Attacks/Breaches
3/21/2013
09:48 AM
50%
50%

South Korea Bank Hacks: 7 Key Facts

Data-wiping attacks on Windows and Linux computers may have just focused on random targets to cause chaos, security researchers say.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
The online attacks launched against multiple banks, insurance companies and television stations in South Korea Wednesday knocked targeted networks offline. But according to security experts, the attacks were relatively unsophisticated and would have required little infrastructure or expertise to launch.

That's one of the early takeaways from studies of the attack techniques and malware used in the South Korean cyber attacks, which began Wednesday at about 2:20 p.m. local time. South Korean broadcasters KBS, MBC and YTN, as well as the Jeju, Nonghyup and Shinhan banks, saw their computer networks get knocked offline after their PCs were infected with data-deleting malware.

Here's what's currently known about the attacks:

1. DarkSeoul Malware: No Awards For Sophistication

Sophos, has analyzed the malware -- which it dubbed "DarkSeoul" -- used in the attack, and found that the malicious code attempted to deactivate two antivirus products that are popular in South Korea: AhnLab and Hauri AV. Despite that, however, the malware hardly qualifies some advanced persistent threat.

[ Were known security flaws an issue in this attack? Read HTTPS Security Encryption Flaws Found. ]

"What's curious is that the malware is not particularly sophisticated. Sophos products have been able to detect the malware for nearly a year, and the various commands embedded in the malicious code have not been obfuscated," said Graham Cluley, senior technology consultant at Sophos, in a blog post. "For this reason, it's hard to jump to the immediate conclusion that this was necessarily evidence of a 'cyberwarfare' attack coming from North Korea."

Mikko Hypponen, chief research officer at F-Secure, likewise noted that the malware was relatively unsophisticated. "Out of all the possible things you could do with a compromised machine, wiping it empty is the least useful thing for an advanced attacker," he said on Twitter.

2. Targeted Organizations Still Struggling To Recover

Whether or not the malware rates as highly advanced, the targeted organizations' networks were paralyzed after the Wednesday attacks, leading to disruptions that disabled ATMs and smartphone banking websites for the financial firms. Targeted television stations, however, were able to continue broadcasting.

By Thursday, many of the affected organizations reported that they'd restored their networks, but had yet to fully recover all of their wiped PCs. "We successfully recovered our mainstay network related to programming and advertising this morning, and normalized our service," an official at Korea's largest television station, KBS, told South Korea's Yonhap News Agency. "But we are still working to recover around 5,000 personal computers that came under the attack, and our website is still inaccessible."

3. Malware Included Linux Wiping Capability

As that suggests, the malware used in the attacks was quite effective at deleting data. According to research published by Symantec, the malware -- which it dubbed Trojan.Jokra -- "is a Trojan horse that attempts to wipe the hard disk of the compromised computer" and can infect numerous versions of Windows (Windows 2000, Windows 7, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Server 2008, Windows Vista and Windows XP) as well as Linux systems.

The malware wiped Windows computers by overwriting their master boot record (MBR) and any data stored on the PC, then instructed the PC to shut down, "which renders the computer unusable as the MBR and the content of the drive are now missing," according to Symantec's analysis.

The malware also includes a module designed to remotely wipe any Linux machines that are connected to the same network as the infected PC. "We do not normally see components that work on multiple operating systems, so it is interesting to discover that the attackers included a component to wipe Linux machines inside a Windows threat," Symantec said. "The included module checks Windows 7 and Windows XP computers for an application called mRemote, an open source, multi-protocol remote connections manager."

An XML file maintained by mRemote lists saved connections with remote systems, and the malware "parses this XML file for any connection with root privileges using the SSH protocol," said Symantec. The malware then uses a bash script to upload and execute a temporary file on the Linux system. "The bash script is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions," according to Symantec. "It wipes out the /kernel, /usr, /etc, and /home directories."

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Computer Repair Whiteplains NY
50%
50%
Computer Repair Whiteplains NY,
User Rank: Apprentice
3/21/2013 | 5:13:05 PM
re: South Korea Bank Hacks: 7 Key Facts
It's incredible to see how even Linux systems get infected. At this point, I would suggest those banks to get off the Internet or, if they need to remain online, to adopt a very high customization and split of their networks.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2208
Published: 2014-12-28
CRLF injection vulnerability in the LightProcess protocol implementation in hphp/util/light-process.cpp in Facebook HipHop Virtual Machine (HHVM) before 2.4.2 allows remote attackers to execute arbitrary commands by entering a \n (newline) character before the end of a string.

CVE-2014-2209
Published: 2014-12-28
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.

CVE-2014-5386
Published: 2014-12-28
The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initial...

CVE-2014-6228
Published: 2014-12-28
Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted arguments to the chunk_split ...

CVE-2014-6229
Published: 2014-12-28
The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string,...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.