2010 Japan–South Korea cyberwarfare

On February 23, 2010, members of DC Inside, Humoruniversity, Ruliweb, Daum Truepicture, todayhumor, and various other Korean online communities formed the Terror Action Association (TAA) (Korean: 정당한 테러대응연합'은). On March 1, 2010, they attacked the Japanese website 2channel. It coincided with the 100th anniversary of the Japan-Korea Treaty of 1910. Since 2004, DC Inside and 2ch have had numerous conflicts, both large and small.[1]

Summary

On February 23, 2010, users on 2chan (2channers) made offensive comments about a Korean international student that was beaten to death in Russia in the winter of 2009. “Dog died, why is it on the news?”, “Kill more!”, and other remarks were made. A few days prior, the Korean figure skater Yuna Kim won the gold medal in the 2010 Vancouver Winter Olympics, and 2channers asserted that officials must have been bribed.

These expressions from 2chan flowed into DC Inside's Humor Program Gallery.[2] DC Inside and HumorUniversity (Korean web communities) agreed that the date of the attack should be March 1, 2010, and began recruiting from other online communities such as Today's Humor, Ruliweb, Daum.net. They formed the Terror Action Association, amassing more than 102,000 participants in a day.[3][4][5]

On 1 PM of March 1 (GMT+9), the TAA vandalized 2chan's galleries and executed a massive DDoS attack by paralyzing 2chan's servers.[6]

According to Pacific Internet Exchange, who were hosting 2chan's servers, Japanese servers were already experiencing increased volume of requests from Korea facilitated by bots since 11:40 AM. Other websites affiliated with 2chan were also affected by the attack.

On the evening of March 1, 2chan servers were suspended and IP addresses from all sources of attacks were blocked.

On March 2, damages were estimated to be above $2.5 million. Mainly 2chan's “Korea Slander Gallery", "VIP Gallery", "Breaking News Gallery" were targeted.[5]

Timeline and the aftermath

On February 24, Korean online communities noticed a series of posts on the Japanese website 2chan regarding Yuna Kim, a Korean figure skater, and the Korean international student that was murdered in Russia. Korean online communities claimed that 2chan members were accusing Yuna Kim of bribery and finding delight in the murder of the Korean student in Russia. An internet community, Terror Action Association was formed with the objective of carrying out a cyberattack on 2chan on March 1, 2010. Although the TAA prohibited the distribution or the use of illegal software, members continuously distributed illegal software leading up to the day of the attack.

On February 25, around midnight, Japanese posts appeared on DC Inside's comedy gallery and its users claimed that the servers had slowed down, and interpreted these as signs of a preemptive attack from 2chan.[7] Korean appeared on 2chan's Korean threads as well, however Japanese did not appear on 2chan's Korean galleries.[8] In a few minutes, the DC Inside servers returned to their usual speeds.

On February 26, attacks were carried out on 2chan's Yaoi forum. During the Figure Skating Short Program of the Vancouver Olympics that took place a few days before the attack, Yuna Kim took the lead over Mao Asada by meagre 5 points and won the gold medal. 2channers suggested that Yuna Kim won the gold medal through bribery. However, whether this attack really originated from Korean users is unclear because the vandalism that appeared on 2chan's website did not contain any Korean but only English phrases such as “I’m Korean.”

On February 28, a committee of 2channers scheduled two rounds of attacks on DC Inside at 8 PM and 9 PM within 30 minute windows. These attacks proved to be ineffective. The upcoming cyber war began attracting attention from the press.

1 PM on March 1, the TAA began the attack in two teams – one team vandalized the website, the other team carried out a DDoS attack.[2] 1:03 PM, only three minutes after the initiation of the attack, 2chan's VIP gallery was paralyzed. 1:13 PM, five servers were paralyzed. 1:16 PM, the main channel's login requests started to get effected. 1:22 PM, all but two of the thirty-three 2chan servers were all paralyzed. 1:44 PM, the entire server was down.[2] 2:13 PM, 2chan's main page was hacked and replaced with a page containing the Korean flag.[2] 2:43 PM, naver.com blocked Japanese IPs. 3:35 PM, 2chan blocked Korean IPs, however the servers were not yet restored.

A Korean student in Japan spied on the Japanese plans for retribution. At 6 PM, it was discovered that a website had plans for attacking the Blue House website. However, some Koreans who disliked Lee Myung Bak (Korean President at the time of the attack) participated in this attack. The Blue House shortly blocked Japanese IPs. 6:11 PM, VANK homepage started receiving attacks and was paralyzed for about 1 hour but was soon restored. It has been rumored that some of VANK's routers exploded from the attack. 6:38 PM, attacks on Comedy Program Gallery began, but the attacks were deflected in four minutes. 8:43 PM, organizers from 2chan declared the end of the attacks. 9:35 PM, 2chan had been effectively downed for 8 hours, and MBC reported on the outcome.[2]

Around 6 PM of the following day, the servers began to restore (At 8 PM, most of the servers were running normally). At 7 PM, another attack on VANK was made without success, and prompted a retribution attack from TAA, downing the control server of 2chan. Around 8 PM, attacks were again initiated by 2ch, but failed. 10 PM, VANK blocked all Japanese IPs.

On March 5, 2ch provisionally suspended attacks and promised to strike on August 15. On August 15, the attacks were announced but the day passed by without offense from either side. A Korean gaming portal was downed this day but it was confirmed this was not an attack from Japan. A lot of fingers were pointed, including at China, at business establishments, and some speculated that it was an inside job by DC Inside. The Japanese Wiki article on this topic claims that VANK had a main role in this attack.

