North Korea’s Internet connectivity went dark Monday, just days after President Obama warned the U.S. would launch a “proportional response” to the attack against Sony.
The hermit country’s Internet access first became unstable late Friday and worsened over the weekend. By Monday, North Korea’s Internet was completely offline. The country’s Internet connection appeared to show signs of life later by around 5:00 pm ET, according to the Internet company CloudFlare, but traffic had not yet recommenced.
Security researchers said that the network failure in North Korea appeared to be a distributed denial of service (DDoS) attack, in which hackers flood a network with traffic until it collapses. “Their networks are under duress,” Doug Madory of Dyn Research told the Times. “This is consistent with a DDoS attack on their routers.”
But Matthew Prince, the co-founder of Cloudflare said Internet connection in North Korea had been flickering on and off all morning, indicating that the attack—if that’s what it was—was likely not technologically sophisticated. “It’s far more likely this attack was carried out by a 15-year old kid in a Guy Fawkes mask than the National Security Agency,” Prince told TIME. “If a nation state decided they would launch this attack, it’s much more likely you’d see a total collapse.”
President Obama said Friday the United States will respond to North Korea over its cyberattack on Sony Pictures, but did not say whether his administration would order an attack on the hermit nation’s networks.
DDoS attacks are traditionally associated with so-called “hacktivist” groups who are often ideologically allied with nation-states but lack extensive cyber capabilities. The civil war in Ukraine has sparked a surge in DDoS attacks by outside groups against both separatists and Ukraine’s government, as did the recent war between Hamas and Israel.
North Korea has an extremely limited connection to the worldwide web, and even a primitive DDoS attack could knock the country off the Internet, security researchers said. The country has just 1,024 Internet protocol addresses, compared with the United States’ billions of addresses.
Last week, a London teenager pleaded guilty to successfully launching a DDoS attack against the anti-spam service Spamhaus, whose Internet connectivity is much greater than North Korea’s likely is.
North Korea’s Internet connection is routed through a Chinese telecommunication company called Unicom. Prince said that the collapse of Internet connectivity could also be due to China’s Unicom “kinking the hose” with North Korea, or North Korean shutting the Internet off itself.
The White House declined to comment to the Associated Press on Monday. In the past, most U.S. cyber operations have reportedly been aimed at collecting defense operations or obtaining communications between terrorism suspects.