"DDoS Allegation"... What Caused the KT Outage? Possibility of Human Error

[Asia Economy Reporter Seulgina Jo] KT initially suspected the cause of the wired and wireless internet network outage that occurred on the 25th to be a 'large-scale DDoS attack,' but corrected it to a 'routing (network path configuration) error' after about two hours. This has led to repeated criticism that this blackout incident was also a preventable 'human error.'

At around 2:30 PM on the same day, KT issued an official statement saying, "First, we apologize for the inconvenience caused to the public due to the communication failure," and added, "Initially, we suspected a DDoS attack due to traffic overload, but after careful verification, we identified a routing error as the cause." This corrected the earlier announcement made right after the blackout, when the crisis management committee was activated and it was reported that "a large-scale DDoS attack occurred around 11 AM."

The routing KT cited as the cause of the connection failure refers to selecting the optimal path when transmitting communication data within a network. Telecom companies use this to efficiently manage large-scale traffic and ensure smooth operation of the internet network. KT has not yet disclosed the specific circumstances under which the routing error occurred.

However, since KT mentioned "traffic overload" as the reason for initially suspecting a DDoS attack, there is speculation within and outside the industry that incorrect routing configuration settings may have caused traffic to concentrate on a specific network. It is explained that symptoms caused by incorrect routing settings can resemble those of a DDoS attack.

Typically, routing tasks are handled by automated equipment based on pre-set values according to manuals. It has not yet been confirmed whether this incident was due to equipment-level errors, administrator configuration mistakes, or occurred during device replacement or inspection work.

Some criticize KT’s initial response for hastily attributing the cause to a DDoS attack, arguing that careful cause identification should have been conducted to prevent unnecessary confusion. A DDoS attack refers to a cyberattack that paralyzes systems by using zombie PCs infected with malware. When connection errors occurred in Naver News and Cafes last April, the possibility of a DDoS attack was only mentioned after half a day had passed.

KT’s second labor union, KT Saenozu, issued a statement titled "KT Nationwide Internet Outage Incident, a Serious Matter for Which Management Must Take Responsibility," saying, "If it is a routing error, there is a high possibility of human error, according to internal staff opinions," and criticized, "The current reality of KT is that a nationwide internet communication outage occurs due to human error in a 100-year-old telecommunications company." KT Saenozu added, "As workers of a national public enterprise responsible for the country’s core telecommunications, we feel deep self-reproach and believe that the clear cause and management responsibility must be held accountable."

The Ministry of Science and ICT, the relevant government department, issued an information and communication accident crisis alert at the 'caution' level at 11:56 AM on the same day according to the crisis management manual and is investigating the specific cause of the incident. A Ministry official said, "We instructed KT to investigate the damage status to users and plan to prepare follow-up measures such as recurrence prevention after investigating the cause of the accident."

The connection failure occurred nationwide, including Seoul, the metropolitan area, Chungcheong and Honam regions, and Jeju Island, for about 40 minutes starting around 11:20 AM. Services across KT’s internet, from web searches to stock trading systems and store payment systems, were disrupted. Some subscribers even experienced failures in regular telephone calls, spreading the outage further.

This content was produced with the assistance of AI translation services.