Slashdot Mirror
South Korea Backtracks On China As Source of Cyberattack
hackingbear writes "The suspected cyberattack that struck South Korean banks and media companies this week didn't originate from a Chinese IP address, South Korean officials said Friday, contradicting their previous claim. The Korea Communications Commission said that after 'detailed analysis,' the IP address used in the attack is the bank's internal IP address — which is, coincidentally identical to a Chinese ISP's address, among the 2^32 address space available."
http://www.theonion.com/articles/kim-jongun-privately-doubting-hes-crazy-enough-to,18374/
The bank used public IP addresses (existing, used elsewhere) for their internal network? The one that designed that should be considered a bigger security threat that any current cyberattack.
BTW, the CNN editorial "Why cyber attacks threaten our freedom" is another piece of art of more or less the same magnitude. I'd say that is on a par with this one
Who wants to bet that China instigated some North Korean pressure to back off?
On my home network, I use the private 24-bit block 10.x.x.x, in case I buy more than 16 million devices. Is the article saying that they decided to map public IPs they didn't own to internal devices? Notwithstanding the confusion such cases like the above would cause, this bank could conceivably leak banking data out to that Chinese ISP!
All the articles I can find are equally uninformative.
How Mani other countries would admit this instead of just continuing to blame the big bad boogyman?
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
So who is the joker that configured that bank's system? They probably have many other issues.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
You know, someone keeps calling her saying he will kill her? And then the police trace the call to find that it is coming from inside the house?
"Get out of the house, the calls are coming from upstairs!"
In this case, they have traced the attacks to be coming from IP address 127.0.0.1
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
aren't the sharpest knives in the hibachi.
What, they didn't recognize the source address of the attack to be either one of their own allocated addresses, or a NAT private use address? No wonder it was so easy to circumvent the bank's security.
Gangbamk Style.
Err wtf? There is no 2^64 address space and we have been moving to 2^128 for over a decade already.
Yes. The next question of course is whether to go deep or wide. Heaps are devastated sometimes by going wide.
What.. are 17.8m raw reserved LAN IP addresses not enough? Hell.. I bet even the PR dept. in the US knows how to subnet. I'll just leave this here.. : http://www.youtube.com/watch?v=EYWZZlVlFb4
Korean Banks forces its customers to use ActiveX & IE6.
http://www.techdirt.com/articles/20120507/12295718818/south-korea-still-paying-price-embracing-internet-explorer-decade-ago.shtml
>At the end of the 1990s, Korea developed its own encryption technology, SEED, with the aim of securing e-commerce. Users must supply a digital certificate, protected by a personal password, for any online transaction in order to prove their identity. For Web sites to be able to verify the certificates, the technology requires users to install a Microsoft ActiveX plug-in.
http://seoulspace.co.kr/2010/03/09/ie6-no-more-not-in-korea/
>With all of this momentum against IE6, one would think that IE6 will soon become a problem of the past but in Korea, this is far from true. Internet Explorer holds over a 95% market share in Korea and many estimates peg market share for IE6 to be over 50%. Why the popularity of Internet Explorer in Korea? The main reason is Active-X. Many Web sites in Korea require Active-X whether you want to do online banking, shop online or even browse a social network. This means users have no choice but to use Internet Explorer.
come on, nobody really believes that this was a bank IT error, right? Obv the chinese struck a deal / strongarmed SK to throw its own under the bus.
Uhh - the article suggests that the attack has been traced to a bank's own IP address. That doesn't seem to suggest the bank's IT department made some stupid mistake. To me, it sounds like that bank's server was compromised, then used to make the attack. Further investigation of that machine may demonstrate that it was an inside job, done by someone with physical access to that machine. Or, that NK or China accessed the machine via the internet. At this point, it's anyone's guess.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
There is no reason at this stage why a bank shouldn't be using IP6 unless IP6 isn't adopted yet in South Korea by the ISP's. If they are confined to IPV4 addresses then they should be using NAT translation to the outside. I think some really dumb admin either used public IP's on his private network or they were too dumb to recognize that the reserved IP4 address space for LAN's was the orrginator of the attack. In either case this makes me think a run on the bank is necessary because I certainly wouldn't want to see them holding on to my money. They need to hire a couple of CCIE's to get their network right. Oh, by the way, interested in Previewing Windows 8 without Installing Over Your Desktop? Or interested in running a Test MSSQL Cluster on Free Virtualization? Or want to know What is Virtualization in Laymen's Terms? Or interested in a Good ESX Whitebox Setup for Experimental Use?
I wonder if China got pissed off about being publicly implicated based on nothing more than an IP address (which means nothing) and put pressure on the SK government to put pressure on this Bank to change their story?
They traced it back to an internal IP that happened to be the same as some public IP.
Surely an IT department has to be rather stupid if they managed to do this
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Then maybe they should look at using something other than a /24. Usually this is just laziness, where it's easier/more-convenient to assign a /24 to every little unit. There is an advantage in that it's easier to read the addresses, but this comes at the drawback of using up private address-space much quicker.
Using public address-space for private subnets is just an overall terrible idea. A mis-configured firewall, change-over of gear with default settings, routing issue, or any number of things and you have the potential for either:
a) A private machine ending up live on the internet
or
b) Going out to a machine that's live on the internet instead of the internal machine
All it takes is a weak firewall rules and a machine without a gateway/route to the internal box and BLAMMO, suddenly traffic intended for the inside is headed out (and to China, no less).
My Dear Friend, I have it on good authority that Natalie and her father had EVERYthing to do with your Internets.
my guess on this is NK, because of the ongoing hostilities. they are surprisingly advanced at cyber stuff. i think war will eventually happen, after which SK will have to absorb the impoverished north into a single country, and try to maintain their own standard of living!
If someone is smart enough to pull an attack like this, I would hope they would be clever enough to hide the IP where the attack was originated. How hard could it be, really?
In the worst case scenario, they could always recruit Chinese students overseas to originate attacks from within universities, no?
Because they were lazy/incompetent?
As much as techies would love to believe that some other techie made a monumental error, it is more likely that this is a by-product of the attack. Either politically, to shift the blame or just plain and simple messing with network to make things harder to trace.
Heh, I remember when a company I worked for used 192.100.0.0 for an internal address. I remember huachuca.army.mil being the "real" owner of that, but checking now, they no longer are. I have no idea who shared the IP of our mail server, but it caused no end of trouble. I pointed out the problem, but he was the IT manager (under the CIO, so he wasn't top dog), so pissing him off by writing a paper on why it was a monumentally stupid thing (as part of a business case to re-IP servers, no easy task) managed to shorter my time there. So I can see how that could happen. If the email server had become compromised, I might have tracked it down to the US military attacking me.
But what was the IP? Were they improperly using a public address as private? Fire the guy who made that decision. Come on, who, in charge of setting IP addresses hasn't heard of rfc 1918?
Learn to love Alaska