5 ms·

South Korea Probe Says North Behind Cyber Attack: Report

27 points by techinsidr 14y ago

kcorbitt 14y ago
There is no way in the world that North Korea developed the expertise to affect this kind of attack in-house, even if it is a relatively simple piece of malware. My guess is that the Chinese have been supporting them in a limited way. China doesn't really have a motivation to encourage North Korea's ridiculous antics and belligerent behavior of late, but it does have a great deal of interest in testing out its own cyber-attack vectors on real-world targets. If they were to directly attack the computers of another nation themselves the world will go into an uproar and their trade will suffer. On the other hand, if North Korea does it we've gotten to the point, collectively, where we don't do much more than roll our eyes and shrug it off. It's a bit like when the Gemans decided to test tank warfare by getting involved in the Spanish Civil War.
- duked 14y ago
  Honestly it doesn't require the help of China or any other country to build such a simple malware. It's not because the country has limited internet access that they are completely clueless. If it's intended, organized by the DPRK government I assume they must have a team of "cyber specialists". I personally doubt that needed china's help for such a simple malware. For info: http://www.symantec.com/connect/blogs/south-korean-banks-and-broadcasting-organizations-suffer-major-damage-cyber-attack http://www.symantec.com/connect/blogs/south-korean-banks-and... http://www.symantec.com/connect/blogs/remote-linux-wiper-found-south-korean-cyber-attack http://www.symantec.com/connect/blogs/remote-linux-wiper-fou...
- fixxer 14y ago
  I think Anonymous needs to get into this full. I don't see boots on the ground happening (thank god, because it'll be lose-lose).
- Spooky23 14y ago
  The DPRK does some IT Offshoring stuff, particularly for Europeans. There was an article about it last summer in the Communications of the ACM.
- EliRivers 14y ago
  Unless they, you know, have internet access, some hardware to play around with and the ability to read.
  - nwh 14y ago
    For the most part they don't though.
    - EliRivers 14y ago
      So this is unlikely to be the work of some punk kid in a village two hundred miles from Pyongyang. I suppose there is the one in a million chance that the DPRK government might have arranged some kind of group that does have internet access and a mandate to cause problems for the country they're at war with.
    - zokier 14y ago
      You don't need most parts. You need a handful of people.
  - jmsduran 14y ago
    It is more likely that an elite group in Pyongyang has internet and computer access, with a subset of that group given more privileges to engineer & deploy malware/etc. Given that though, I find it rather hard to believe the North Korean government could pull off a cyber-attack like this all by themselves, especially when you take into account the effect of international sanctions and the North's very outdated technology (I remember reading they still use a 1960's crank-phone for communication through the DMZ). My best bet is that the Chinese government gave them significant assistance in launching this attack.
    - socillion 14y ago
      There has been some reporting on state-funded North Korean hackers, e.g. http://www.reuters.com/article/2011/06/01/us-korea-north-hackers-idUSTRE7501U420110601 http://www.reuters.com/article/2011/06/01/us-korea-north-hac... No clue how much truth is behind it, I just remember reading about it a while back.
ihsw 14y ago
I was going to make a snide comment about South Koreans using Internet Explorer 6, but apparently usage is way down. http://www.ie6countdown.com/ http://www.ie6countdown.com/
- kijin 14y ago
  Doesn't really matter, because all the important stuff (like online banking and virtually all government business) still relies on ActiveX controls that were developed in the IE5 days. You can upgrade everyone to IE10 but it won't help because the ActiveX controls are still there.
kyllo 14y ago
Is there an article anywhere that clearly explains the actual attack vector? The bash script ultimately used by the malware is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions, Symantec said. As such, it wipes out the /kernel, /usr, /etc, and /home directories. That wouldn't take a particularly sophisticated bash script. But as far as how the payload was actually delivered to the infected machines, there doesn't seem to be a consensus. This article portrays it as a RAT/botnet style attack via "a central computer providing antivirus protection," which suggests that they may have gained privileged access to an antivirus company's update server and pushed the code out to clients via the antivirus software itself. http://www.guardian.co.uk/technology/2013/mar/22/south-korea-cyber-attack http://www.guardian.co.uk/technology/2013/mar/22/south-korea... Meanwhile, this article attributes it to an executable e-mail attachment with a misleading filename, basically a phishing attack: http://www.infosecurity-magazine.com/view/31475/south-korea-cyber-attacks-likely-sparked-by-phishing-emails/ http://www.infosecurity-magazine.com/view/31475/south-korea-... Some articles described the South Korean government as concluding that the attack came from China, and then later articles say that they backtracked on this and decided it actually came from North Korea. I think this part is heavily politicized, and it's entirely possible that it did come from China but the South Korean government found it more politically expedient to blame it on North Korea instead.
- drzaiusapelord 14y ago
  Reason #452 why I never run AV on servers unless its a file server. AV is just a vector for either fat fingered definitions that destroy your system or a venue for malware to enter your system. I don't trust Sophos and Kaspersky that much. On the desktop, its a tolerated and perhaps necessary evil, but on servers - no way.
- kijin 14y ago
  My current understanding is that the malware was delivered as part of an update to some commonly used ActiveX controls. The initial infiltration took place 8 months ago, but the malware was designed to go live at a specific time [1]. Over 70 different pieces of malware were used to infiltrate a wide range of targets. The bash script was apparently used on non-Windows targets, of which there were only a few. EDIT: The single most effective attack vector seems to have been the update server for an ActiveX control called XecureWeb, which is used by several banks and their 20 million customers [4]. Just checked and I have XecureWeb too, in a VM that I only use for online banking. Good thing I have that VM turned off 99% of the time. According to SK news media, the primary reason the SK government suspects NK of the latest attack is because the attackers used some of the same malware, same proxy servers, and same techniques that were used in previous attacks, which the SK government also attributes to NK [2]. But AFAIK there is no indisputable evidence that links those previous attacks to NK, either. So there's a bit of circular reasoning involved in the accusation. The initial accusation of a Chinese attack was based on a Chinese IP address (101.106.25.105) that was used by the attackers. This accusation was rescinded when it was found that one of the banks that were hacked have been using the same IP range in its internal network </facepalm> [3]. But even if this wasn't the case, the case for a Chinese attack would be weak because anyone can use a Chinese open proxy. There was also mention of an North Korean IP address (175.45.178.x) being used for command & control [2], but I don't know how that works because SK ISPs are extremely unlikely to permit any traffic to or from NK IP addresses. Remember, this is a country that censors virtually every NK-operated website. All in all, little direct evidence that links the attacks to NK has been released. Maybe such evidence exists but is classified. Maybe it doesn't exist in the first place. However, since the series of attacks over the last few years targeted SK's major financial, governmental, and media infrastructure, it is not too unreasonable to suspect that the attackers (or whoever hired them) have an axe to grind with SK as a whole, not with any particular corporation. Given the extremely polarized political landscape, it is also not unreasonable to suspect that someone who has a problem with SK might sympathize with NK. What doesn't get mentioned amid all the finger-pointing and political rhetoric is that SK's internet infrastructure desperately needs a major overhaul. The so-called "security" companies, who sell ActiveX controls with various alleged benefits, have been in charge of IT policy for over a decade. This has led to an online landscape where it is considered normal for any random website to ask the user to restart IE as administrator and install 5 ActiveX controls just to be able to log in. This is a completely separate problem from antiviruses. I'm not joking when I tell you that every bank requires you to install an ActiveX control that claims to detect and disable keyloggers. That's 1000x more evil than Norton Antivirus. [1] http://news.khan.co.kr/kh_news/khan_art_view.html?artid=201304102221475&code=940202 http://news.khan.co.kr/kh_news/khan_art_view.html?artid=2013... [Korean] [2] http://www.hani.co.kr/arti/economy/it/582269.html http://www.hani.co.kr/arti/economy/it/582269.html [Korean] [3] http://www.hani.co.kr/arti/economy/it/579266.html http://www.hani.co.kr/arti/economy/it/579266.html [Korean] [4] http://news.mt.co.kr/mtview.php?no=2013040922225524474&VRF http://news.mt.co.kr/mtview.php?no=2013040922225524474&V... [Korean] UPDATE: More links. ADDENDUM: In a previous comment [5], I argued that Ahnlab is an upstanding company that is unlikely to be involved in malicious activities. Turns out one of their products actually was exploited during the latest attack, though it was not their flagship antivirus suite. [5] https://news.ycombinator.com/item?id=5407719 https://news.ycombinator.com/item?id=5407719

27 points by techinsidr 14y ago

There is no way in the world that North Korea developed the expertise to affect this kind of attack in-house, even if it is a relatively simple piece of malware. My guess is that the Chinese have been supporting them in a limited way. China doesn't really have a motivation to encourage North Korea's ridiculous antics and belligerent behavior of late, but it does have a great deal of interest in testing out its own cyber-attack vectors on real-world targets. If they were to directly attack the computers of another nation themselves the world will go into an uproar and their trade will suffer. On the other hand, if North Korea does it we've gotten to the point, collectively, where we don't do much more than roll our eyes and shrug it off. It's a bit like when the Gemans decided to test tank warfare by getting involved in the Spanish Civil War.

duked 14y ago
Honestly it doesn't require the help of China or any other country to build such a simple malware. It's not because the country has limited internet access that they are completely clueless. If it's intended, organized by the DPRK government I assume they must have a team of "cyber specialists". I personally doubt that needed china's help for such a simple malware. For info: http://www.symantec.com/connect/blogs/south-korean-banks-and-broadcasting-organizations-suffer-major-damage-cyber-attack http://www.symantec.com/connect/blogs/south-korean-banks-and... http://www.symantec.com/connect/blogs/remote-linux-wiper-found-south-korean-cyber-attack http://www.symantec.com/connect/blogs/remote-linux-wiper-fou...
fixxer 14y ago
I think Anonymous needs to get into this full. I don't see boots on the ground happening (thank god, because it'll be lose-lose).
Spooky23 14y ago
The DPRK does some IT Offshoring stuff, particularly for Europeans. There was an article about it last summer in the Communications of the ACM.
EliRivers 14y ago
Unless they, you know, have internet access, some hardware to play around with and the ability to read.
- nwh 14y ago
  For the most part they don't though.
  - EliRivers 14y ago
    So this is unlikely to be the work of some punk kid in a village two hundred miles from Pyongyang. I suppose there is the one in a million chance that the DPRK government might have arranged some kind of group that does have internet access and a mandate to cause problems for the country they're at war with.
  - zokier 14y ago
    You don't need most parts. You need a handful of people.
- jmsduran 14y ago
  It is more likely that an elite group in Pyongyang has internet and computer access, with a subset of that group given more privileges to engineer & deploy malware/etc. Given that though, I find it rather hard to believe the North Korean government could pull off a cyber-attack like this all by themselves, especially when you take into account the effect of international sanctions and the North's very outdated technology (I remember reading they still use a 1960's crank-phone for communication through the DMZ). My best bet is that the Chinese government gave them significant assistance in launching this attack.
  - socillion 14y ago
    There has been some reporting on state-funded North Korean hackers, e.g. http://www.reuters.com/article/2011/06/01/us-korea-north-hackers-idUSTRE7501U420110601 http://www.reuters.com/article/2011/06/01/us-korea-north-hac... No clue how much truth is behind it, I just remember reading about it a while back.

ihsw 14y ago

I was going to make a snide comment about South Koreans using Internet Explorer 6, but apparently usage is way down. http://www.ie6countdown.com/ http://www.ie6countdown.com/

kijin 14y ago
Doesn't really matter, because all the important stuff (like online banking and virtually all government business) still relies on ActiveX controls that were developed in the IE5 days. You can upgrade everyone to IE10 but it won't help because the ActiveX controls are still there.

kyllo 14y ago

Is there an article anywhere that clearly explains the actual attack vector? The bash script ultimately used by the malware is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions, Symantec said. As such, it wipes out the /kernel, /usr, /etc, and /home directories. That wouldn't take a particularly sophisticated bash script. But as far as how the payload was actually delivered to the infected machines, there doesn't seem to be a consensus. This article portrays it as a RAT/botnet style attack via "a central computer providing antivirus protection," which suggests that they may have gained privileged access to an antivirus company's update server and pushed the code out to clients via the antivirus software itself. http://www.guardian.co.uk/technology/2013/mar/22/south-korea-cyber-attack http://www.guardian.co.uk/technology/2013/mar/22/south-korea... Meanwhile, this article attributes it to an executable e-mail attachment with a misleading filename, basically a phishing attack: http://www.infosecurity-magazine.com/view/31475/south-korea-cyber-attacks-likely-sparked-by-phishing-emails/ http://www.infosecurity-magazine.com/view/31475/south-korea-... Some articles described the South Korean government as concluding that the attack came from China, and then later articles say that they backtracked on this and decided it actually came from North Korea. I think this part is heavily politicized, and it's entirely possible that it did come from China but the South Korean government found it more politically expedient to blame it on North Korea instead.

drzaiusapelord 14y ago
Reason #452 why I never run AV on servers unless its a file server. AV is just a vector for either fat fingered definitions that destroy your system or a venue for malware to enter your system. I don't trust Sophos and Kaspersky that much. On the desktop, its a tolerated and perhaps necessary evil, but on servers - no way.
kijin 14y ago
My current understanding is that the malware was delivered as part of an update to some commonly used ActiveX controls. The initial infiltration took place 8 months ago, but the malware was designed to go live at a specific time [1]. Over 70 different pieces of malware were used to infiltrate a wide range of targets. The bash script was apparently used on non-Windows targets, of which there were only a few. EDIT: The single most effective attack vector seems to have been the update server for an ActiveX control called XecureWeb, which is used by several banks and their 20 million customers [4]. Just checked and I have XecureWeb too, in a VM that I only use for online banking. Good thing I have that VM turned off 99% of the time. According to SK news media, the primary reason the SK government suspects NK of the latest attack is because the attackers used some of the same malware, same proxy servers, and same techniques that were used in previous attacks, which the SK government also attributes to NK [2]. But AFAIK there is no indisputable evidence that links those previous attacks to NK, either. So there's a bit of circular reasoning involved in the accusation. The initial accusation of a Chinese attack was based on a Chinese IP address (101.106.25.105) that was used by the attackers. This accusation was rescinded when it was found that one of the banks that were hacked have been using the same IP range in its internal network </facepalm> [3]. But even if this wasn't the case, the case for a Chinese attack would be weak because anyone can use a Chinese open proxy. There was also mention of an North Korean IP address (175.45.178.x) being used for command & control [2], but I don't know how that works because SK ISPs are extremely unlikely to permit any traffic to or from NK IP addresses. Remember, this is a country that censors virtually every NK-operated website. All in all, little direct evidence that links the attacks to NK has been released. Maybe such evidence exists but is classified. Maybe it doesn't exist in the first place. However, since the series of attacks over the last few years targeted SK's major financial, governmental, and media infrastructure, it is not too unreasonable to suspect that the attackers (or whoever hired them) have an axe to grind with SK as a whole, not with any particular corporation. Given the extremely polarized political landscape, it is also not unreasonable to suspect that someone who has a problem with SK might sympathize with NK. What doesn't get mentioned amid all the finger-pointing and political rhetoric is that SK's internet infrastructure desperately needs a major overhaul. The so-called "security" companies, who sell ActiveX controls with various alleged benefits, have been in charge of IT policy for over a decade. This has led to an online landscape where it is considered normal for any random website to ask the user to restart IE as administrator and install 5 ActiveX controls just to be able to log in. This is a completely separate problem from antiviruses. I'm not joking when I tell you that every bank requires you to install an ActiveX control that claims to detect and disable keyloggers. That's 1000x more evil than Norton Antivirus. [1] http://news.khan.co.kr/kh_news/khan_art_view.html?artid=201304102221475&code=940202 http://news.khan.co.kr/kh_news/khan_art_view.html?artid=2013... [Korean] [2] http://www.hani.co.kr/arti/economy/it/582269.html http://www.hani.co.kr/arti/economy/it/582269.html [Korean] [3] http://www.hani.co.kr/arti/economy/it/579266.html http://www.hani.co.kr/arti/economy/it/579266.html [Korean] [4] http://news.mt.co.kr/mtview.php?no=2013040922225524474&VRF http://news.mt.co.kr/mtview.php?no=2013040922225524474&V... [Korean] UPDATE: More links. ADDENDUM: In a previous comment [5], I argued that Ahnlab is an upstanding company that is unlikely to be involved in malicious activities. Turns out one of their products actually was exploited during the latest attack, though it was not their flagship antivirus suite. [5] https://news.ycombinator.com/item?id=5407719 https://news.ycombinator.com/item?id=5407719