On War Anniversary, South Korea faces fresh cyber attack

NEW DELHI, INDIA: South Korea seems to be in the eye of a cyber attack storm. On Wednesday - the Korean War anniversary - the South Korean government and media agencies faced a fresh round of attacks, reports global security company, Trend Micro.

The attack, according to the report, began around 9.30 am with the defacement of the Presidential Office - Cheong WaDae's website, and extending to the office of Government Policy Coordination. The defaced website showed message that read "Great leader Kim Jong-un" - North Korea's top Leader.

The unidentified attacker claims to be part of the hacktivist group, Anonymous, who was involved in recent #OpPetrol and #OpUSAoperations, and has posted online what may be 20,000 military personnel information.

Website defacement is only the tip of the iceberg; personal identifiable information of the members of the military and government, including the Presidential Office, and the ruling Saenuri party has been compromised, reckons Trend Micro.

In a statement, Sharda Tickoo, product marketing manager, Trend Micro India, said, "The cyber attack involves the compromise of the auto-update mechanism related to the legitimate installer file, SimDisk.exe. The incident shows that users need to be vigilant about the security of the auto-update mechanism of the vendors they choose to trust. Software vendors are also required to prioritize safeguarding product servers and the overall security of their network using products, considering the impact that a compromise in this area has on their software's users."

According to Trend Labs, the attacker took an unprecedented approach in compromising a cloud storage provider to harvest a large number of botnet in a short period of time. By compromising the server, which hosted the client installation program (SIMDisk Installer EXE), and its update server, a significant number of PCs are compromised when the cloud storage client program automatically updates.

Compared to the previous cyber-attack in March, the attacker has taken this to a whole new level. Instead of compromising an update server within an organization, the attacker compromised a cloud storage provider.

Trend Micro predicts that cyber-attacks will continue to breach critical systems such as application update servers. Therefore, application provider must take greater care in securing their update infrastructure. Secondly, end users should be cautious of freeware and only install programs from trusted vendor.

To prevent such an attack, organizations must ensure their critical systems are patched immediately and monitored for unauthorized changes.

To know more about this threat, click here.