South Korea Bank Hacks: 7 Key Facts

Data-wiping attacks on Windows and Linux computers may have just focused on random targets to cause chaos, security researchers say.



Who Is Hacking U.S. Banks? 8 Facts (click image for larger view and for slideshow)

The online attacks launched against multiple banks, insurance companies and television stations in South Korea Wednesday knocked targeted networks offline. But according to security experts, the attacks were relatively unsophisticated and would have required little infrastructure or expertise to launch.

That's one of the early takeaways from studies of the attack techniques and malware used in the South Korean cyber attacks, which began Wednesday at about 2:20 p.m. local time. South Korean broadcasters KBS, MBC and YTN, as well as the Jeju, Nonghyup and Shinhan banks, saw their computer networks get knocked offline after their PCs were infected with data-deleting malware.

Here's what's currently known about the attacks:

1. DarkSeoul Malware: No Awards For Sophistication

Sophos, has analyzed the malware -- which it dubbed "DarkSeoul" -- used in the attack, and found that the malicious code attempted to deactivate two antivirus products that are popular in South Korea: AhnLab and Hauri AV. Despite that, however, the malware hardly qualifies some advanced persistent threat.

[ Were known security flaws an issue in this attack? Read HTTPS Security Encryption Flaws Found. ]

"What's curious is that the malware is not particularly sophisticated. Sophos products have been able to detect the malware for nearly a year, and the various commands embedded in the malicious code have not been obfuscated," said Graham Cluley, senior technology consultant at Sophos, in a blog post. "For this reason, it's hard to jump to the immediate conclusion that this was necessarily evidence of a 'cyberwarfare' attack coming from North Korea."

Mikko Hypponen, chief research officer at F-Secure, likewise noted that the malware was relatively unsophisticated. "Out of all the possible things you could do with a compromised machine, wiping it empty is the least useful thing for an advanced attacker," he said on Twitter.

2. Targeted Organizations Still Struggling To Recover

Whether or not the malware rates as highly advanced, the targeted organizations' networks were paralyzed after the Wednesday attacks, leading to disruptions that disabled ATMs and smartphone banking websites for the financial firms. Targeted television stations, however, were able to continue broadcasting.

By Thursday, many of the affected organizations reported that they'd restored their networks, but had yet to fully recover all of their wiped PCs. "We successfully recovered our mainstay network related to programming and advertising this morning, and normalized our service," an official at Korea's largest television station, KBS, told South Korea's Yonhap News Agency. "But we are still working to recover around 5,000 personal computers that came under the attack, and our website is still inaccessible."

3. Malware Included Linux Wiping Capability

As that suggests, the malware used in the attacks was quite effective at deleting data. According to research published by Symantec, the malware -- which it dubbed Trojan.Jokra -- "is a Trojan horse that attempts to wipe the hard disk of the compromised computer" and can infect numerous versions of Windows (Windows 2000, Windows 7, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Server 2008, Windows Vista and Windows XP) as well as Linux systems.

The malware wiped Windows computers by overwriting their master boot record (MBR) and any data stored on the PC, then instructed the PC to shut down, "which renders the computer unusable as the MBR and the content of the drive are now missing," according to Symantec's analysis.

The malware also includes a module designed to remotely wipe any Linux machines that are connected to the same network as the infected PC. "We do not normally see components that work on multiple operating systems, so it is interesting to discover that the attackers included a component to wipe Linux machines inside a Windows threat," Symantec said. "The included module checks Windows 7 and Windows XP computers for an application called mRemote, an open source, multi-protocol remote connections manager."

An XML file maintained by mRemote lists saved connections with remote systems, and the malware "parses this XML file for any connection with root privileges using the SSH protocol," said Symantec. The malware then uses a bash script to upload and execute a temporary file on the Linux system. "The bash script is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions," according to Symantec. "It wipes out the /kernel, /usr, /etc, and /home directories."

1 of 2