Attacks/Breaches
7/16/2013
12:58 PM
50%
50%

Anonymous Not Behind Attacks, South Korea Says

June's online attacks against South Korean government agencies and private businesses trace back to hackers operating from North Korea, not Anonymous, officials say.

South Korean officials have traced June's online attacks against government agencies and private businesses to hackers operating from North Korea, refuting the attackers' claims that they were affiliated with Anonymous.

"We speculate the hacking was done by North Korea," Park Jae-moon, a senior ministry official, said Thursday in a media briefing, reported the BBC. "[A] North Korean IP [address] was found in passages of the malignant codes and some of the damaged organizations. I can say this is the decisive evidence," he said.

Analysis of 82 different versions -- or variants -- of malware recovered after the attacks, multiple IP addresses used by attackers, as well as their tapping South Korean file-sharing sites for hosting exploit code were also consistent with previous cyber attacks that have been traced to Pyongyang, he said.

Those latest online attacks against South Korea began on June 25, 2013 -- the anniversary of the start of the start of the Korean War (1950-53) -- and continued through July 1, officials said. All told, the attacks targeted 69 government-related and private websites in South Korea, including the prime minster's office. Attacked sites, in some cases, sported defacements that read "Great leader Kim Jong-un," referring to the leader of the North Korean regime, which is based in Pyongyang. Officials at South Korea's Science Ministry said that all but about 10% of attacked sites have now been repaired.

[ IT pros have strong opinions on the balance between privacy and security. See NSA Surveillance: IT Pro Survey Says What? ]

"These were meticulously planned attacks that had been prepared at least for several months to find the weak spots of their targets," Park said, reported The New York Times.

In a statement issued Thursday, Korea's Science Ministry said that the attack signatures also correlated with the March 20 wiper malware campaign that erased the hard drives of an estimated 48,000 South Korean PCs at banks and broadcasters, as well as distributed denial-of-service attacks. The attacks were later revealed to be part of a four-year cyber-espionage campaign.

The hackers behind the June attacks had claimed to be affiliated with Anonymous. But South Korean officials said the claimed Anonymous affiliation appeared designed simply to cause confusion. Likewise, official channels of the hacktivist collective had quickly denied the attackers' assertion, with the Japanese branch of Anonymous tweeting: "We didn't Hack any #SouthKorea websites." At the time, in fact, Anonymous -- as part of its ongoing "#OpNorthKorea" campaign -- had been attacking a number of sites affiliated with Pyongyang, including numerous government websites, the airline Air Koryo and multiple business sites.

South Korea traced the last major cyber attack against the country, in March, to Pyongyang after one of the attackers apparently suffered technical difficulties, leading to the IP address being temporarily and accidentally exposed. Officials at the Korea Internet & Security Agency said the IP address was registered to a company called Star Joint Venture (Star JV), which is North Korea's sole service provider.

Prior online attacks against South Korean sites, in 2009 and 2011, were also traced to Pyongyang.

The accusation of launching yet another cyber attack against South Korea isn't this week's only potential political setback for North Korean leader Kim Jong-un, who Thursday was pictured visiting a mushroom farm. Notably, officials in Panama Thursday said they detained a ship flying the North Korean flag, which had departed from Cuba, on suspicion that it was being used to transport drugs. After the ship was stopped, the vessel's captain experienced a heart attack and then attempted to commit suicide, reported the Guardian.

After a partial search of the ship, Panamanian officials said they found, hidden in crates of brown sugar, what they described as "weapons of war" -- including missiles -- being transported in violation of United Nations arms trafficking sanctions against North Korea, which all member states are required to uphold. Police also arrested 35 North Koreans onboard the vessel after they attempted to prevent police from rerouting the vessel into the Atlantic-side port of Manzanillo.

Panama's president, Ricardo Martinelli, later tweeted a picture that showed a long, military-green tube. By late Tuesday morning, his spokesman said police had only completed searching one of the ship's five holds

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-5027
Published: 2014-12-26
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-2062. Reason: This candidate is a reservation duplicate of CVE-2010-2062. Notes: All CVE users should reference CVE-2010-2062 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2010-1441
Published: 2014-12-26
Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) A/52, (2) DTS, or (3) MPEG Audio decoder.

CVE-2010-1442
Published: 2014-12-26
VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) ASF, or (3) Matroska (aka MKV) demuxer.

CVE-2010-1443
Published: 2014-12-26
The parse_track_node function in modules/demux/playlist/xspf.c in the XSPF playlist parser in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty location element in an XML Shareable Playlist Format...

CVE-2010-1444
Published: 2014-12-26
The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.