Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

8/25/2014
08:00 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

27 Million South Koreans Victimized In Online Gaming Heist

16 suspects arrested in South Korea as authorities pursue additional suspects, including a Chinese hacker.

South Korean authorities are investigating a massive and widespread breach of personal information on some 27 million online gamers in that nation in what a report there says makes up more than 70% of South Korea's population of people between the ages of 15 and 65.

According to a report by Korea's JoongAng Daily, the South Jeolla Provincial Police Agency has arrested a 24-year-old man with the last name of Kim, who acquired names, registration numbers, account names, and passwords on the 27 million victims, from a Chinese hacker he met in 2011 in an online game. They have arrested 15 other suspects as well, and are pursuing more.

Kim allegedly used the stolen credentials and information to pilfer hundreds of millions of won, equivalent to around US $400,000, in online gaming currency from six online games in Korea. He gave a cut to the Chinese hacker, according to the report, and sold some of the stolen information to others in the black market.

Online gaming is wildly popular in South Korea, so it's no surprise cyber criminals would target that community, says Adam Kujawa, head of malware intelligence at Malwarebytes.

It's unclear whether the gamers' credentials originally were stolen via a drive by attack on the gaming websites, or if the hacker who grabbed them used a password-cracking tool, he says. "They could have been testing known passwords and usernames, and had a tool that automatically tries to log in using these credentials. Once they worked, they were able to steal money."

Or the attackers used a key logger to sniff the credentials when the victims logged in, says Kujawa.

Regardless, two-factor authentication would have kept the accounts safe from this scam, with a temporary one-time password, for example, he says. "I think two-factor authentication should be required" for gaming. The online gaming community sometimes offers incentives to get users to configure their accounts for two-factor, such as free in-game special items for users who register for two-factor authentication.

"This shows how easy it was for these attackers to exploit" gamers, Kujawa says. "I think it was fairly significant and an eye-opener... The population of people playing [online gaming] is growing, therefore so is the population for potential victims."

Kim reportedly sold some of the stolen information to mortgage fraudsters and phony gambling advertisers as well, and made billions of wons worth of fraudulent transactions.

South Korea has had its share of data breaches: Earlier this year, an employee of the Korea Credit Bureau allegedly stole personal information on some 20 million citizens, and in 2011, personal information of some 35 million users of a social network and search engine was exposed. 

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
8/26/2014 | 7:28:11 PM
Re: Human Error
I bet Blizzard, with its 2FA system, is feeling fairly smug right about now.
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
8/26/2014 | 12:07:33 PM
Re: Human Error
Another interesting element to evaluate in this story is that South Korea is one of the countries that suffered the greatest number of data breaches and some experts speculated that they could be the results of state-sponsored hacking.

In the specific case I don't believe there is a relationship with information warfare operation despite the hacker who passed the stolen data was Chinese and China has always supported the greatest enemy of South Korea, the North Korea.
Whoopty
50%
50%
Whoopty,
User Rank: Ninja
8/26/2014 | 11:23:48 AM
Future
I get the feeling that as you guys say, biometrics may be the best way forward in the future, especially since there's a fair number of very personal body signatures that could identtify us. 

However in the mean time, while that sort of technology drops in price, two factor really is a must for communities of this size, it's too easy to exploit otherwise. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/26/2014 | 10:28:20 AM
Re: Human Error
I'm personally all for biometrics, but that's probably a long way away from happening in online gaming. 2FA makes sense and ideally should be mandatory. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/26/2014 | 8:25:42 AM
Re: Human Error
Biometrics is a good idea, but I think from a personal computing standpoint it would be hard to rationalize cost when multi factor authentication is available without it. I would think that tokens might be less cost intensive, one time password sent to devices, things of that nature.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
8/25/2014 | 11:14:54 PM
Human Error
The problem here is that as humans we usually follow the path of least resistance.  In this case these individuals probably know that two factor authentication is more secure, but don't want to use it because it causes minor inconvenience.  We need to find better two factor authentication sources that cause less heartburn in order to gain wider acceptance.  Biometrics maybe?
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15734
PUBLISHED: 2021-04-12
An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same directory or sub-directories. This issue affects: Bitdefender Safepay versions prior to 25.0.7.29.
CVE-2020-7924
PUBLISHED: 2021-04-12
Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions late...
CVE-2021-27486
PUBLISHED: 2021-04-12
The Fatek Automation WinProladder Versions 3.3 and prior are vulnerable to an integer underflow, which may cause an out-of-bounds write and allow an attacker to execute arbitrary code.
CVE-2021-3465
PUBLISHED: 2021-04-12
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-15942
PUBLISHED: 2021-04-12
An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile.