialized personnel but also basic attacks using hacking tools. A notable increase in attacks aimed at seizing financial and virtual assets has also been observed. In the cyber world, where attacking is easy but defending is difficult, experts gathered to discuss how South Korea should respond to North Korean hacking threats.
Rep. Park Chung-gwon, a member of the National Assembly's Science, ICT and Broadcasting Committee, held a seminar titled 'The Reality of North Korean Hacking and Response Strategies' on the 3rd at the National Assembly Member Hall in Yeongdeungpo-gu, Seoul.
In his opening remarks, Rep. Park Chung-gwon noted, "It has not been long since the unprecedented hacking incident targeting the Supreme Court was confirmed, yet now the official social media account of the Ministry of Health and Welfare has been hacked by a North Korean hacker group. Public anxiety over the inadequate security systems of public institutions is growing further."
He said, "The Kim Jeong-eun regime emphasizes hacking as an 'all-purpose treasured sword' and is intensively training hacking personnel. North Korean hacker units are highly likely to use stolen personal information for criminal activities to earn illicit funds, or to carry out strategies against South Korea by targeting government employees." He pointed out that massive amounts of stolen personal information could also be disguised as virtual individuals and used to spread disinformation and fake news, or to manipulate online comments within our society.
Rep. Park Chung-gwon concluded his opening remarks by stating, "Security is over once it is breached. Major public institutions handling large amounts of personal information must thoroughly prepare for cyber threats to their information and communication networks and administrative data."
This was followed by congratulatory remarks from National Assembly Deputy Speaker Joo Ho-yeong, National Assembly Intelligence Committee Chair Shin Sang-beom, and lawmakers Yoon Jae-ok and Han Gi-ho.
North Korea Eager for Foreign Currency… Seizing Assets via Cyberattacks
At the seminar, experts noted that while North Korea previously conducted hacking against hostile forces, it is now carrying out cyberattacks targeting various countries and companies with the aim of earning foreign currency. They assessed that North Korea is likely investing the assets obtained from these cyberattacks into nuclear and missile development.
In the first presentation, Moon Jong-hyeon, Director of the Genians Security Center, presented on 'The Reality of North Korean Cybersecurity Threats Based on Real Cases.'
Director Moon Jong-hyeon stated that cyber intrusions by North Korea have reached a serious level, noting that news of North Korean hacking has become so commonplace that it now appears as an ordinary story.
He explained that North Korea carries out hacking for the purposes of information theft, causing social disorder, and extorting financial and virtual assets, and that it is also working hard to train specialized personnel to carry out these activities. He said North Korea is cultivating "computer elites," whose main job is to conduct cyberattacks, through a formal education curriculum.
Director Moon Jong-hyeon categorized North Korean cyberattack methods into five types: spear phishing attacks, watering hole attacks, software supply chain attacks, social network service attacks, and outsourcing freelancer attacks.
He stated, "In the case of a website intrusion incident involving a domestic construction technology association, we were able to grasp the attack storyline, or the flow of the intrusion, through an Endpoint Detection and Response (EDR) solution." He added, "To build consensus at the national cybersecurity level, raise security awareness, and accurately understand and respond to threat realities, it is necessary to build a next-generation integrated security platform including EDR."
Regarding "building a next-generation integrated security platform," he said it should be operated efficiently and with visibility by integrating the latest threat-detection technologies, including EDR and cyber threat intelligence (CTI).
He also mentioned the need to strengthen intelligent monitoring through an automated, platform-based multi-threat response system.
He emphasized that continuous attention and investment in next-generation security technologies are no longer an option but a necessity.
He added that it is also necessary to train field-ready cybersecurity professionals and to improve working conditions for existing security personnel.
Kim Dong-hui, Director of the National Security Research Institute, gave the second presentation on 'Policy Directions for Responding to Cybersecurity Threats.'
Director Kim Dong-hui analyzed, "North Korea is engaging in earning foreign currency through cyberattacks," adding, "North Korean cyber threats are expanding into various areas and continuing to become more sophisticated and complex." This implies that as North Korea is expected to attempt intelligent attacks rather than simple cyberattacks in the future, South Korea's response must also be integrated and comprehensive.
He said, "In February, the National Security Office announced the 'National Cyber Security Strategy.' It embodies the vision of a global pivotal state that upholds the values of freedom, human rights, and the rule of law in cyberspace and fulfills its role and responsibilities in the international community. It also presented three major goals: offensive cyber defense and response, expanding global leadership, and securing robust cyber resilience."
The government identified five strategic tasks to implement the three major goals of the National Cyber Security Strategy: strengthening offensive cyber defense activities, building a global coordination system, strengthening cyber resilience of national core infrastructure, securing a competitive edge in new technologies, and strengthening the foundation for mission execution.
