Attacks/Breaches

3/21/2013
09:48 AM
50%
50%

South Korea Bank Hacks: 7 Key Facts

Data-wiping attacks on Windows and Linux computers may have just focused on random targets to cause chaos, security researchers say.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
The online attacks launched against multiple banks, insurance companies and television stations in South Korea Wednesday knocked targeted networks offline. But according to security experts, the attacks were relatively unsophisticated and would have required little infrastructure or expertise to launch.

That's one of the early takeaways from studies of the attack techniques and malware used in the South Korean cyber attacks, which began Wednesday at about 2:20 p.m. local time. South Korean broadcasters KBS, MBC and YTN, as well as the Jeju, Nonghyup and Shinhan banks, saw their computer networks get knocked offline after their PCs were infected with data-deleting malware.

Here's what's currently known about the attacks:

1. DarkSeoul Malware: No Awards For Sophistication

Sophos, has analyzed the malware -- which it dubbed "DarkSeoul" -- used in the attack, and found that the malicious code attempted to deactivate two antivirus products that are popular in South Korea: AhnLab and Hauri AV. Despite that, however, the malware hardly qualifies some advanced persistent threat.

[ Were known security flaws an issue in this attack? Read HTTPS Security Encryption Flaws Found. ]

"What's curious is that the malware is not particularly sophisticated. Sophos products have been able to detect the malware for nearly a year, and the various commands embedded in the malicious code have not been obfuscated," said Graham Cluley, senior technology consultant at Sophos, in a blog post. "For this reason, it's hard to jump to the immediate conclusion that this was necessarily evidence of a 'cyberwarfare' attack coming from North Korea."

Mikko Hypponen, chief research officer at F-Secure, likewise noted that the malware was relatively unsophisticated. "Out of all the possible things you could do with a compromised machine, wiping it empty is the least useful thing for an advanced attacker," he said on Twitter.

2. Targeted Organizations Still Struggling To Recover

Whether or not the malware rates as highly advanced, the targeted organizations' networks were paralyzed after the Wednesday attacks, leading to disruptions that disabled ATMs and smartphone banking websites for the financial firms. Targeted television stations, however, were able to continue broadcasting.

By Thursday, many of the affected organizations reported that they'd restored their networks, but had yet to fully recover all of their wiped PCs. "We successfully recovered our mainstay network related to programming and advertising this morning, and normalized our service," an official at Korea's largest television station, KBS, told South Korea's Yonhap News Agency. "But we are still working to recover around 5,000 personal computers that came under the attack, and our website is still inaccessible."

3. Malware Included Linux Wiping Capability

As that suggests, the malware used in the attacks was quite effective at deleting data. According to research published by Symantec, the malware -- which it dubbed Trojan.Jokra -- "is a Trojan horse that attempts to wipe the hard disk of the compromised computer" and can infect numerous versions of Windows (Windows 2000, Windows 7, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Server 2008, Windows Vista and Windows XP) as well as Linux systems.

The malware wiped Windows computers by overwriting their master boot record (MBR) and any data stored on the PC, then instructed the PC to shut down, "which renders the computer unusable as the MBR and the content of the drive are now missing," according to Symantec's analysis.

The malware also includes a module designed to remotely wipe any Linux machines that are connected to the same network as the infected PC. "We do not normally see components that work on multiple operating systems, so it is interesting to discover that the attackers included a component to wipe Linux machines inside a Windows threat," Symantec said. "The included module checks Windows 7 and Windows XP computers for an application called mRemote, an open source, multi-protocol remote connections manager."

An XML file maintained by mRemote lists saved connections with remote systems, and the malware "parses this XML file for any connection with root privileges using the SSH protocol," said Symantec. The malware then uses a bash script to upload and execute a temporary file on the Linux system. "The bash script is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions," according to Symantec. "It wipes out the /kernel, /usr, /etc, and /home directories."

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Computer Repair Whiteplains NY
50%
50%
Computer Repair Whiteplains NY,
User Rank: Apprentice
3/21/2013 | 5:13:05 PM
re: South Korea Bank Hacks: 7 Key Facts
It's incredible to see how even Linux systems get infected. At this point, I would suggest those banks to get off the Internet or, if they need to remain online, to adopt a very high customization and split of their networks.
Four Faces of Fraud: Identity, 'Fake' Identity, Ransomware & Digital
David Shefter, Chief Technology Officer at Ziften Technologies,  6/14/2018
Meet 'Bro': The Best-Kept Secret of Network Security
Greg Bell, CEO, Corelight,  6/14/2018
Containerized Apps: An 8-Point Security Checklist
Jai Vijayan, Freelance writer,  6/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-9036
PUBLISHED: 2018-06-20
CheckSec Canopy 3.x before 3.0.7 has stored XSS via the Login Page Disclaimer, allowing attacks by low-privileged users against higher-privileged users.
CVE-2018-12327
PUBLISHED: 2018-06-20
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq ...
CVE-2018-12558
PUBLISHED: 2018-06-20
The parse() method in the Email::Address module through 1.909 for Perl is vulnerable to Algorithmic complexity on specially prepared input, leading to Denial of Service. Prepared special input that caused this problem contained 30 form-field characters ("\f").
CVE-2018-6563
PUBLISHED: 2018-06-20
Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings, (2) send emails, or (3) change contact information by leveraging lack of an anti...
CVE-2018-1120
PUBLISHED: 2018-06-20
A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which makes a read() call t...