South Korea to develop Stuxnet-like cyberweapons

South Korean plans to develop Stuxnet-type weapons to damage North Korean nuclear facilities

South Korea is to develop cyber-attack tools in an attempt to damage North Korean nuclear facilities.

The country's defence ministry wants to develop weapons similar to Stuxnet, the software designed to attack Iranian nuclear enrichment plants.

The South Korean military will carry out missions using the software, the defence ministry said.

One computer security expert said that using cyberweapons could be "very dangerous".

The defence ministry reported its plan to the government on 19 February, the Yonhap news agency reported.

In 2006, North Korea said it had successfully tested a nuclear weapon, spreading alarm through the region. Intensive diplomatic efforts to try to rein in North Korea's nuclear ambitions continue.

Online propaganda

The development of weapons capable of physically damaging North Korean nuclear plants and missile facilities is the second phase of a strategy that began in 2010, Yonhap said.

The first part of South Korea's plan, which is continuing, is to conduct online propaganda operations by posting to North Korean social networking and social media services.

"Once the second phase plan is established, the cybercommand will carry out comprehensive cyberwarfare missions," a senior ministry official said.

The South Korean cyberwarfare command, which will use the weapons, has been dogged by accusations of using its psychological warfare capabilities on its own population to try to influence voters in the run-up to the 2012 presidential elections.

Attempting to use cyberweapons to physically damage critical infrastructure could drastically backfire, Prof Alan Woodward, a computer security expert at the University of Surrey, told the BBC.

"I think it's very dangerous," he said. "[The weapon] could end up damaging all sorts of things you never intended it to."

Once Stuxnet was released, its spread was impossible to predict or control, Prof Woodward said.

Vulnerable

The code was designed to target Iranian nuclear enrichment facilities and disrupt a suspected nuclear weapons development programme.

However, the code attacked Siemens control systems used not only in the facilities but also in electrical generation plants, factories and water treatment works.

"You might be targeting one thing, but it could spread," Prof Woodward said. "All those other forms of infrastructure become vulnerable."

Malicious code such as Stuxnet does not respect national boundaries. Cyber-attack code developed by South Korea could rebound and end up damaging South Korean infrastructure that uses the same technologies, he said. The code could spread internationally.

In addition, once the attack code is released, malicious hackers or military personnel anywhere in the world would be able to study a sample and use the weapons against another target, Prof Woodward added.