Sign in

back to article Experts finger disk-wiping badness used in S Korea megahack

Antivirus firms have identified the main malware behind a major internet attack that hit corporate computer networks in South Korea on Wednesday afternoon. However the source and motives behind the attack remain a mystery. Researchers have dubbed it DarkSeoul. Computer networks at three South Korean TV stations and at least …

COMMENTS

House rules Send corrections
This topic is closed for new posts.
  1. Anonymous Coward
    Anonymous Coward

    Please wipe all our bank debts out!

    1 0
    1. Destroy All Monsters Silver badge
      Reply Icon
      Holmes

      That's just a political decision that can be made tomorrow.

      I'm sure some people would be very relieved.

      "Donald Trump comes out of Trump Tower and sees a beggar hanging around on the sidewalk. He turns to his valet and says 'Why is this man begging? He has three billion USD more than me!"

      1 0
  2. Eenymeeny
    Thumb Up

    Ace

    OK that was easily the best punning subline ever on Reg. Insightful political comment, too!

    9 0
    1. Gordon 10 Silver badge
      Reply Icon
      Thumb Up

      Re: Ace

      havent read the article yet - came straight in to upvote the subheading.

      1 0
  3. g e
    Terminator

    Please someone officially attribute it to somewhere other than the NORKs

    If only to make FOX look like the utter twats they are.

    0 2
    1. Cipher
      Reply Icon
      FAIL

      Re: Please someone officially attribute it to somewhere other than the NORKs

      g e

      "Please someone officially attribute it to somewhere other than the NORKs

      If only to make FOX look like the utter twats they are."

      So you want some network to report incorrect information just to sate your adolescent dislike of Fox?

      Really?

      1 0
  4. Anonymous Coward
    Happy

    Bravo, Sir

    "The long, dark teatime of the Seoul" Just wondering about how many journalist-hours of waiting it took for an opportunity to use that subline. Perhaps the less pure "The long, dark boot-time of the Seoul" may have offended St Douglas less? ;-)

    2 0
  5. Michael H.F. Wilkinson
    Joke

    Long, Dark Teatime of the Seoul

    It could be the South Koreans doing it to fellow South Koreans they happen to dislike, and give them a excuse to attack North Korea with similar means. This suggests they are in the third stage of warfare according to Douglas Adams:

    1. Retribution: I am going to kill you because you killed my brother

    2. Anticipation: I am going to kill you because I killed your brother

    3. Diplomacy: I am going to kill my brother and then kill you on the pretext that your brother did it.

    2 0
  6. Soruk
    FAIL

    BBC: Pointing finger at China was a mistake

    http://www.bbc.co.uk/news/world-asia-21891617

    Apparently, the "Chinese" IP was used internally by one of the bank servers that had been compromised in the attack.

    Muppets. Couldn't they just use RFC1918 for internal addresses?!

    1 0
  7. Anonymous Coward
    Anonymous Coward

    Best Korea...

    ... needs to learn to update it's AV and patch it's machines, and do perimeter scanning of inbound web browing and email.

    FFS people - it's not bloody rocket science.

    PS - yes, yes I know this doesn't stop 0day expoits, or malware coded to avoid AV signature - however, in this case, it would have stopped this attack dead.

    0 0
  8. Anonymous Coward
    Anonymous Coward

    Data delete?

    fixmbr and back to normal. I thought they deleted data?

    1 0
    1. MacGyver
      Reply Icon
      Facepalm

      Re: Data delete?

      I know, they make it sound like they lost something, other than the <10 minutes that it takes to boot from their PE or recovery CD/DVD and run the OS specific boot recovery command.

      They should be thankful that it happened the way it did, they should take it for the wake-up call that it was. It also might be a good idea in the future to run one antivirus software on half of your infrastructure, and a competing antivirus of the the other half, that way, when this happens again, you won't be completely shutdown and sitting in the dark wondering what was going on.

      0 0
      1. Anonymous Coward
        Reply Icon
        IT Angle

        Data-wiping malware?

