SEOUL, South Korea The hackers who knocked out tens of thousands of South Korean computers simultaneously this year are out to do far more than erase hard drives, cybersecurity firms say: They also are trying to steal South Korean and U.S. military secrets with a malicious set of codes they've been sending through the Internet for years.
The identities of the hackers, and the value of any information they have acquired, are not known to U.S. and South Korean researchers who have studied line after line of computer code. But they do not dispute South Korean claims that North Korea is responsible, and other experts say the links to military spying add fuel to Seoul's allegations.
Researchers at Santa Clara, California-based McAfee Labs said the malware was designed to find and upload information referring to U.S. forces in South Korea, joint exercises or even the word "secret."
McAfee said versions of the malware have infected many websites in an ongoing attack that it calls Operation Troy because the code is peppered with references to the ancient city. McAfee said that in 2009, malware was implanted into a social media website used by military personnel in South Korea.
"This goes deeper than anyone had understood to date, and it's not just attacks: It's military espionage," said Ryan Sherstobitoff, a senior threat researcher at McAfee who gave The Associated Press a report that the company is releasing later this week. He analyzed code samples shared by U.S. government partners and private customers.
McAfee found versions of the keyword-searching malware dating to 2009. A South Korean cybersecurity researcher, Simon Choi, found versions of the code as early as 2007, with keyword-searching capabilities added in 2008. It was made by the same people who have also launched prior cyberattacks in South Korea over the last several years, Choi said.
Versions of the code may still be trying to glean military secrets from infected computers. Sherstobitoff said the same coded fingerprints were found in an- the anniversary of the start of the 1950-53 Korean War - in which websites for South Korea's president and prime minister were attacked. A day later the Pentagon said it was investigating reports that personal information about thousands of U.S. troops in South Korea had been posted online.
Sherstobitoff began his investigation after the March 20 cyberattack, known as the Dark Seoul Incident. It wiped clean tens of thousands of hard drives, including those belonging to three television networks and three banks in South Korea, disabling ATMs and other bank services. South Korea says no military computers were affected by Dark Seoul.
The code used in the shutdown is different from that used to hunt for military secrets, but they share so many characteristics that Sherstobitoff and Choi believe they were made by the same people.
Sherstobitoff said those responsible for the spying had infected computers by "spear phishing" - targeted attacks that trick users into giving up sensitive information by posing as a trusted entity. The hackers hijacked about a dozen obscure Korean-language religious, social and shopping websites to make it easier to pull secrets from infected computers without being detected.
The McAfee expert said the hackers have targeted government networks with military information for at least four years, using code that automatically searched infected computers for dozens of military terms in Korean, including "U.S. Army," ''secret," ''Joint Chiefs of Staff" and "Operation Key Resolve," an annual military exercise held by U.S. Forces Korea and the South Korean military.
The report does not identify the government networks that were targeted, but it does mention that in 2009, the code was used to infect a social media site used by military personnel living in South Korea. McAfee did not name the military social media site, nor release what language it is in, at the request of U.S. authorities who cited security issues. South Korea has a military force of 639,000 people, and the U.S. has 28,500 military personnel based in the country.
McAfee also said it listed only some of the keywords the malware searched for in its report. It said it withheld many other keywords that indicated the targeting of classified material, at the request of U.S. officials, due to the sensitivity of releasing specific names and programs.
"These included names of individuals, base locations, weapons systems and assets," said Sherstobitoff.
Choi, who works for a South Korean cybersecurity company, has made similar discoveries through IssueMakersLab, a research group he and other "white-hat" hackers created.
Results of a report Choi produced were published in April by Boan News, a Seoul-based website focused on South Korean security issues, but they did not get broad attention. That report included many search terms not included in the McAfee report, including the English-language equivalents of Korean keywords.
Both McAfee and IssueMakersLab found that any documents, reports and even PowerPoint files with military keywords on infected computers would have been copied and sent back to the attackers.
The attackers are also able to erase hard drives en masse by uploading malware and sending remote-control commands, which is what happened March 20.
Before that attack, hackers had been sending spy malware on domestic networks for months, giving them the ability to gather information about how their internal servers work, what websites the users visit and which computers are responsible for security, the researchers found. This information would have been crucial for planning the coordinated attacks on banks and TV networks.
Anti-virus software and safe practices such as avoiding links and attachments on suspicious emails can prevent computers from getting infected, but the March attack shows how difficult this can be to accomplish on a broad scale. Ironically, some of the malicious codes used were disguised as an anti-virus product from Ahnlab Inc., South Korea's largest anti-virus maker, said McAfee.
McAfee said it shared its findings with U.S. authorities in Seoul who are in close collaboration with South Korean military authorities.