Category: DPRK Government

Bureau 121 hackers operating in China says defector

Posted on by

In the northeastern Chinese city of Shenyang, you’ll find businesses owned and operated by the North Korean government.

You’ll also find a secret network of North Korean hackers, known as Bureau 121, according to defector Kim Heung-Kwang.

“It’s easy for them to work secretly. It also has great Internet infrastructure,” says Kim Heung-kwang, a former Pyongyang computer science professor who escaped North Korea in 2004. Kim says some of his own students became cyber warriors for the hacker network. “By day, they worked regular jobs. But the rest of the time, they were acting on orders from Pyongyang,” he says.

Kim claims North Korean hackers operated secretly in Shenyang for years, moving from location to location to conceal their whereabouts and activities. “Bureau 121 began its large-scale operation in China in 2005. It was established in the late 90s,” Kim says.

“Team members entered China separately — in smaller groups — 20 members at a time,” he says. “When they entered China, they came under different titles. For example an office worker, an official with a trade company or even as a diplomatic staffer.”

Long before North Korea had its own Internet, it dialed in to servers in Shenyang, in Liaoning Province, in the country’s north. Today, nearly all of North Korea’s Internet traffic is still routed through China.

Kim says the operation in China scaled back considerably a few years ago, when North Korea expanded its high speed Internet access. But he believes hackers are still operating in Shenyang.

“North Korea does have illicit activities in China,” says Steve Sin, a terrorism expert at the University of Maryland and former U.S. military intelligence analyst. Sin wrote a report naming Shenyang as a North Korean hacker hub. “It has the location, security, as well as infrastructure,” Sin says.

“Right now, the best information available to us is that they are still conducting such an operation and they can still conduct such an operation from that location.”

[CNN]

Chinese annoyance with North Korea bubbles to the surface

Posted on by

When a retired Chinese general with impeccable Communist Party credentials recently wrote a scathing account of North Korea, as a recalcitrant ally headed for collapse and unworthy of support, he exposed a roiling debate in China about how to deal with the country’s young leader, Kim Jong-un.

For decades China has stood by North Korea, and though at times the relationship has soured, it has rarely reached such a low point, Chinese analysts say. The fact that the commentary by Lt. Gen. Wang Hongguang, a former deputy commander of an important military region, was published in a state-run newspaper and then posted on an official People’s Liberation Army website attested to how much the relationship had deteriorated, the analysts say.

“China has cleaned up the D.P.R.K.’s mess too many times,” General Wang wrote in The Global Times. Of the government in North Korea, he said: “If an administration isn’t supported by the people, ‘collapse’ is just a matter of time.” Moreover, North Korea had violated the spirit of the mutual defense treaty with China, he said, by failing to consult China on its nuclear weapons program, which has created instability in Northeast Asia.

A Chinese official who is closely involved in China’s diplomacy with North Korea said that General Wang’s disparaging attitude was more prevalent in the Chinese military today than in any previous period. “General Wang’s views really reflect the views of many Chinese—and within the military views are varied,” said the official, who declined to be named because of the sensitivity of the matter.

[NY Times]

The cold relationship between China and North Korea

Posted on by

The last time a Chinese leader visited North Korea was in July 2013 when Vice President Li Yuanchao tried to patch up relations, and pressed North Korea, after its third nuclear test in February 2013, to slow down its nuclear weapons program. Mr. Li failed in that quest.

After the vice president’s visit, relations plummeted further, entering the icebox in December 2013 when China’s main conduit within the North Korean government, Jang Song-thaek, a senior official and the uncle of Kim Jong-un, was executed in a purge.

In July, President Xi Jinping snubbed North Korea, visiting South Korea instead. Mr. Xi has yet to visit North Korea, and is said to have been infuriated by a third nuclear test by North Korea in February 2013, soon after Kim Jong-un came to power.

