GWACHEON, South Korea (AP) - South Korean investigators on Tuesday blamed rival North Korea for a cyberattack last month on dozens of South Korean media and government websites, including those of the president and prime minister.
The biggest piece of evidence linking Pyongyang to the attacks on June 25, which marked the 63rd anniversary of the beginning of the Korean War, was a North Korean Internet protocol address found in some of the websites and malicious codes, South Korea's Ministry of Science said.
Investigators said North Korea was found responsible after an analysis of Internet addresses, access logs and 82 malicious codes found in the attacked servers, computers and websites.
Last month's attack was the latest of several that South Korea has blamed on North Korea since 2009, including an attack on South Korean broadcasters and banks in March.
Pyongyang has rejected previous accusations and has blamed the United States and South Korea for a cyberattack, also in March, that shut down its websites for two days. There was no immediate comment from North Korea's state media on Tuesday's accusation.
The South Korean government-led team of investigators said the June online assaults, which hit 69 government and private companies' websites and servers, were planned for at least six months. Part of that planning included hacking file-sharing websites in South Korea.
One of the investigators declined to disclose how the attackers hacked the presidential website because other hackers may mimic the attack. But he said the attackers employed a variety of methods to launch the attack and one of them was to make computers automatically send a massive amount of traffic to a targeted website when a user downloaded a malicious code from a file-sharing site. This type of offense of shutting down a website by incurring huge traffic is called DDoS attack, or distributed denial of service.
The fact that attackers were preparing cyberattacks months ahead of time raises questions about whether authorities failed to detect early warning signs. Officials could have detected a problem if someone had discovered the file-sharing hacking, but no one did, even while authorities were investigating the March 20 cyberattacks that shut down tens of thousands of computers at South Korean broadcasters and banks.
Chun Kilsoo, director of the government-run Korea Internet Security Center, told reporters in a briefing that the evidence investigators have collected so far points to North Korea. In response to criticism about officials not detecting the June attack preparations, Chun said it was difficult to spot ahead of time because the targets of the March and June attacks were different.
Chun said the attackers tried to steal personal information from the websites targeted in the June 25 cyberattacks. He said investigators could not find out whether that information was stolen during hacking preparations before the attack or during the attack itself.
Local media reported the personal information of hundreds of thousands of people was stolen from the presidential office's website and the ruling party.
Investigators managed to recover data on the hard drives that the attackers destroyed June 25 and found an Internet protocol address that was used by North Korea.
The attackers in June tried to hide their identities by destroying hard drives and hiding the Internet protocol addresses they used, the ministry said. The attackers also tried to mislead investigators by using the picture of a global hacking collective called Anonymous, the ministry said.