Director Kim Dong-hui proposed four suggestions for implementing these strategic tasks.
First, he said South Korea should strengthen its cyber response capabilities, which requires securing "means to deter and respond to cyberattacks" and "technical and institutional capabilities for offensive cyber defense activities." He said the concept of offensive defense lies in a gray zone between attack and defense, and that problems such as violations of international law, infringement of jurisdiction, and collateral damage could arise. He therefore stressed the need to clearly establish the concept of offensive defense.
He also suggested reorganizing the legal and institutional framework for responding to cyber threats. He stressed the need to overhaul and strengthen the cyber security implementation system and establish a legal basis for cyber security tasks. In particular, he pointed out that enacting a framework act on cyber security is urgent.
He also deemed strengthening public-private cooperation essential. To achieve this, he said there must be efforts to enhance the private sector's cyber security capabilities and expand participation, and to strengthen the collection and sharing of cyber threat information. He also suggested the need to establish reasonable control measures for collecting digital information in cyber security work.
Finally, he emphasized the need to strengthen international cooperation. He said there should be efforts to establish high-level situational awareness criteria for cyber security threats and to develop and implement joint response options for cyber threats.
Attacks Are Easy but Defense Is Hard… Urgent Need to Strengthen Public-Private Information Sharing and Cooperation
In a discussion moderated by Ha Jae-cheol, a professor at Hoseo University and president of the Korea Institute of Information Security and Cryptology, panelists unanimously agreed that defending against North Korean cyberattacks is not easy, and therefore, national defense capabilities must be strengthened through public-private cooperation.
In the discussion, Kim Jin-guk, CEO of Plainbit, pointed out, "In the past, North Korea-backed cyberattacks had specific targets and clear objectives, so simply identifying an attack as coming from North Korea was of great help in responding to cyber threats. Recently, however, North Korea has diversified its targets to the point where it is difficult to group its attacks, and its methods have also become more varied." He cited a case in which North Korea carried out cyberattacks on Ukraine via South Korea's information and communications technology (ICT) infrastructure.
He suggested that rather than focusing solely on the origin of the threat being North Korea, it is necessary to carefully assess the association with attack groups based on exploited vulnerabilities, infrastructure, and attack methods, and to develop response strategies by distinguishing within the same attack group according to purpose.
CEO Kim Jin-guk raised his voice, stating, "It is difficult to remove North Korean threats that have penetrated widely and deeply into South Korea all at once. The asymmetry between attack and defense makes North Korea appear powerful. Now we must grow our defense capabilities to match the attack capabilities."
He pointed out that overseas, the FBI openly and actively cooperates with private companies like Mandiant in the cyber domain, whereas in South Korea, state agencies such as investigative bodies conduct threat analysis and response informally and are reluctant to reveal or engage in private cooperation.
CEO Kim Jin-guk concluded, "The defense and response capabilities of the public and private sectors must grow together."
Won Yu-jae, a professor at Chungnam National University Hospital and president of Concert.or.kr, said, "We need to approach prevention and response separately," and offered opinions on strengthening national cyber security capabilities.
First, he said the expertise of security officials in central administrative agencies should be enhanced. Pointing out limitations such as frequent personnel transfers and a focus on operational security tasks, he noted, "The government, which demands that the private sector prohibit the concurrent holding of the chief information security officer (CISO) position, must also secure the expertise of its own security personnel."
He also expressed the opinion that the information security industry needs to prepare for security incidents. He said, "While supply chain security applies to everyone, it is important to ensure that security incidents do not occur at information security companies. There have been many incidents involving the use of information security solutions. We must raise the capability level of information security companies to prevent such incidents in the future."
He also pointed out the need for the public and private sectors to quickly share information about cyberattacks, saying, "When a cyberattack is attributed to North Korea, information about the incident or analysis results is often not well shared. Since the vulnerability itself can become a weapon, sharing needs to happen quickly in order to raise the level of response."
Finally, he called for the information security disclosure system to be run in a more substantive way. He said the disclosure system currently allows understanding of how much companies invest in information security, but going forward, the system should be properly established by checking the adequacy of disclosure content and the direction of investment.
Kim So-jeong, a senior researcher at the Institute for National Security Strategy (INSS), emphasized strengthening international cooperation in her policy proposal to counter North Korea's virtual asset theft.
According to the 2024 UN Security Council Panel of Experts report on North Korea sanctions, North Korea is known to have seized approximately $3 billion (about 4 trillion won) worth of virtual assets over about six years. She assessed that North Korean cyberattacks are now being carried out targeting the entire world. Cyber duty officers at embassies of various countries in South Korea say, "North Korea has been attacking our country."