        "An analysis by South Korean antivirus firm AhnLab fails to mention this but does explain the data-wiping behaviour of the malware in some depth."

        "Of each physical disk MBR and VBR, up to a maximum of 10 physical disk (\ \ PHYSICALDRIVE0 ~ \ \ PHYSICALDRIVE9) to open the string "PRINCPES" Repeat overwritten. Extend the system partition and extended partition if VBR for each partition until the destruction of the target." link

        0 0
    2. Grogan
      Reply Icon

      Re: Data delete?

      Unfortunately, when they say "the MBR" they mean the first sector of the disk (sector 0), that has the MBR (master boot record) and partition tables.

      If you were to know what happened and use a utility to reconstruct the partition tables exactly as they were (if you just have one partition on the disk it's easy) you could fix it good as new though. You could then use fixmbr (or in the more modern case "bootrec /fixmbr") to make the disk bootable again.

      1 0
      1. Grogan
        Reply Icon

        Re: Data delete?

        I said: "Unfortunately, when they say "the MBR" they mean the first sector of the disk (sector 0), that has the MBR (master boot record) and partition tables."

        Actually, it does worse than that. It doesn't just delete the sector, it overwrites the MBR itself, then extends partitions and stuff to disconnect your data and make it difficult to recover any logical drives. (At least that's what I understood from it)

        See a post further down by dgharmon that has a rough translation from Korean of what it does.

        0 0
        1. Vic
          Reply Icon

          Re: Data delete?

          > extends partitions and stuff to disconnect your data and make it difficult to recover

          Testdisk will get it all back. it always does.

          Vic.

          0 0
  9. tony trolle

    key info on linux killing

    http://blog.trendmicro.com/trendlabs-security-intelligence/how-deep-discovery-protected-against-the-korean-mbr-wiper/

    It uses any stored root credentials to log into remote Linux servers: for AIS, HP-UX, and Solaris servers it wipes the MBR. If it is unable to wipe the MBR, it instead deletes the folders /kernel/, /usr/, /etc/, /home/.

    0 0
  10. Ceiling Cat

    AhnLab? Seriously?

    I didn't know AhnLab even made an Antivirus program. I do know that they make anti-cheat software for K-MMORPGs. Their product, Hackshield, is absolutely BRILLIANT at stopping legit players from playing, while allowing the cheaters to get on with ruining the games that it is being used to protect.

    Imagine that : It's OK to edit network packets so that you can do obscene amounts of damage, but it's absolutely not OK to monitor a temperature sensor on your motherboard.

    Not that any other anticheat or antivirus is 100% effective, but AhnLab's offerings seem to be worse than many. Never had Avast block Speedfan from operating correctly. Some anticheat software does take exception to being run in a virtual environment, but some game companies REALLY don't want you multi-boxing*.

    * - Once played a casual MMO hosted at Aeria games. Their reasoning behind not allowing multi-boxing at that time was that some people can barely afford the one computer they own, and that it's not polite to flaunt the fact that you can afford several machines. I've played other games where it was thought to just be too difficult to multi-box (Granado Espada, where you control 3 characters at once). On Granado, I managed to juggle 3 (!) teams of 3 characters, with at least one team farming on a different map (and therefore not able to benefit from the other two teams apart from a couple of bonuses based on how many faction-mates you had logged on at one time.

    0 0
This topic is closed for new posts.

Other stories you might like

  • Liftoff at last for South Korean space program
    Satellite-deploying rocket finally launches – after a few setbacks
    Laura Dobberstein Wed 22 Jun 2022 // 05:57 UTC

    South Korea's Aerospace Research Institute (KARI) yesterday succeeded in its endeavor to send the home-grown Nuri launcher into space, then place a working satellite in orbit.

    The launch was scheduled for earlier in June but was delayed by weather and then again by an anomaly in a first-stage oxidizer tank. Its October 2021 launch failed to deploy a dummy satellite, thanks to similar oxidizer tank problems that caused internal damage.

    South Korea was late to enter the space race due to a Cold War-era agreement with the US, which prohibited it developing a space program. That agreement was set aside and yesterday's launch is the culmination of more than a decade of development. The flight puts South Korea in a select group of nations that have demonstrated the capability to build and launch domestically designed and built orbital-class rockets.

    Continue reading
  • Emotet malware gang re-emerges with Chrome-based credit card heistware
    Crimeware groups are re-inventing themselves
    Jeff Burt Fri 10 Jun 2022 // 07:57 UTC

    The criminals behind the Emotet botnet – which rose to fame as a banking trojan before evolving into spamming and malware delivery – are now using it to target credit card information stored in the Chrome web browser.

    Once the data – including the user's name, the card's numbers and expiration information – is exfiltrated, the malware will send it to command-and-control (C2) servers that are different than the one that the card stealer module uses, according to researchers with cybersecurity vendor Proofpoint's Threat Insight team.

    The new card information module is the latest illustration of Emotet's Lazarus-like return. It's been more than a year since Europol and law enforcement from countries including the United States, the UK and Ukraine tore down the Emotet actors' infrastructure in January 2021 and – they hoped – put the malware threat to rest.

    Continue reading
  • Microsoft Defender goes cross-platform for the masses
    Redmond's security brand extended to multiple devices without stomping on other solutions
    Richard Speed Fri 17 Jun 2022 // 15:30 UTC

    Microsoft is extending the Defender brand with a version aimed at families and individuals.

    "Defender" has been the company's name of choice for its anti-malware platform for years. Microsoft Defender for individuals, available for Microsoft 365 Personal and Family subscribers, is a cross-platform application, encompassing macOS, iOS, and Android devices and extending "the protection already built into Windows Security beyond your PC."

    The system comprises a dashboard showing the status of linked devices as well as alerts and suggestions.

    Continue reading
  • HelloXD ransomware bulked up with better encryption, nastier payload
    Russian-based group doubles the extortion by exfiltrating the corporate data before encrypting it.
    Jeff Burt Mon 13 Jun 2022 // 17:30 UTC

    Windows and Linux systems are coming under attack by new variants of the HelloXD ransomware that includes stronger encryption, improved obfuscation and an additional payload that enables threat groups to modify compromised systems, exfiltrate files and execute commands.

    The new capabilities make the ransomware, first detected in November 2021 - and the developer behind it even more dangerous - according to researchers with Palo Alto Networks' Unit 42 threat intelligence group. Unit 42 said the HelloXD ransomware family is in its initial stages but it's working to track down the author.

    "While the ransomware functionality is nothing new, during our research, following the lines, we found out the ransomware is most likely developed by a threat actor named x4k," the researchers wrote in a blog post.

    Continue reading
  • South Korea's space ambitions stuck on the launchpad
    Second Nuri rocket stalls with problem similar to those that caused first mission to mostly fail
    Simon Sharwood, APAC Editor Thu 16 Jun 2022 // 04:45 UTC

    South Korea's ambition to launch a space industry on the back of a locally developed rocket have stalled, after a glitch saw the countdown halted for its latest attempt to place its Nuri vehicle into orbit.

    The launch was planned for Wednesday, but postponed by a day due to unfavourable weather.

    The Korea Aerospace and Research Institute tried again but, as the countdown progressed, an anomaly appeared in a first stage oxidizer tank. That issue was considered so serious that Nuri was returned to its assembly facility.

    Continue reading
  • Symbiote Linux malware spotted – and infections are 'very hard to detect'
    Performing live forensics on hijacked machine may not turn anything up, warn researchers
    Brandon Vigliarolo Fri 10 Jun 2022 // 14:50 UTC

    Intezer security researcher Joakim Kennedy and the BlackBerry Threat Research and Intelligence Team have analyzed an unusual piece of Linux malware they say is unlike most seen before - it isn't a standalone executable file.

