Slashdot Mirror
South Korea Backtracks On China As Source of Cyberattack
hackingbear writes "The suspected cyberattack that struck South Korean banks and media companies this week didn't originate from a Chinese IP address, South Korean officials said Friday, contradicting their previous claim. The Korea Communications Commission said that after 'detailed analysis,' the IP address used in the attack is the bank's internal IP address — which is, coincidentally identical to a Chinese ISP's address, among the 2^32 address space available."
http://www.theonion.com/articles/kim-jongun-privately-doubting-hes-crazy-enough-to,18374/
The bank used public IP addresses (existing, used elsewhere) for their internal network? The one that designed that should be considered a bigger security threat that any current cyberattack.
BTW, the CNN editorial "Why cyber attacks threaten our freedom" is another piece of art of more or less the same magnitude. I'd say that is on a par with this one
Who wants to bet that China instigated some North Korean pressure to back off?
On my home network, I use the private 24-bit block 10.x.x.x, in case I buy more than 16 million devices. Is the article saying that they decided to map public IPs they didn't own to internal devices? Notwithstanding the confusion such cases like the above would cause, this bank could conceivably leak banking data out to that Chinese ISP!
All the articles I can find are equally uninformative.
How Mani other countries would admit this instead of just continuing to blame the big bad boogyman?
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
So who is the joker that configured that bank's system? They probably have many other issues.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
You know, someone keeps calling her saying he will kill her? And then the police trace the call to find that it is coming from inside the house?
"Get out of the house, the calls are coming from upstairs!"
In this case, they have traced the attacks to be coming from IP address 127.0.0.1
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Err wtf? There is no 2^64 address space and we have been moving to 2^128 for over a decade already.
What.. are 17.8m raw reserved LAN IP addresses not enough? Hell.. I bet even the PR dept. in the US knows how to subnet. I'll just leave this here.. : http://www.youtube.com/watch?v=EYWZZlVlFb4
come on, nobody really believes that this was a bank IT error, right? Obv the chinese struck a deal / strongarmed SK to throw its own under the bus.
Uhh - the article suggests that the attack has been traced to a bank's own IP address. That doesn't seem to suggest the bank's IT department made some stupid mistake. To me, it sounds like that bank's server was compromised, then used to make the attack. Further investigation of that machine may demonstrate that it was an inside job, done by someone with physical access to that machine. Or, that NK or China accessed the machine via the internet. At this point, it's anyone's guess.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
They traced it back to an internal IP that happened to be the same as some public IP.
Surely an IT department has to be rather stupid if they managed to do this
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Then maybe they should look at using something other than a /24. Usually this is just laziness, where it's easier/more-convenient to assign a /24 to every little unit. There is an advantage in that it's easier to read the addresses, but this comes at the drawback of using up private address-space much quicker.
Using public address-space for private subnets is just an overall terrible idea. A mis-configured firewall, change-over of gear with default settings, routing issue, or any number of things and you have the potential for either:
a) A private machine ending up live on the internet
or
b) Going out to a machine that's live on the internet instead of the internal machine
All it takes is a weak firewall rules and a machine without a gateway/route to the internal box and BLAMMO, suddenly traffic intended for the inside is headed out (and to China, no less).
My Dear Friend, I have it on good authority that Natalie and her father had EVERYthing to do with your Internets.
my guess on this is NK, because of the ongoing hostilities. they are surprisingly advanced at cyber stuff. i think war will eventually happen, after which SK will have to absorb the impoverished north into a single country, and try to maintain their own standard of living!
Because they were lazy/incompetent?
As much as techies would love to believe that some other techie made a monumental error, it is more likely that this is a by-product of the attack. Either politically, to shift the blame or just plain and simple messing with network to make things harder to trace.
Heh, I remember when a company I worked for used 192.100.0.0 for an internal address. I remember huachuca.army.mil being the "real" owner of that, but checking now, they no longer are. I have no idea who shared the IP of our mail server, but it caused no end of trouble. I pointed out the problem, but he was the IT manager (under the CIO, so he wasn't top dog), so pissing him off by writing a paper on why it was a monumentally stupid thing (as part of a business case to re-IP servers, no easy task) managed to shorter my time there. So I can see how that could happen. If the email server had become compromised, I might have tracked it down to the US military attacking me.
But what was the IP? Were they improperly using a public address as private? Fire the guy who made that decision. Come on, who, in charge of setting IP addresses hasn't heard of rfc 1918?
Learn to love Alaska