South Korean election systems may be vulnerable to attacks from North Korean threat actors. According to the NIS (National Intelligence Service) Report today (Tuesday 10th October 2023), there is a necessity for the North Korean government to fortify its election systems ahead of the incoming general election next-year (2024).
As revealed by the Korean Herald, a high-stakes press briefing held by the NIS unveiled shocking cybersecurity findings. The election watchdog had unwittingly weathered targeted and successful cyber assaults from North Korea, all while remaining oblivious to the breach.
The cybersecurity team of the NIS, gave an analysis which shows that the election service systems responsible for collating the votes and storing the voting data were unable to thwart off simulated cyberattacks. In a discovery from the mock test (simulated cyber-attacks), it was discovered that vote counting could be manipulated and outcome (results) can be influenced by the threat actors.
Accredited voters who have voted could be circumvented, and enabling them to cast their votes multiple times. As at the time this report was made, it still remains a mystery if past election results have been influenced or not.
However, The Deputy Director of NIS Bae Jong-Wook disclosed to reporters saying:
“Our Security screening revealed that the vulnerabilities exist, but whether such vulnerabilities had actually been exploited by outside hackers, is a different story.”
In a further opinion, he stated that over a period of 12-weeks security screening conducted, the NIS were unable to prove if the system has been accessed in time past by malicious hackers, to influence electoral outcomes.
He said:
“The tools used in the previous elections have been replaced, and the log files of past activities erased.”
Reports and findings by the NIS, indicated that the election services failed to adhere to the best security practises and various flaws which includes (unverified contractors gaining access to internal systems, and leaving passwords unchanged on devices) were discovered.
It was also discovered that on two different occasions, the account of senior-level official at the organization was breached by threat actors from North Korea.
According to reports the Electoral body and services organizing the elections nationwide rejected third-party cybersecurity investigations, citing their independence to be the bone of contention for such decision. However, they agreed to the NIS-led screening, that uncovered the weakness that exist in the system.
Sometime in May 2023, the National Assembly of South Korea, received a report that their system may have been infiltrated by the North Korea foreign intelligence agency, the Reconnaissance General Bureau, over the last two years. However, the institution initially denied knowledge of such reports, regarding the North Korean Infiltration.
On the very day of the NIS report, the election service released a statement downplaying the cybersecurity apprehensions raised by the NIS.
In a statement the Electoral Body said that:
“The Possibility of infiltration does not mean election results being manipulated. Hackers meddling in elections is a ‘practically impossible scenario’.”
Not relenting on disregarding the NIS findings, the Electoral Service emphasized more saying:
“The NIS announcement suggesting foreign actors could potentially influence elections, sowed distrust in the country’s election system, and threatened the very basis of democracy.”
The incumbent electoral office, People Power Party are of the opinion that the election service has to be accountable for denying the possibility of North Korean threat actors manipulating the South Korean electoral processes, and for not taking actions in checking the security risk of the election systems.
A Law Maker of the ruling party who chose to remain anonymous disclosed to Korea Herald that the disclosure are sufficient evidences to warrant calls for the resignation of the election chief service.
Put your comments below in the comment section on your thoughts about this.