In this context, Kim So-jeong's opinion is that South Korea should respond to North Korea's cyberattacks through international coordination and cooperation.
She emphasized the need to fully understand North Korea's cyber capabilities and threat assessments and to pursue cooperation with allies and friendly nations.
She also noted that joint advisory statements issued with major allies appear to have deterrence in responding to North Korea's malicious activities, and proposed specifying the criteria and procedures to activate and actively utilize them.
Kim San-ho, Chief of the Security Investigation Command Division at the Korean National Police Agency, emphasized the need to solidify the cybersecurity-related agency cooperation network.
He said, "To effectively respond to North Korea's indiscriminate cyber threats targeting both the public and private sectors, it is necessary to strengthen the cooperative network among related agencies. Now is the time to expand the scope of sharing cyber threat information and technical response methods with related agencies at home and abroad in order to jointly respond to North Korea's cyberattacks."
He also offered opinions on the need for legal and institutional support for cybersecurity. He stated, "Legal and institutional adjustments must be made for immediate and rapid response to cyberattacks ranging from network intrusions and malware distribution to ransomware and generative AI-based attacks."
He added that bold human and material support is needed not only for cybersecurity technology research and development (R&D) but also for strengthening investigative capabilities, including the latest analysis techniques.
Jung Chang-rim, Director of the Information Protection Network Policy Division at the Ministry of Science and ICT, said, "Centered on the National Security Office, the Ministry of Science and ICT, the National Intelligence Service, and other related ministries, along with the public and private sectors, are actively responding to North Korean cyber threats."
He explained that the Ministry of Science and ICT is working to move away from its existing focus on incident prevention and response, and instead to proactively and offensively secure deterrence against cyber threats while strengthening cyber resilience.
He also stressed that the ministry will do its best to prevent and respond to incidents not only in the private sector but also in the public sector.
He also reiterated the "Strategy for Securing Global Competitiveness in the Information Security Industry," which aims to grow the information security industry market to 30 trillion won (about $21.7 billion) by 2027. The strategy, announced by the Ministry of Science and ICT in September of last year, includes: ▲investing a total of 1.1 trillion won (about $800 million) in related budgets to reach a market size of 30 trillion won by 2027 ▲actively fostering security unicorn companies by building a 130 billion won (about $94 million) "cybersecurity fund" by 2027 ▲establishing a zero-trust transition roadmap and distributing Zero Trust Guidelines 2.0, as well as promoting pilot projects to shift the security paradigm in key infrastructure sectors such as telecommunications, finance and healthcare ▲expanding support for global exports through the "K-Security Alliance" to develop an innovative, integrated security model.
Chairman Ha Jae-cheol, summarizing the discussion, said, "North Korea's cyberattacks appear to be focused mainly on acquiring funds for nuclear and missile development. North Korea's cyberattacks are expected to become a major asymmetric capability going forward. We must now establish countermeasures and practice offensive defense — predicting and defending in advance."
He also pointed out that while technical solutions for responding to current North Korean cyberattacks are being actively discussed, discussions on laws, institutions, and policies are needed. This means that policy countermeasures are necessary to respond to attacks. This is understood as a remark with the Basic Cybersecurity Act in mind.
Chair Ha Jae-cheol said, "I think it is time to discuss diplomatic and cooperative measures. North Korea is stealing cryptocurrency internationally and using it for weapons development. It is time for the whole world to respond to North Korea through international coordination and cooperation."
Meanwhile, participants noted that active government support policies are needed to prevent the polarization of cybersecurity capabilities from deepening.
Rep. Park Chung-gwon, who is himself a North Korean defector, testified to the reality of North Korea's hacking education, saying, "When I attended Kim Jeong-eun National Defense University, hacking was covered in the first chapter of the introductory computer engineering textbook. In our classes, they listed types of hacking techniques and taught that the ultimate goal of North Korean hacking was to paralyze a U.S. aircraft carrier strike group. When I heard that, I thought it was probably impossible, but they were teaching the idea that if the hacking succeeded, just a few missiles would be enough to attack the carrier strike group."
He said, "I will work to reflect in policy legislation the opinions of today's participants, who presented the current state of South Korea's cybersecurity system and the direction it should take going forward. Also, while North Korea's intensifying cyberattacks are putting constant pressure on our society, I think this could also be an opportunity for South Korea to leap to the global top in the field of global cybersecurity and to seize the market first. Therefore, I will do my best to fulfill my role in the National Assembly so that South Korea can intensively foster its cybersecurity capabilities."
0 Comments
No comments yet.