North Korea's Internet Disrupted by Coordinated DDoS Attacks
Multiple waves of distributed denial-of-service (DDoS) attacks rendered over 40 North Korean state websites, including the Ministry of Foreign Affairs, unreachable for approximately 32 hours.
North Korea's public internet services experienced a significant disruption this week, with multiple waves of distributed denial-of-service (DDoS) attacks rendering over 40 state-controlled websites inaccessible. The outage, which lasted for approximately 32 hours, affected prominent sites such as the Ministry of Foreign Affairs and the Korean Central News Agency, impacting users attempting to access the .kp domain.
Analysis by Kentik, a network intelligence firm, indicated that the disruptions were caused by sudden and substantial traffic floods originating from IP addresses in Vietnam and Venezuela. These traffic surges began around 02:01 UTC on October 20th, overwhelming North Korea's internet infrastructure and preventing legitimate users from accessing its online services. While the origin countries of the traffic are known, the specific threat actors behind the coordinated attacks remain unidentified.
Doug Madory, director of internet analysis at Kentik, observed that the traffic patterns suggested several distinct waves of attack rather than a single continuous surge. This observation helped confirm the nature of the incident as a DDoS attack, a common method used to disrupt online services by flooding target systems with an overwhelming amount of traffic. The timing of these traffic spikes closely correlated with the reported website failures, providing strong evidence for the DDoS attribution.
During the outage, network routing paths for North Korea's internet traffic also exhibited notable changes. Madory's observations highlighted shifts in how traffic was being transited, with certain network blocks moving between providers. For instance, the 175.45.176.0/24 network block, which contains name servers crucial for the .kp domain, reportedly moved from a provider identified as Cenbong to Russia's Transtelecom (TTK). Such routing changes can sometimes be an attempt to mitigate the impact of attacks, though it is unclear if this was the deliberate intention in this case.
The incident underscores the vulnerability of even isolated internet infrastructures to sophisticated, externally launched attacks. While initial speculation considered power or telecommunications faults, Kentik's traffic data provided direct evidence pointing towards a deliberate DDoS campaign. The exact tools, peak traffic volumes, and specific methods employed by the attackers are not yet known, leaving the full scale and technical details of the operation unresolved.
This event serves as a reminder of the importance of robust network monitoring and traffic analysis in identifying and attributing cyber incidents. The ability to correlate traffic measurements with service availability is crucial for understanding the nature of attacks, especially when direct attribution of threat actors is challenging. The incident also highlights the potential for widespread disruption even when specific vulnerabilities are not exploited, relying instead on overwhelming network capacity.
While the attackers' identities and motivations remain unclear, the coordinated nature and scale of the DDoS attacks demonstrate a significant capability to disrupt state-level internet services. The incident's resolution, with services gradually returning to normal, marks the end of a prolonged period of digital isolation for North Korea's public-facing websites.