Feeds

South Korean TV and banks paralysed in disk-wipe cyber-blitz

Too early to blame network meltdown on Norks

Top three mobile application threats

Banks and TV stations in South Korea have been hit by a debilitating attack on their computer networks.

Three financial institutions - Shinhan, Nonghyup and Jeju - and two insurance firms as well as broadcasters KBS, MBC and YTN have either been partially or completely crippled by malware, it appears, according to South Korean news agency Yonhapnew.

PCs on the networks of TV stations crashed and couldn't be restarted; some displayed an error message claiming that their boot records had been destroyed, as seen in news coverage here and here. Some reports suggest that images of skulls appeared on some computer screens. The attack started at 1400 local time today.

Telly programmes continue to be transmitted despite the problems. However internet banking and cash machines operated by Shinhan Bank are not functioning. South Korean ISP LG Uplus has also been hit by the assault. Government computer networks remain largely unaffected, according to an official from the National Computing and Information Agency (NCIA). However some important websites, including KCNA and Air Koryo, were rendered temporarily inaccessible.

The authorities are trying to identify the cause of the problem. Files named KBS.exe and MBC.exe, which began circulating last week, could be key components for distributing the disk-wiping malware that apparently brought down the networks. The situation remains confused but already thoughts are turning towards who could have launched the attack; North Korea is emerging as a prime suspect.

"We do not rule out the possibility of North Korea being involved, but it's premature to say so," South Korea's Defence Ministry spokesman Kim Min-seok told the BBC.

Christopher Boyd, senior threat researcher at ThreatTrack Security, commented: “There have been numerous serious attacks on South Korean networks and systems over the last few years, from recent newspaper site defacements and the most recent network attacks to the so-called 'Ten Days of Rain' distributed denial-of-service [DDoS] attacks on multiple government sites and the United States Forces Korea in 2011.

"While it's tempting to attribute these attacks to the North given the current state of play in the region, many attacks are not so easy to pin down: the 'Ten Days of Rain' used compromised machines inside South Korea to launch the DDoS attacks.

"In 2009 the JoongAng Daily claimed that a South Korean man allegedly purchased infected games in North Korea, only to take them back home and infect other gamers - using them to DDoS the website of the Incheon International Airport. Recent reports that North Korea itself claims to have been knocked offline by hackers does nothing to clarify the issue, and in this 'tit-for-tat' environment we should be wary of attributing any blame until the full facts emerge.”

Some Koreans spread screen grabs of a social-networking website on which a group calling itself the "Whois Team" claimed responsibility for the outages; some captured the crew's boasts in a video uploaded to YouTube. However LG UPlus Corp, the ISP behind the social network, denied the existence of such pages on its website, Reuters reports.

The attack appears to be wide-ranging, coordinated and targeted at high-profile institutions in South Korea. The South Korean military cyberattack readiness level was raised from three to four on the five-tier system, The Guardian reports. Defence minister Kim Kwan-jin convened a meeting to discuss the attacks.

North Korea was blamed for two previous cyber-attacks against its southern neighbour, in 2009 and 2011, that targeted government agencies and banks. Last week North Korea's official news agency KCNA blamed the US and its allies for computer hacking attacks against its networks. Political tensions on the Korean peninsular have been running high for weeks since recent rocket and nuclear tests by the North Koreans. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.