Slashdot Mirror
S. Korea Says Cyber Attack From North Wiped 48,700 Machines
wiredmikey writes "An official investigation into a major cyber attack on South Korean banks and broadcasters last month has determined that North Korea's military intelligence agency was responsible. An investigation into access records and the malware used in the attack pointed to the North's military Reconnaissance General Bureau as the source, the Korea Internet and Security Agency (KISA) said on Wednesday. To spread the malware, the attackers went through 49 different places in 10 countries including South Korea, the investigation found. The attacks used malware that can wipe the contents of a computer's hard disk (including Linux machines) and damaged 48,700 machines including PCs, ATMs, and servers."
Just makes me wonder what war is turning into. Instead of bombing cities, I can see nations targeting unprotected civilian computers in enemy nations. Massive destruction ensues, even though it's imprecise. In other words: bombing, but without all the mess.
Rice farmers in North Korea are not vulnerable to hacking. One of the most technologically sophisticated countries just South of that border is.
Amazing how much damage an armada of russian ZX Spectrum clone can do.
They must have found the ultimate hacking tool for data erasure.. the vulnerability, believe it or not.. is called fdisk
Symantec has an analysis of the linux component. It relies on extracting a history of ssh connections from windows machines from an application called mRemote, an open source, multi-protocol remote connections manager.
When our name is on the back of your car, we're behind you all the way!
People, N. Korea has declared war. Time to make a backup...
+1 informative, in my book...
I guess BSD is immune :P
(because they didn't add a case for it).
Just think about all of those hours lost playing StarCraft.
In other news, the entire population of South Korea is now looking for that 1 StarCraft CD so they can install it on all their machines again.
If this is true, they're significantly more of a threat than what their paltry nuclear and rocket propulsion levels convey.
I would laugh my ass off if N.Korea turned the world on its head with a sudden penchant for technology and digital security research.
Rice farmers in SK aren't either. However, NK missiles are not Estes rockets connected to a car battery (even though a 12 year old with their finger on the button may be an accurate analogy). You are mistaken if you think NK doesn't have any technology.
only made possible by piss poor security; wake up and smell the coffee, s. korea IT people
highlights the need to do nightly backups of critical data!
Wonder if North Korea was the original target, and the malware leaked out into the wild...
Most norks have fuck all because their government spends all their money on the military. These were military hackers. Comprende?
have her drive down to the DC, start restoring tapes, and for the love of god quit with the pissing contest. its becoming apparent the US, as well as both koreas are incapable of understanding the repercussions of a thermonuclear war.
Good people go to bed earlier.
Pull the other what? And why did you say that twice?
The advantage of a toot login vs root is that it uses a double olfactory authentication. Plus it just feels good.
It occurs to me that the North Korean regime is probably secretly very unpopular in North Korea, even among top military and government officials but the officials are too distrustful of each other to scheme together against the regime. So perhaps their current belligerence is actually their way of trying to end their own regime - they advocate seemingly patriotic actions such as attacking/threatening the rest of the world - while their true intention is to provoke the world into destroying their regime. Once an international force attacks, the officials go into hiding and decline to fight, allowing an international peacekeeping force to take over, like what happened in Iraq during the first gulf war.
How did the North get the equipment to do this? From China or Russia? I thought they were way behind the rest of the world in technology?!?!?
If I understand correctly (do I?) the way it attacked Linux systems was that some people use a ssh client, where they literally have a preference or setting stored, for logging into the Linux machine as root. User clicks something (which does the equivalent of "ssh root@whatever" and the software automatically supplies a key or passphrase) and the next thing they see is a root bash prompt. Wow.
If that's right, then assuming your Linux machines still have
in /etc/ssh/sshd_config, then your setup isn't compatible with this malware. You'll need an updated version of this malware.
All machines should have "PermitRootLogin no" and if yours doesn't, you're doing something very very strange. Maybe you should go check that, right now. It'll take .. seconds.
That said, things still aren't very rosy. Presumably the user of this ssh client would also have non-root passwords or keys stored too, to get non-root access. But how many of us usually login as a user with some sudoers powers? And how many of us have a very lazy sudoers configuration, where you're literally allowed to just do "sudo -s" and get a root shell, by only having to type in your password again?