A heightened debate in China is spurred in part by fears that North Korea could collapse even though economic conditions in the agriculture sector seemed ready to improve, several Chinese analysts said. Indeed, one of the tricky balancing acts for China is how much to curtail fuel supplies and other financial support without provoking a collapse that could send refugees into China’s northeastern provinces, and result in a unified Korean Peninsula loyal to the United States.

“If China presses D.P.R.K. too hard it could collapse,” Zheng Jiyong, director of the Center for Korean Studies at Fudan University, said. “But if it doesn’t press hard enough it will become uncontrolled and do more things like nuclear tests.”

[NY Times]

Jong Un’s sister marries son of top North Korean official

Posted on by

The sister of North Korean leader Kim Jong Un has married the son of one of the country’s most powerful officials, Yonhap news agency reported on Friday, citing unnamed sources.

north-korean-kim-yo-JongKim Yo Jong, who is 27 or 28, was said by state media late last year to have assumed a senior position in the ruling Workers’ Party. She is the only other member of the ruling Kim family known to have an official job within the government.

“As far as I know, Kim Yo Jong, deputy director of the Workers’ Party, got married to a son of the party secretary Choe Ryong Hae,” the South Korean news agency quoted a China-based source as saying.

A second source identified Kim Yo Jong’s husband as Choe’s second son, Choe Song, Yonhap reported.

The senior Choe is a high-ranking member of the ruling Workers’ Party widely seen as a close confidant of Kim, the isolated country’s third-generation leader.

Kim Yo Jong was seen wearing what appears to be a wedding ring in a photo released by the reclusive North’s official KCNA news agency on Friday.

[Reuters]

The effect of sanctions on North Korea

Posted on by

Experts believe that sanctions on North Korea were likely to have little effect—which is already under several international penalties.

“How do you sanction the world’s most heavily sanctioned country?” said John Park, a Northeast Asia specialist at Harvard Kennedy School, adding that “every time you apply sanctions to a target, it forces them to innovate and get around sanctions.”

Other experts had suggested in December that the U.S. government might be able to hurt the regime in Pyongyang by attacking its international exposure—either those foreign firms operating in North Korea, or North Korean entities operating abroad.

This may account for the sanctioning of some of the officials with business ties to other countries, including Kil Jong Hun and Kim Kwang Yon, who the Treasury described as representing “the southern African interests of KOMID.”

Sanctioned groups include intelligence organization Reconnaissance General Bureau, Korea Mining Development Trading Corporation (which the Treasury called the country’s “primary arms dealer and main exporter of goods and equipment related to ballistic missiles and conventional weapon”), and defense industry-focused Korea Tangun Trading Corporation.

“The financial portion is what hurts them the most,” Jack Pritchard, who served as U.S. ambassador and special envoy for negotiations with the Democratic People’s Republic of Korea from 2001 to 2003.

[CNBC]

US sanctions North Korea

Posted on by

President Obama has signed an executive order imposing new sanctions on North Korea following last month’s cyber-attack on Sony Pictures Entertainment.

In issuing the order, Obama accuses North Korea of “destructive, coercive cyber-related actions during November and December,” calling them a “continuing threat to the national security, foreign policy and economy of the United States.”

The order authorizes the Treasury Department to shutdown access to the U.S. financial system, prohibiting transactions and freezing assets, for specific North Korean officials and entities and anyone who supports them.

The Obama administration has identified more than a dozen targets of the sanctions – 3 North Korean agencies and 10 individuals – including the country’s primary intelligence agency that the administration believes runs their “major cyber operations.”

[ABC]

Kim Jong Un indicates openness to summit with South Korea

Posted on by

North Korean leader Kim Jong Un said in New Year’s speech Thursday that he is open to more talks with Seoul or even a summit with his South Korean counterpart, but stressed North Korea will continue to strengthen its military amid an atmosphere of distrust and tension while trying to diversify its economy and raise the national standard of living.

