South Korea Bank Hacks: 7 Key Facts

Data-wiping attacks on Windows and Linux computers may have just focused on random targets to cause chaos, security researchers say.

Who Is Hacking U.S. Banks? 8 Facts (click image for larger view and for slideshow)
The online attacks launched against multiple banks, insurance companies and television stations in South Korea Wednesday knocked targeted networks offline. But according to security experts, the attacks were relatively unsophisticated and would have required little infrastructure or expertise to launch.
Thats one of the early takeaways from studies of the attack techniques and malware used in the
South Korean cyber attacks
, which began Wednesday at about 2:20 p.m. local time. South Korean broadcasters KBS, MBC and YTN, as well as the Jeju, Nonghyup and Shinhan banks, saw their computer networks get knocked offline after their PCs were infected with data-deleting malware.
Heres whats currently known about the attacks:
1. DarkSeoul Malware: No Awards For Sophistication
Sophos, has analyzed the malware -- which it dubbed DarkSeoul -- used in the attack, and found that the malicious code attempted to deactivate two antivirus products that are popular in South Korea:
AhnLab
and
Hauri AV
. Despite that, however, the malware hardly qualifies some
advanced persistent threat
.
[ Were known security flaws an issue in this attack? Read
HTTPS Security Encryption Flaws Found
. ]
Whats curious is that the malware is not particularly sophisticated. Sophos products have been able to detect the malware for nearly a year, and the various commands embedded in the malicious code have not been obfuscated, said Graham Cluley, senior technology consultant at Sophos, in a
blog post
. For this reason, its hard to jump to the immediate conclusion that this was necessarily evidence of a cyberwarfare attack coming from North Korea.
Mikko Hypponen, chief research officer at F-Secure, likewise noted that the malware was relatively unsophisticated. Out of all the possible things you could do with a compromised machine, wiping it empty is the least useful thing for an advanced attacker, he said
on Twitter
.
2. Targeted Organizations Still Struggling To Recover
Whether or not the malware rates as highly advanced, the targeted organizations networks were paralyzed after the Wednesday attacks, leading to disruptions that disabled ATMs and smartphone banking websites for the financial firms. Targeted television stations, however, were able to continue broadcasting.
By Thursday, many of the affected organizations reported that theyd restored their networks, but had yet to fully recover all of their wiped PCs. We successfully recovered our mainstay network related to programming and advertising this morning, and normalized our service, an official at Koreas largest television station, KBS,
told South Koreas Yonhap News Agency
. But we are still working to recover around 5,000 personal computers that came under the attack, and our website is still inaccessible.
3. Malware Included Linux Wiping Capability
As that suggests, the malware used in the attacks was quite effective at deleting data. According to
research published by Symantec
, the malware -- which it dubbed
Trojan.Jokra
-- is a Trojan horse that attempts to wipe the hard disk of the compromised computer and can infect numerous versions of Windows (Windows 2000, Windows 7, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Server 2008, Windows Vista and Windows XP) as well as Linux systems.
The malware wiped Windows computers by overwriting their master boot record (MBR) and any data stored on the PC, then instructed the PC to shut down, which renders the computer unusable as the MBR and the content of the drive are now missing, according to
Symantecs analysis
.
The malware also includes a module designed to remotely wipe any Linux machines that are connected to the same network as the infected PC. We do not normally see components that work on multiple operating systems, so it is interesting to discover that the attackers included a component to wipe Linux machines inside a Windows threat, Symantec said. The included module checks Windows 7 and Windows XP computers for an application called mRemote, an open source, multi-protocol remote connections manager.
An XML file maintained by mRemote lists saved connections with remote systems, and the malware parses this XML file for any connection with root privileges using the SSH protocol, said Symantec. The malware then uses a bash script to upload and execute a temporary file on the Linux system. The bash script is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions, according to Symantec. It wipes out the /kernel, /usr, /etc, and /home directories.
Anonymous: 10 Things We Have Learned In 2013 (click image for larger view and for slideshow)
4. Targets May Have Already Been Botnet Zombies
Might the South Korean malware attacks have been designed to cause maximum chaos and disruption, rather than targeting any given organization? One theory -- advanced by Jaime Blasco, labs manager at AlienVault Labs -- is that whoever targeted the South Korean banks and broadcasters may have just used machines that were already infected by the GonDad exploit kit, which has been used to infect a number of PCs in the country.
From my point of view one of the easiest ways to gain access to several targets without having too much resources/skills would be [to] buy an exploit kit and a malware kit, hack into websites and redirect victims to your malicious infrastructure, Blasco said in a
blog post
. Even better, rent a botnet(s) that have access to hundreds of computers and try to find victims inside interesting targets.
[ How hard is it to find patterns in attacks? Read
Security Tools Show Many Dots, Few Patterns
. ]
Indeed, he said that if the goal of the attackers was to create panic it means they hadnt to have a specific list of victims, [did] they? Instead, they could have just identified targets of opportunity.
If the people behind yesterdays South Korean attacks had access to some of the infrastructure ... they could have gained access to hundreds if not thousands of South Korean systems and then they could have chosen which of the compromised systems were in interesting companies, he said. Then they could have manually upload another payload to each of the systems and they could have performed lateral movement to own the network. Once they are in the network they can easily execute the wiping payload.
You should take into account that this is only a theory and it could even be a very small part of all the infrastructure they could have used, he said.
5. Attacks Launched Via Chinese IP Address
A group calling itself the Whois Team has claimed credit for the attacks, and defaced some disrupted websites with a message announcing that This is the Beginning of our Movement and that Unfortunately, We have deleted Your Data. Well be back Soon. See You Again. But who is the Whois Team? Thats not clear, and it may just be a front for a nation state or gang.
According to the Korea Communications Commission (KCC), at least some of the malware that was used in the attacks was distributed via IP addresses located in China. Thats no smoking gun for either Chinese government involvement or Chinese nationals being behind the attacks. Rather, attackers may have simply
rented an inexpensive China-based botnet
to target a pre-supplied list of South Korean IP or email addresses with malware attacks.
Both the exploit kit and the malware mentioned seems to come from China, but the attackers could have bought/[rented] it in the black market, said Blasco at AlienVault Labs.
6. Outage: South Korean Internet Service Provider Targeted
The attackers may have also hacked into the countrys South Korean service provider LG UPlus, which told police Wednesday that it had suffered a network outage as a result of a hack attack,
reported Reuters
. South Korean police said they were investigating that claim. Interestingly, all of the malware-attacked organizations are customers of LG UPlus, but that might just be a coincidence.
7. South Korean Official Suspect North Korea
After any online attack against South Korea, the primary suspect is always North Korea, given tensions between the two neighbors, as well as reports that
North Korea has developed a cyberwarfare unit
. In the wake of yesterdays attacks, officials in Seoul were urging caution before assigning blame. But by Thursday, South Korean officials started pointing fingers.
The government is closely analyzing the incident with all possibilities open, while bearing a strong suspicion that North Korea conducted the attack, a high-ranking official of the presidential office Cheong Wa Dae told Yonhap News Agency.
According to Yonhap, Korean intelligence officials said theyve traced six online attacks to North Korea in recent years, including a massive 2009
distributed denial of service (DDoS) attack
that
disabled 26 South Korean government and foreign websites
, another DDoS attack in March 2011 against the websites of the South Korean president, national assembly and media outlets, and a June 2012 attack against a conservative newspaper website. At least some of those attacks were launched via Chinese IP addresses.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
South Korea Bank Hacks: 7 Key Facts