So my earlier "joke" about you needing an updated version of malware, might not really be all that much of a joke.
Tighten up your sudoers file if you can. And whether you can or not, have ssh use key authentication instead of password authentication, so that no remote clients can, or need to, have your password stored in them.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
I'm surprised they opted to wipe the compromised machines. North Korea has a long history of earning hard-currency funds through illicit activity (counterfeiting, drug-smuggling, etc). By wiping their targets, they've lost the possibility of using them to turn a fraudulent profit.
Probably means someone over there needed a short-term propaganda coup for internal political reasons.
Of course I mean "PermitRootLogin no" fixes it .. or rather, might not really fix it.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
All the vulnerable machines were wiped. So now there are no vulnerable machines anymore. Second attack will be much harder. And the percentage of Korean users doing proper backups will probably be growing :-) (Not that I'm saying people in Korea are more negligent with backups than others).
That was Windows8....
is this the same attack that after a few days of investigation, they actually found out was coming from their own organization?
1) Shut down your own servers
2) claim you are the victim of "ULTRA DANGEROUS SUPER FATAL CYBERSEX RAPE!!111!1!"
3)???
4) PROFIT!11!
Have you audited all your rice's genes? A leaked Monsanto report said most versions have a buffer-overflow bug somewhere in chromosome 6, but they didn't say exactly where. Unless North Korea buys their seed rice from Theo De Raadt...
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Elite hackers from North Korea? Pull the other one. Most people in NK don't even have access to computers. Those who do are stuck with Red Star OS and a BBS. No, something like this malware would have to come from an very advanced country. USA or South Korea maybe? It's all part of the propaganda war.
NK has a very strong IT sector - http://spectrum.ieee.org/podcast/at-work/tech-careers/for-outsourcing-it-have-you-considered-north-korea
I will never think of the word "norks" quite the same again.
Wonder if North Korea was the original target, and the malware leaked out into the wild.
I wonder if the miscreant just used NK to carry out the attack, in order to incriminate them. I'm lookin' at you, CIA. I must say I'm also a bit surprised to learn that NK allows any connection to the net outside its borders, especially to SK (the enemy).
"Tongue tied and twisted, just an Earth bound misfit
I felt a disturbance in the force. As if thousands of Korean Starcraft characters all cried out at once then were deleted.
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
What equipment? A computer? From Newegg. The general population of NK is way behind, largely BECAUSE the government spends all the money on military and political posturing. Their military, apparently including cyber-warfare, is quite well funded.
If for some reason you can't use: PermitRootLogin no Consider allowing root login only with a key, not with a password: PermitRootLogin without-password If you do allow root login with a key by using "without-password", use a passphrase on the key if possible. That gives two factor security. something you have (the key) plus something you know (the passphrase). For automated SSH login such as remote cron, consider "command=" to an ssh key, so it can run as root, but it can only execute that one command.
None of which helps if you have a piece of software storing all the credentials you need to log onto a remote machine.
If they got them from Theo De Raadt, they will be secure, but hard to grow, and not very healthy. His mouth will also tempt people to attack your rice fields.
I've heard "the victim deserves it for not protecting themselves" a couple of dozen times, ad ALWAYS from thieves, as an excuse. Therefore, most likely sildur and iggy are simply common thieves who are too stupid to even come up with a halfway logical sounding excuse to tell themselves.
sildur, your house must be surrounded by razor wire, and you've replaced all those nice breakable windows in your house and car with solid steel, right?
You COULD do those things to protect yourself, so if you don't do them, it's perfectly okay for me to smash your windows and steal your stuff, right? That's what you said, is it not?
Most likely you fail at logic forever, because for no reason you equate "victim deserves it == perpetrator is innocent" and "didn't take basic steps to secure it == didn't go over US Defense Budget to secure it".
I'm pretty sure sildur locks his front door when going out to the bar instead of leaving it wide open, and I'm pretty sure you'd at least raise a brow hearing about him getting robbed if he didn't.
I once had a colleague who talked incessantly about norks, or "norx" as he spelt it. Chebs was his other favourite word. I've always been partial to jubblies myself.
