Attacks/Breaches
3/21/2013
09:48 AM
50%
50%

South Korea Bank Hacks: 7 Key Facts

Data-wiping attacks on Windows and Linux computers may have just focused on random targets to cause chaos, security researchers say.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
The online attacks launched against multiple banks, insurance companies and television stations in South Korea Wednesday knocked targeted networks offline. But according to security experts, the attacks were relatively unsophisticated and would have required little infrastructure or expertise to launch.

That's one of the early takeaways from studies of the attack techniques and malware used in the South Korean cyber attacks, which began Wednesday at about 2:20 p.m. local time. South Korean broadcasters KBS, MBC and YTN, as well as the Jeju, Nonghyup and Shinhan banks, saw their computer networks get knocked offline after their PCs were infected with data-deleting malware.

Here's what's currently known about the attacks:

1. DarkSeoul Malware: No Awards For Sophistication

Sophos, has analyzed the malware -- which it dubbed "DarkSeoul" -- used in the attack, and found that the malicious code attempted to deactivate two antivirus products that are popular in South Korea: AhnLab and Hauri AV. Despite that, however, the malware hardly qualifies some advanced persistent threat.

[ Were known security flaws an issue in this attack? Read HTTPS Security Encryption Flaws Found. ]

"What's curious is that the malware is not particularly sophisticated. Sophos products have been able to detect the malware for nearly a year, and the various commands embedded in the malicious code have not been obfuscated," said Graham Cluley, senior technology consultant at Sophos, in a blog post. "For this reason, it's hard to jump to the immediate conclusion that this was necessarily evidence of a 'cyberwarfare' attack coming from North Korea."

Mikko Hypponen, chief research officer at F-Secure, likewise noted that the malware was relatively unsophisticated. "Out of all the possible things you could do with a compromised machine, wiping it empty is the least useful thing for an advanced attacker," he said on Twitter.

2. Targeted Organizations Still Struggling To Recover

Whether or not the malware rates as highly advanced, the targeted organizations' networks were paralyzed after the Wednesday attacks, leading to disruptions that disabled ATMs and smartphone banking websites for the financial firms. Targeted television stations, however, were able to continue broadcasting.

By Thursday, many of the affected organizations reported that they'd restored their networks, but had yet to fully recover all of their wiped PCs. "We successfully recovered our mainstay network related to programming and advertising this morning, and normalized our service," an official at Korea's largest television station, KBS, told South Korea's Yonhap News Agency. "But we are still working to recover around 5,000 personal computers that came under the attack, and our website is still inaccessible."

3. Malware Included Linux Wiping Capability

As that suggests, the malware used in the attacks was quite effective at deleting data. According to research published by Symantec, the malware -- which it dubbed Trojan.Jokra -- "is a Trojan horse that attempts to wipe the hard disk of the compromised computer" and can infect numerous versions of Windows (Windows 2000, Windows 7, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Server 2008, Windows Vista and Windows XP) as well as Linux systems.

The malware wiped Windows computers by overwriting their master boot record (MBR) and any data stored on the PC, then instructed the PC to shut down, "which renders the computer unusable as the MBR and the content of the drive are now missing," according to Symantec's analysis.

The malware also includes a module designed to remotely wipe any Linux machines that are connected to the same network as the infected PC. "We do not normally see components that work on multiple operating systems, so it is interesting to discover that the attackers included a component to wipe Linux machines inside a Windows threat," Symantec said. "The included module checks Windows 7 and Windows XP computers for an application called mRemote, an open source, multi-protocol remote connections manager."

An XML file maintained by mRemote lists saved connections with remote systems, and the malware "parses this XML file for any connection with root privileges using the SSH protocol," said Symantec. The malware then uses a bash script to upload and execute a temporary file on the Linux system. "The bash script is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions," according to Symantec. "It wipes out the /kernel, /usr, /etc, and /home directories."

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Computer Repair Whiteplains NY
50%
50%
Computer Repair Whiteplains NY,
User Rank: Apprentice
3/21/2013 | 5:13:05 PM
re: South Korea Bank Hacks: 7 Key Facts
It's incredible to see how even Linux systems get infected. At this point, I would suggest those banks to get off the Internet or, if they need to remain online, to adopt a very high customization and split of their networks.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1701
Published: 2015-04-21
Unspecified vulnerability in Microsoft Windows before 8 allows local users to gain privileges via unknown vectors, as exploited in the wild in April 2015.

CVE-2015-2041
Published: 2015-04-21
net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.

CVE-2015-2042
Published: 2015-04-21
net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.

CVE-2015-0702
Published: 2015-04-20
Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote authenticated users to execute arbitrary code by using the languageShortName parameter to upload a file that provides shell access, aka Bug ID CSCus95712.

CVE-2015-0703
Published: 2015-04-20
Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.