    Dubbed Symbiote, the badware instead hijacks the environment variable (LD_PRELOAD) the dynamic linker uses to load a shared object library and soon infects every single running process.

    The Intezer/BlackBerry team discovered Symbiote in November 2021, and said it appeared to have been written to target financial institutions in Latin America. Analysis of the Symbiote malware and its behavior suggest it may have been developed in Brazil. 

    Continue reading
  • AMD targeted by RansomHouse, attackers claim to have '450Gb' in stolen data
    Relative cybercrime newbies not clear on whether they're alleging to have gigabits or gigabytes of chip biz files
    Jeff Burt Tue 28 Jun 2022 // 14:01 UTC

    If claims hold true, AMD has been targeted by the extortion group RansomHouse, which says it is sitting on a trove of data stolen from the processor designer following an alleged security breach earlier this year.

    RansomHouse says it obtained the files from an intrusion into AMD's network on January 5, 2022, and that this isn't material from a previous leak of its intellectual property.

    This relatively new crew also says it doesn't breach the security of systems itself, nor develop or use ransomware. Instead, it acts as a "mediator" between attackers and victims to ensure payment is made for purloined data.

    Continue reading
  • Now Windows Follina zero-day exploited to infect PCs with Qbot
    Data-stealing malware also paired with Black Basta ransomware gang
    Jeff Burt Thu 9 Jun 2022 // 00:29 UTC

    Miscreants are reportedly exploiting the recently disclosed critical Windows Follina zero-day flaw to infect PCs with Qbot, thus aggressively expanding their reach.

    The bot's operators are also working with the Black Basta gang to spread ransomware in yet another partnership in the underground world of cyber-crime, it is claimed.

    This combination of Follina exploitation and its use to extort organizations makes the malware an even larger threat for enterprises. Qbot started off as a software nasty that raided people's online bank accounts, and evolved to snoop on user keystrokes and steal sensitive information from machines. It can also deliver other malware payloads, such as backdoors and ransomware, onto infected Windows systems, and forms a remote-controllable botnet.

    Continue reading
  • Chinese-sponsored gang Gallium upgrades to sneaky PingPull RAT
    Broadens targets from telecoms to finance and government orgs
    Jeff Burt Tue 14 Jun 2022 // 06:27 UTC

    The Gallium group, believed to be a Chinese state-sponsored team, is going on the warpath with an upgraded remote access trojan (RAT) that threat hunters say is difficult to detect.

    The deployment of this "PingPull" RAT comes as the gang is broadening the types of organizations in its sights from telecommunications companies to financial services firms and government entities across Asia, Southeast Asia, Europe and Africa, according to researchers with Palo Alto Networks' Unit 42 threat intelligence group.

    The backdoor, once in a compromised system, comes in three variants, each of which can communicate with the command-and-control (C2) system in one of three protocols: ICMP, HTTPS and raw TCP. All three PingPull variants have the same functionality, but each creates a custom string of code that it sends to the C2 server, which will use the unique string to identify the compromised system.

    Continue reading
  • Symantec: More malware operators moving in to exploit Follina
    Meanwhile Microsoft still hasn't patched the fatal flaw
    Jeff Burt Thu 9 Jun 2022 // 11:45 UTC

    While enterprises are still waiting for Microsoft to issue a fix for the critical "Follina" vulnerability in Windows, yet more malware operators are moving in to exploit it.

    Microsoft late last month acknowledged the remote code execution (RCE) vulnerability – tracked as CVE-2022-30190 – but has yet to deliver a patch for it. The company has outlined workarounds that can be used until a fix becomes available.

    In the meantime, reports of active exploits of the flaw continue to surface. Analysts with Proofpoint's Threat Insight team earlier this month tweeted about a phishing campaign, possibly aligned with a nation-state targeting US and European Union agencies, which uses Follina. The Proofpoint researchers said the malicious spam messages were sent to fewer than 10 Proofpoint product users.

    Continue reading

Biting the hand that feeds IT © 1998–2022

Do not sell my personal information Cookies Privacy Ts&Cs