Kim’s call for improving inter-Korea relations comes as Pyongyang is facing heightened criticism over its human rights record and souring ties with Washington over allegations it was involved in the massive hacking attack on Sony Pictures. (North Korea has denied involvement, but said the hack was a “righteous deed” and suggested it might have been carried out by sympathizers or supporters abroad.)

“We believe we can resume suspended senior-level talks and hold other talks on specific issues if South Korea sincerely has a position that it wants to improve North-South relations through a dialogue,” Kim said in the nationally televised speech. “And there is no reason not to hold the highest-level talks if the atmosphere and conditions are met.”

Meeting such conditions has proven to be virtually impossible in the past. The two countries have not held a summit since 2007 and, despite Kim’s remarks, the likelihood of one happening again soon is very low given the deep distrust that remains between the two countries.

[Associated Press]

Internet service restored in North Korea

Posted on by

After more than nine hours and 30 minutes, Internet service has been restored in North Korea, according to technology news service Dyn Research. Access is only partial, Reuters reports, but the country’s main news service and newspaper both are back online.

North Korea’s Internet went offline days after President Obama pledged a “proportional response” to the communist country’s alleged hacking of Sony Pictures, multiple news reports say.

Doug Madory, the director of Internet analysis at Dyn Research, told The New York Times and other news organizations that North Korea’s Internet access became unstable late Friday. By Monday, it was offline, he said.

It’s unclear what caused the outage, but State Department spokeswoman Marie Harf said: “We aren’t going to discuss publicly operational details about the possible response options or comment on those kind of reports in any way except to say that as we implement our responses, some will be seen, some may not be seen.”

In an interview with NPR’s Elise Hu, Matthew Prince, chief executive of CloudFlare, pointed to four possible scenarios: North Korea turned off its own Internet; China’s upstream provider turned it off; the country’s routers failed at an unfortunate time; or it was the result of a denial-of-service attack from either a hacking group or the U.S.

[NPR]

What military chiefs worry about at night

Posted on by

Shortly before he retired as chairman of the Joint Chiefs of Staff, I asked Adm. Mike Mullen what he saw on the ceiling on nights when he couldn’t sleep.

“Cyber,” he said.

That was 2011 and this is 2014, and it seems that Mullen’s ceiling has been moved to Sony Corp., which has been hacked, maybe by North Korea, and nobody seems to be able to do anything about it.

–Richard Cohen, Washington Post columnist

The cyber army of North Korea Bureau 121

Posted on by

Somewhere deep inside North Korea is a cell of sophisticated cyber warriors known as Bureau 121. It is suspected to have carried out a series of other attacks against South Korean companies, and also possibly against Sony more recently. Cybersecurity researchers have said the Sony breach is similar to an attack against South Korean media and financial institutions last year that was attributed to North Korea.

A North Korean defector, Jang Se-yul, told Reuters that Bureau 121 consists of roughly 1,800 hackers, who live a relatively pampered life as elites in the country’s military.

“For them, the strongest weapon is cyber. In North Korea, it’s called the Secret War,” Jang told Reuters. But while members of Bureau 121 are reportedly handpicked from the reclusive nation’s technical university programs, the rest of the country is largely cut off from the online world outside of North Korea.

Given the increasingly digital nature of warfare in the world, it makes economic sense for North Korea to pour resources in entities such as Bureau 121. On the digital battlefield attackers have a distinct advantage. For hackers to win, they only need to breach a system once, while defenders must deflect each and every attack to be successful.

“Cyber warfare is an important asymmetric dimension of conflict that North Korea will probably continue to emphasize— in part because of its deniability and low relative costs,” Gen. Curtis Scaparrotti, the commander of United States Forces Korea, testified.

An Hewlett-Packard Security Briefing from earlier this year said, “North Korea’s hermit infrastructure creates a cyber-terrain that deters reconnaissance. Because North Korea has few Internet connections to the outside world, anyone seeking intelligence on North Korea’s networks has to expend more resources for cyber reconnaissance.”

[Washington Post]