Outcome

Connecting to 2chan was impossible in the morning of March 1 until the evening of March 2nd when the attacks shrank and a portion of the servers partially recovered.[9][10] The next day, about a third of the servers were restored, and by the evening all but the Dubai server were completely restored. The Dubai server was never completely restored due to damage, and according to 2chan administrators, the recovery of data on the Dubai server was difficult and it was stated that the gallery would be opening on a different server.[11]

The webpages of VANK and the Blue House were slowed down due to the attacks. There were reports that routers at VANK exploded, however, VANK had merely blocked Japanese IPs.

Reactions and Responses
  • Pacific Internet Exchange, the managing company of 2chan's servers, declared on March 2 that they were preparing to investigate this event as a cyber-terrorism attack in collaboration with USA's Federal Bureau of Investigations (FBI),[12] by collecting and analyzing data related to this attack. However, the investigation was not actually carried out. This cyberwarfare collaterally impacted some US agencies. Management of Big-server.com stated that a German who enforced cyberattacks was arrested in the US and sentenced to two years. However, it was later confirmed that this scenario was fantasized by 2chan users, and a US journalist had picked up on this and published an article without checking the details. Because the FBI investigates activity that occurs within the United States, it is unlikely that they have actually investigated this cyberwar. CIA, on the other hand, may investigate this cyberwar in collaboration with South Korean or Japanese intelligence agencies, police forces, etc., with the approval of ministries on both ends (Japan has no official collective intelligence agency, instead there are intelligence clusters such as the Chief Cabinet Secretary's intelligence investigators, the Ministry of Justice's Public Inspection Agency, National Police Agency Security Bureau, and the Defense Agency).[13][14][15]
  • The head of Voluntary Agency Network of Korea (VANK) stated, “Japan has hurt their own reputation in the eyes of the international society”, “Inflicting F5 attacks is no different than what Japan did. We must ignore them.”[16]
  • JoongAng Daily– Editorials criticized both the way that Japanese netizens reacted to not winning the gold medal, as well as the way Korean netizens similarly reacted to the Japanese netizens.[17]
  • Korea Communications Commission stated that they are obtaining a holistic profile of this case and preparing measures. They stated “We are worrying about how to protect [Korean] netizens if this case evolves into a dispute between the two countries.”[18]
  • Matsumoto Tetsujo, representative of the SoftBank Group, recorded on his blog that “If Japanese right-wing truly has ability and the sense of duty for the country, and if there is a site with anti-Japanese sentiments, whether it is Korean or Chinese, why don’t they also try gathering total power and launching a multi-scale assault just like the Koreans?”[19][20]

References
  1. "한국 네티즌 일본 사이트 공격". www.dt.co.kr.
  2. Yu Kim (2010-03-01). "Epic Cyber War (Full Story): Japan V.S Korea". Archived from the original on 2010-03-12. Retrieved 2015-08-02.
  3. 한·일 누리꾼, '3.1절 사이버 전쟁', YTN
  4. "한일양국에서〈삼일절 사이버 전쟁〉 움직임 김연아 비방 사이트 狙い 국내 넷 유저〈오늘 대대적 공격〉". 중앙일보. 2010-03-01. Retrieved 2010-03-02.
  5. "김연아를 비방한 일본의 사이트가 다운". 중앙일보. 2010-03-02. Retrieved 2010-03-02.
  6. "韓 네티즌, 한국 비방 日사이트 2ch 공격 초토화". 맥스무비. 2010-03-01.
  7. "20100225002408.jpg (730x600 pixels)". Archived from the original on 12 July 2012. Retrieved 19 March 2019.
  8. "20100225005031.jpg (642x500 pixels)". Archived from the original on 11 July 2012. Retrieved 19 March 2019.
  9. "(cache) Graph: 2chtotal" (in Japanese). 2010-03-03.
  10. "(cache) ２ちゃんねる サーバ負荷監視所". 2010-03-02.
  11. "２ちゃんねる復活への奇跡の軌跡". ula.cc. Archived from the original on 2010-03-04. Retrieved 2015-08-02.
  12. "2chサーバのデータセンター、「サイバーテロ」として米機関に調査依頼へ". ITmedia NEWS.
  13. 2ちゃんねる攻撃で米企業がFBIと法的措置検討　損害2億2千万円 Archived 2011-01-08 at the Wayback Machine 産経新聞 2010.3.2閲覧
  14. "2ちゃん攻撃は国際犯罪 FBIが首謀者割り出し捜査へ : J-CASTニュース". J-CASTニュース. 2010-03-03.
  15. "Men indicted over cyber attacks". Channel 4.
  16. 반크 박기태 단장 “한일 사이버전쟁, 결국 제살깎아먹기” Archived 2010-03-05 at the Wayback Machine 민일보 《쿠키뉴스》, 2010년 03월 02일
  17. (in Japanese) 【社説】日本ネチズンの行きすぎた行動…勝った私たちが負けよう 중앙일보 일어판, 2010년 3월 3일
  18. 한·일 사이버대전 FBI 손으로 Archived 2015-09-24 at the Wayback Machine, 《경제투데이》
  19. "아고라 : 사이버테러의 문제 - 마쓰모토 데쓰조". Retrieved 2010-03-20.
  20. "松本 徹三- SBI Business 公式プロフィール". Retrieved 2010-03-20.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.