Ministry of Defense headquarters in Yongsan District, central Seoul, on Aug. 14.NEWS1
Weapons systems in active military use carry hundreds of cybersecurity flaws, and Chinese-made cameras passed off as Korean still guard some of South Korea’s most sensitive energy facilities, data released by two lawmakers show.
The military’s own inspections found more than 840 vulnerabilities across 41 weapons and support systems, some of them in equipment now deployed in operations. The findings have raised concern that hackers from North Korea or elsewhere could harm the military’s ability to respond to a crisis.
The Cyber Operations Command and the Army, Navy and Air Force found the flaws in cybersecurity checks of weapons and combat support systems in the first half of the year, according to data from Rep. Lim Jong-deuk, a conservative People Power Party member of the National Assembly’s National Defense Committee. The problems included open communication ports that allowed unauthorized access, lax password management and security patches that had not been properly applied.
Weapons systems accounted for 418 of the flaws, found in 21 systems: six in the Army, five in the Navy and 10 in the Air Force. They include equipment deployed in actual operations, such as the Navy’s patrol assets and the Air Force’s equipment for monitoring radio jamming. Military authorities did not disclose which systems were affected or what the flaws were. They cited the risk that North Korea could exploit the information in cyberattacks.
This is the first time the results of cybersecurity inspections of the military’s weapons systems have been made public, the Ministry of National Defense said.
The figures combine checks by the Cyber Operations Command with each service’s own inspections. The command handles the highest-security “Class A” systems under the ministry’s control, as well as systems linked to internal and external networks and internet-based systems. The services inspect the rest.
The other 422 flaws were found in 20 combat support systems, which cover logistics and other support functions: nine in the Army, seven in the Navy and four in the Air Force. Security gaps also emerged at five defense institutions, including agencies under the ministry, and on 85 military-run websites.
A Marine Corps amphibious assault vehicle fires smoke grenades as it maneuvers during a large-scale joint field training exercise led by the Army’s 17th Infantry Division at the Jangdo training ground in Seo District, Incheon, on Oct. 15.YONHAP
“Cyberattacks are a serious security problem that threatens not only the normal operation of weapons and combat support systems but also the military’s ability to carry out operations,” Lim said. “The vulnerabilities must be fixed quickly, and thorough follow-up inspections must be carried out to fully maintain combat readiness.”
Korea Gas Corp. (Kogas), meanwhile, still operates 243 Chinese-made CCTV cameras from a supplier that was caught in 2021 selling them as Korean-made, according to data Rep. Jang Chul-min of the liberal Democratic Party obtained from the Public Procurement Service and the state gas company. The cameras account for 7.86 percent of all the company’s CCTV cameras.
Of those, 163 are installed at unmanned supply management stations that are run on par with national security facilities. Sixteen are used for internal surveillance at the company’s Incheon liquefied natural gas terminal, a national key facility with the top “Class A” security rating. At the Korea National Oil Corporation's stockpiling bases, 261 of the 849 CCTV cameras are Chinese-made products from the same supplier, illegally labeled Korean.
Liquefied natural gas (LNG) storage tanks stand at Korea Gas Corp.’s Incheon terminal in Songdo, Yeonsu District, Incheon, on March 4. The terminal, which has the country’s largest LNG storage capacity, uses Chinese-made cameras for internal surveillance.YONHAP
The National Intelligence Service (NIS) had flagged the cameras in December 2021, while the supplier was under investigation. It asked that the origin, manufacturer and network connections of CCTV cameras at national security facilities be checked. Such cameras “can automatically communicate with the Chinese manufacturer’s cloud if connected to an open network,” the agency said at the time. The Industry Ministry forwarded the request to 10 public institutions, including Kogas, in the same month. The gas company kept using the cameras anyway.
The supplier’s chief executive was sentenced to four years in prison by a local court in 2022 on charges including violations of the Foreign Trade Act and fraud related to sales made between 2016 and 2021. The sentence was finalized in 2023.
“The NIS warned about Chinese CCTV cameras disguised as Korean products in 2021, and a 2023 Supreme Court confirmed that disguised products had been delivered, yet national key facilities are still using the offending models,” Jang said.
“Kogas and the Korea National Oil Corporation must immediately take action on the offending models, and the Industry Ministry must reexamine the security inspection systems of the bodies under its supervision.”
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
