North Korea experienced significant disruptions to its public internet services this week, as a series of distributed denial-of-service (DDoS) attacks took major state-run websites offline. The incidents highlight vulnerabilities within the nation’s digital infrastructure.
Details of the Disruption
The internet analysis director at Kentik, Doug Madory, connected the outages to a surge in traffic originating from countries such as Vietnam, the Philippines, and Venezuela. The influx of data began on October 20 at 02:01 UTC, rendering North Korea’s websites inaccessible.
Over 40 websites utilizing the .kp domain were impacted, including key sites like the Ministry of Foreign Affairs and the Korean Central News Agency. The disruption persisted intermittently for approximately 32 hours, with services reportedly stabilizing by 7 p.m. local time on October 21, following multiple downtimes and brief recoveries.
Analysis of Attack Patterns
According to Doug Madory’s public findings, the attack involved several waves of high-volume traffic rather than a single, continuous assault. This pattern strongly suggested a coordinated DDoS attack aimed at overwhelming targeted websites and blocking legitimate user access.
Despite identifying the traffic sources, the specific individuals or groups responsible for the attacks remain unknown. Kentik’s analysis did not pinpoint the command-and-control elements behind these traffic surges, which may be linked to compromised devices in various locations.
Network Changes and Implications
Madory also observed notable changes in North Korea’s network routes during the incident. The 175.45.176.0/24 network block, critical for .kp domain name servers, experienced transit shifts from Cenbong to Russia’s Transtelecom and back.
These routing adjustments could indicate attempts to mitigate the attacks’ effects, although intentionality remains unconfirmed. Initial theories proposed power or telecommunications issues, but subsequent traffic analysis supported the DDoS hypothesis.
While the precise attack methods and scale have yet to be determined, the correlation between traffic spikes and service failures underscores the need for comprehensive traffic monitoring in outage investigations. Strengthening defenses against emerging threats is crucial for preventing similar situations in the future.
