[Defense Column] If Wireless Hacking Is Breached, National Security Is Also Compromised

[Ryu Gil-ho, Adjunct Professor at Seoul Venture Graduate School] Failure to prepare for wireless hacking can create vulnerabilities in national security. Hacking refers to unauthorized intrusion into someone else's computer through computer communication networks to illegally use, alter, or delete stored information or programs.

The United Nations states that if a Third World War occurs, it could be a cyber war, and no country can remain a sanctuary during such a conflict.

Cyber warfare involves using various cyber attack methods in virtual space through computer networks to disrupt, deny, control, or destroy the enemy's information systems, as well as activities to defend against such attacks. In other words, it is a battle between those trying to breach and those trying to block. Cyber warfare is even defined as the fifth battlefield following land, sea, air, and space.

South Korea has established firewalls, intrusion detection systems, and intrusion prevention systems to prepare against hacking, and has exerted great efforts to counter wired hacking through network separation. However, preparations against recent backdoor attacks, i.e., wireless hacking, remain insufficient.

The United States is putting great effort into countering 'backdoors,' the core of wireless hacking, to the extent of waging a war against Huawei. This movement stems from concerns about sensitive information leaks or malware infections through backdoors such as 'spy chips.'

As the first country in the world to prepare for cyber warfare, the United States has established a cyber force following the army, navy, and air force, forming a four-branch system and viewing all weapon systems from the perspective of cyber warfare. For the U.S., cyber warfare is not a matter of choice but a mandatory domain.

All military operations begin and end with, and always consider, cyber warfare. Operations are planned and executed with this in mind, and systems are built accordingly. It is no exaggeration to say that the success or failure of physical operations depends on the level of preparation for cyber warfare.

South Korea has been invaded over 900 times but has never been the first to invade another country. While some argue this is because the nation pursues peace and loves humanity, the fact that it has suffered countless invasions is itself shameful. Being invaded means there was insufficient preparation. National security is the most important mission assigned to the state because it protects the lives and property of its citizens. Without prior preparation, enormous damage is inevitable.

Since the 2000s, South Korea has experienced large-scale cyber intrusion incidents almost every year. These include the 2003 Internet crisis, the 2009 DDoS incident, the 2011 DDoS and NongHyup hacking incidents, the hacking of the Central Election Commission website, the 2012 KT personal information leak, the 2013 server damage of six broadcasting and financial companies including KBS, MBC, YTN, and NongHyup, website tampering of the Blue House and the Office for Government Policy Coordination, the 2014 personal information leak of three credit card companies, destruction of hard disks at Korea Hydro & Nuclear Power, the 2015 BboomBbo incident, the 2016 Ministry of National Defense network intrusion, the 2017 Nayana ransomware attack, the 2017-2018 cryptocurrency exchange thefts, and the Korail hacking incident. The sheer number of these incidents is embarrassing to list. These are also tantamount to invasions.

Conflicts in cyberspace are invisible. Even if money is stolen, only the numbers in bank accounts disappear; the physical currency in one’s pocket does not vanish, so individuals may not feel the damage acutely. Even if important national secrets fall into enemy hands or personal information is sold abroad for a mere 5 won, the impact is not strongly felt. This likely contributes to the slow response and prevention activities in cyberspace.

The saying "locking the barn after the horse is stolen" is akin to establishing defense plans after hacking damage in the era of the Fourth Industrial Revolution. Otherwise, the horse will be lost, and only regret will remain. One should not complacently think that since a thief took one horse, they will be satisfied and not return. A thief who has found a way will always look for the owner’s negligence to come back and steal another horse.

The same applies to hacking damage. Once a path is breached, it is easy to breach again, and sometimes the breach is not even detected. Cyber warfare is a battle between those trying to breach and those trying to block in cyberspace. North Korea prepares for such cyber warfare by producing about 300 hackers annually who operate based in major Chinese cities.

So, how prepared is South Korea for cyber warfare? Recently, a core national institution responsible for managing the people's tax money introduced the country's first-ever continuous detection system against wireless hacking. However, most government agencies hesitate to adopt such systems due to budget constraints and lack of damage cases.

It is now necessary to pay special attention to government ministries and critical national facilities because the lives and safety of citizens are directly involved. To this end, illegal wireless data continuous monitoring devices should be installed in major computer facilities, and a 24/7 integrated management and control system should be established. Such a system would be effective if it allows administrators to take immediate action upon detecting abnormal signs through wireless data monitoring devices.