S. Korea tracks cyber attack to China, North still suspect

South Korea said Thursday it had sourced a damaging cyber attack on its broadcasters and banks to an IP address in China, fuelling suspicions that North Korea may have been responsible.

Previous cyber attacks blamed on North Korea -- including one last year on the computer network of the conservative JoongAng newspaper in Seoul -- have also been tracked back to Chinese sources.

Internet security analysts in South Korea believe official North Korean hackers learned many of their skills in China and operate from there.

The regulatory Korea Communications Commission (KCC) said Wednesday's attack had used the Chinese IP address to access the targeted computer networks and generate malware that crashed their systems.

"The Chinese IP may trigger various assumptions," said Park Jae-Moon, the KCC director of network policy.

"At this stage, we're still making our best efforts to trace the origin of attacks, keeping all kinds of possibilities open," Park said.

The attack on Wednesday completely shut down the networks of TV broadcasters KBS, MBC and YTN, and halted financial services and crippled operations at three banks, Shinhan, NongHyup and Jeju.

The KCC responded by raising its cyber attack alert to "caution", the third highest level on a five-notch scale.

Under a "caution" alert, the government triples its monitoring workforce and organises a government-wide investigation team to launch on-site inspections.

The Defence Ministry raised its own cyber attack alert, although military networks were not affected.

"For geopolitical reasons, it's convenient for North Korea to use Chinese IP addresses for such attacks," said Choi Yun-Seong, a security expert at the state-run Korea Information Technology Research Institute (KITRI).

"However, domestic and foreign hackers can use them as well, so we cannot say for sure North Korea was behind this," Choi told AFP.

China, North Korea's main patron which has angrily denied being behind a spate of cyber attacks on US interests, said the incident in South Korea showed the importance of a collective response to IT threats.

"China would like to work with other countries based on mutual respect and mutual trust in constructive cooperation in this field," foreign ministry spokesman Hong Lei said on Wednesday.

Wednesday's attack came days after North Korea accused South Korea and the United States of being behind a "persistent and intensive" hacking assault that took a number of its official websites offline for nearly two days.

It also coincided with heightened military tensions on the Korean peninsula, following Pyongyang's nuclear test last month.

In testimony last year to the US congressional Armed Services Committee, the commander of US forces in South Korea, General James Thurman, said North Korea was employing "sophisticated computer hackers" trained in cyber attacks.

"Such attacks are ideal for North Korea" because they can be done anonymously, and "have been increasingly employed against a variety of targets including military, governmental, educational and commercial institutions", Thurman said.

North Korea was particularly blamed for cyber attacks in 2009 and 2011 that targeted South Korean financial entities and government agencies.

Those attacks were so-called distributed denial-of-service attacks (DDoS) which overload a site with data causing it to crash, and are relatively simple to carry out.

Wednesday's coordinated assault was more sophisticated, using malware that can wipe the contents of a computer's hard disk as well as drives attached to or mapped to the infected computer.

The malware then forces the infected computer to reboot, which it cannot do because its files have been wiped, rendering the device useless.

Russian computer security company, Kaspersky Lab, said the style and substance of the attack did not necessarily point to a state actor.

"Obviously, the attacks were designed to be 'loud' -- the victims are broadcasting companies and banks," the company said on its website.

"This makes us think we are not dealing with a serious, determined adversary but hacktivists looking for quick fame," it added.