China Works To ‘Muddy’ North Korean Hacker Connection To Hotel At Center Of Sony Breach

http://www.wantchinatimes.com/news-subclass-cnt.aspx?id=20150111000015&cid=1103

Shenyang Hotel Denies Housing North Korean Hackers

Staff Reporter
2015-01-11
09:14 (GMT+8)

The Chilbosan hotel in Shenyang. (Internet photo)
The Chilbosan hotel in Shenyang. (Internet photo)

A journalist for the Chinese nationalist tabloid Global Times has visited a hotel in Shenyang in northeast China’s Liaoning province that has been alleged to accommodate North Korean computer hackers.

CNN quoted a North Korean defector named Kim Heung-Kwang in its report on Jan. 7 about the Chilbosan hotel in Shenyang, a joint venture between North Korea and China. The spot is alleged to be the home of a secret network of the North Korean hacking unit dubbed Bureau 121.

Kim is a former Pyongyang computer science professor who fled the country in 2004. He claims North Korean hackers have operated secretly in Shenyang for years, using various locations to conceal their tracks. Bureau 121 began its large-scale operations in China in 2005. It was established in the late ’90s, Kim said.

“Team members entered China separately in smaller groups, 20 members at a time,” he said. “When they entered China, they came under different titles. For example an office worker, an official with a trade company or even as a diplomatic staffer.”

“By day, they worked regular jobs. But the rest of the time they were acting on orders from Pyongyang,” CNN quoted him as saying.

“North Korea does have illicit activities in China,” says Steve Sin, a terrorism expert at the University of Maryland and former US military intelligence analyst.

“If you are going to conduct illicit activities or covert operations, it’s better to hide among this population, if you will,” said Sin. “Large, complicated attacks require a certain amount of cyber infrastructure to carry it out. Shenyang, China has that capability.”

According to the Global Times, the hotel is located in a busy district near a major train station, a medical school and a hospital. Nothing except a Korean sign distinguishes it from its surroundings.

The ratio of North Korean to Chinese employees at the hotel is about 1:1. The North Korean staff wear traditional clothing while the Chinese do not. When asked about the CNN report, the front desk replied, somewhat surprised, “I’ve never heard of it, and it is impossible. This is a safe place.”

The four-star hotel charges 300 to 400 yuan (US$48-$64) per room per night. The facility cannot be described as luxurious but it provides sufficient services. Signs and brochures there are printed in both Chinese and Korean.

The hotel was opened in May 2012 and North Korea accounts for 70% of its funding while the China takes care of the rest. With that said, the North Koreans leaves the management to the Chinese, according to Zhao Yuesong, director of the general office in the hotel, who added that most of their guests are Chinese.

The North Korean employees are said to come from prestigious families of high-ranking officials and are well-trained. They leave China after three years of staying and working in the hotel. Most of them refuse requests to pose for photos with the guests.

When the reporter asked one such attendant a question in Chinese, she only smiled and shook their hand, signaling that she could not understand. “They can’t really speak much Chinese and are not willing to share information about themselves,” a Chinese staffer told the reporter.

“Sometimes there are North Korean guests. There seems to be rules that they must stay in this hotel when they visit Shenyang,” said another Chinese hotel employee. “They like to stay together in one single room. Once, about seven to eight guests stayed in the same room and made a bed on the floor.”

Pu Jianyi, a researcher with the National Institute of International Strategy, Chinese Academy of Social Sciences, believes that the rumor that “all North Korean visitors to Shenyang stay in Chilbosan” is not totally correct. “The North Korean army seems to be the source of funding on their side. When their nationals come, it is likely that they only stay in Chilbosan because they can apply for reimbursement.”

“We sometimes receive friends from North Korea and reserve Chinese-funded hotels for them. They don’t seem to have a problem with that. So I believe it is really about the funding and it also depends on different occasions,” said Pu.

Zhao said he is intrigued by the CNN report. “I did not know of such claims until this morning,” said Zhao, adding that in China, there is a filter-like official mechanism that ensures internet security. Abnormal activity there would attract the police sooner than reporters, and “no matter what people say, as you can see, nothing is unusual with our hotel, so there are no North Korean hackers here,” said Zhao.

The Shenyang police confirmed Zhao’s words and said that internet enforcers run live monitoring streams from public facilities like hotels. He denied that there is abnormal online activity there.

Japanese media claimed that analysis had shown that the suspects of the recent Sony cyber-attack had an IP address from Shenyang.

In response, an internet expert in Shenyang said an IP alone cannot be the sole evidence of attack. “There is such a tool as hidden IP that users may use to disguise their real IP with fake ones,” he said.

References:

Chilbosan 七寶山

Zhao Yuesong 趙岳松

Pu Jianyi 樸鍵一

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: