Feeds

South Korean TV and banks paralysed in disk-wipe cyber-blitz

Too early to blame network meltdown on Norks

Reducing security risks from open source software

Banks and TV stations in South Korea have been hit by a debilitating attack on their computer networks.

Three financial institutions - Shinhan, Nonghyup and Jeju - and two insurance firms as well as broadcasters KBS, MBC and YTN have either been partially or completely crippled by malware, it appears, according to South Korean news agency Yonhapnew.

PCs on the networks of TV stations crashed and couldn't be restarted; some displayed an error message claiming that their boot records had been destroyed, as seen in news coverage here and here. Some reports suggest that images of skulls appeared on some computer screens. The attack started at 1400 local time today.

Telly programmes continue to be transmitted despite the problems. However internet banking and cash machines operated by Shinhan Bank are not functioning. South Korean ISP LG Uplus has also been hit by the assault. Government computer networks remain largely unaffected, according to an official from the National Computing and Information Agency (NCIA). However some important websites, including KCNA and Air Koryo, were rendered temporarily inaccessible.

The authorities are trying to identify the cause of the problem. Files named KBS.exe and MBC.exe, which began circulating last week, could be key components for distributing the disk-wiping malware that apparently brought down the networks. The situation remains confused but already thoughts are turning towards who could have launched the attack; North Korea is emerging as a prime suspect.

"We do not rule out the possibility of North Korea being involved, but it's premature to say so," South Korea's Defence Ministry spokesman Kim Min-seok told the BBC.

Christopher Boyd, senior threat researcher at ThreatTrack Security, commented: “There have been numerous serious attacks on South Korean networks and systems over the last few years, from recent newspaper site defacements and the most recent network attacks to the so-called 'Ten Days of Rain' distributed denial-of-service [DDoS] attacks on multiple government sites and the United States Forces Korea in 2011.

"While it's tempting to attribute these attacks to the North given the current state of play in the region, many attacks are not so easy to pin down: the 'Ten Days of Rain' used compromised machines inside South Korea to launch the DDoS attacks.

"In 2009 the JoongAng Daily claimed that a South Korean man allegedly purchased infected games in North Korea, only to take them back home and infect other gamers - using them to DDoS the website of the Incheon International Airport. Recent reports that North Korea itself claims to have been knocked offline by hackers does nothing to clarify the issue, and in this 'tit-for-tat' environment we should be wary of attributing any blame until the full facts emerge.”

Some Koreans spread screen grabs of a social-networking website on which a group calling itself the "Whois Team" claimed responsibility for the outages; some captured the crew's boasts in a video uploaded to YouTube. However LG UPlus Corp, the ISP behind the social network, denied the existence of such pages on its website, Reuters reports.

The attack appears to be wide-ranging, coordinated and targeted at high-profile institutions in South Korea. The South Korean military cyberattack readiness level was raised from three to four on the five-tier system, The Guardian reports. Defence minister Kim Kwan-jin convened a meeting to discuss the attacks.

North Korea was blamed for two previous cyber-attacks against its southern neighbour, in 2009 and 2011, that targeted government agencies and banks. Last week North Korea's official news agency KCNA blamed the US and its allies for computer hacking attacks against its networks. Political tensions on the Korean peninsular have been running high for weeks since recent rocket and nuclear tests by the North Koreans. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.