Audit *all* genes? That is like asking someone to determine if a database has hidden data when all you can do is use a SELECT statement. In other words, you aren't going to find anything bad unless you know what to look for.
Yes, I know I'm completely missing the point of the comment.
Sometimes the world seems so big. I had never come across a meaning of "nork" other than as short for "north korean" until now. Needless to say, I like your norks better. Wait...
Well, there you go. Did you hear that? That was the sound of the last Slashdot reader FINALLY realizing Linux is basically the Mac OS (insecure but not typically targeted). Oooooh, you Windows PC users get soooo many viruses! You should switch to this Linux PC because it's magic and invincible and has ground up unicorn horns as thermal paste on the CPU. Get over it.
If you think my comment actually had a point, then you missed the point. :-)
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Most likely you fail at logic forever
Why, because he pointed out the truth?
victim deserves it == perpetrator is innocent
If the victim deserves it, then you mean that they are morally culpable. Which can only mean that the other party - which is solely responsible for taking the action in question, and absent taking that action nothing would happen - is morally in the right in taking that action.
Your own weasle words ("most likely" on a matter of logic?) show you're just another spineless moral relativist.
Don't disappoint your bird dog. Go to the range.
No, because he repeats same strawman as you. By the way, "most likely" there was just mirroring parent post, but hey, attacking word choice and adding ad hominem to your list of logic errors feels good, eh?
If the victim deserves it, then you mean that they are morally culpable. Which can only mean that the other party - which is solely responsible for taking the action in question, and absent taking that action nothing would happen - is morally in the right in taking that action.
Yay, ain't it nice living in a binary world? Black and white's all we need.
Anyways, yeah, applying your logic, as failure to take steps for basic security of your computer creates unnecessary potential hazard for other computers on the net, those NK hackers did a good thing to simpy disable them by wiping, instead of realizing that hazard by installing a DDoS bots. I see you agree with GGGP then, no need for "bombing innocent population" strawmen there.
Too bad you don't think they could done a good thing by hacking into and then fixing the security on those computers instead, so here I disagree with you.
Personally I'd prefer no internet access to North Korea over a wiped computer. So how about we just disconnect them from the global internet instead?
I pop high security locks with slivers of steel for fun. There are many of us. To me, outside the DoD everyone's physical security is poor. Do you believe that you deserve your car to be stolen and your house to be ransacked just because you aren't a domain expert in physical security? I don't. Are you inviting me to take all your stuff? That is wrong. It always has been wrong. In this case it is wrong and you are wrong.
From the symantec analysis:
"The bash script is a wiper designed to work with any Linux distribution, with specific commands for SunOS, AIX, HP-UX distributions."
Sorry, but when did those three become linux distros/
Funded by what? What is NK exporting that gives them money to actually buy shit?
"Dre don't get as high as me.... I'm Cheech and Chong" - Snoop Dogg
Yay, ain't it nice living in a binary world? Black and white's all we need.
Asserting that SK deserves being attacked is exactly such a binary position. They either do deserve to be attacked, or they do not. Tap-dancing around that is just BS.
Don't disappoint your bird dog. Go to the range.
Among other things missiles and missile tech. Iran pays hard cash for that.
US-UK-Israel: The real Axis of Evil
I have am not mistaken they also have mines digging up some valuable elements.
Interestingly, I just started playing with Rootkit Hunter a couple of weeks back, and it complained when it saw "PermitRootLogin yes".
Since I didn't know that existed, it was either set that way by the very popular distribution I'm using OR (unlikely) by an external force. I'm sure no expert, but allowing login as root via SSH just didn't sound like a good idea. Maybe it's all those 'Security Now' episodes.
"You must try to forget all you have learned. You must begin to dream." -- Sherwood Anderson
No way North Korea did that.
It's pointless, from the military prospective, and so unfit for their way of thinking.
Either, some kid hacker messed things up, and the South needs someone to blame,
or someone is trying to sell "security" to the South.
None of which helps if you have a piece of software storing all the credentials you need to log onto a remote machine.
If you follow my suggestion and use command="", it certainly DOES help that that login can only run "startbackup" and nothing else.