South Korea cyberattacks hold lessons for U.S.
It's not the source of an attack that matters, it's how well you are prepared for it
Computerworld - U.S companies and government agencies can learn from the large-scale disruptions that have simultaneously hit several banks and media outlets in South Korea in the last 24 hours.
Early analyses by security firms suggest that the attacks were carried out using previously known vulnerabilities and exploits.
So while considerable attention is being paid to whether or not North Korea is behind the targeted attacks, the real lesson is that organizations have to address the vulnerabilities that leave them exposed, security analysts said.
"It really doesn't matter if the attacker is a nation-state or a cybercriminal or a hacktivist or a bored teenage kid," said John Pescatore, director of emerging security trends at the SANS Institute in Bethesda, Md. "You have to make sure you are at least at the due-diligence level for the well-known critical security controls. If you close the well-known vulnerabilities, you can stop any attacker using those techniques."
At least three broadcast networks and four major banks in South Korea reported moderate to severe disruptions earlier today.
A report in the New York Times quoted South Korea's Financial Services Commission as saying that two banks, NongHyup and Jeju, were temporarily paralyzed after several computers were infected with a virus that deleted data from their systems.
Services at Shinhan Bank, South Korea's fourth largest financial institution, were also disrupted while a fourth financial services firm said it was hit but suffered no damage.
Meanwhile an official from South Korea's Communication Commission told the Voice of America (VoA) that the disruptions at the media operations appear to have been caused by a virus that was distributed as a software update by a patch management system. The virus basically destroyed the master boot record (MBR) on computer hard drives, causing them to crash, according to the official quoted by the VoA.
In a blog post today, security firm Kaspersky said that its analysis indicated that attackers going by the handle "Whois Team" had used a previously known "Wiper"-style malware program to wipe data on infected computers. The malware is similar to last year's Shamoon malware, which was used to destroy more than 30,000 computers at Saudi oil giant Saudi Aramco.
Meanwhile, security firm Avast Software noted in a blog that its analysis of the attacks show that they originated from a legitimate South Korean website belonging to the Korea Software Property Right Council (SPC). According to the company, the attackers appear to have exploited a previously known Internet Explorer vulnerability (CVE-2012-1889) to infiltrate computers at the affected banks.
- Cyberattacks could paralyze U.S., former defense chief warns
- The NSA blame game: Singling out RSA diverts attention from others
- Jury still out on FISA court
- Suspected China-based hackers 'Comment Crew' rises again
- Chinese hackers master the art of lying in wait
- Spy court OK'd all U.S. wiretap requests it received in 2012
- Groups denounce FBI plan to require Internet backdoors for wiretaps
- South Korea cyberattacks hold lessons for U.S.
- U.S. military networks not prepared for cyberthreats, report warns
- Return of CISPA: Cybersecurity boon or privacy threat?
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Infographic: Converged Infrastructure Benefits This Infographic quantifies the savings organizations are realizing from increased deployment speed, higher availability, and lower annual costs.
- CIOs Deliver Productivity Breakthroughs with Intelligent Digital Signage Retailers have long recognized the influence that digital signage provides over a shopper's point-of-purchase decision making process.
- Going Paperless? Here's What You Need to Think About As makers of some of the world's most popular PDF solutions, we often consult with businesses & governmental agencies that have the goal...
- The Big Data Opportunity for HR and Finance If CEOs, CFOs, CIOs, and CHROs want to drive their businesses forward, they will need to quickly recognize the enormous value of big...
- Top 4 Digital Signage Fails Join RMG Networks for a look at four of the most common reasons digital signage fails in corporate businesses. Learn about strategies to...
- Building Tomorrow's Infrastructure Listen to this podcast to discover how Crider Foods worked with PC Connection to update their IT infrastructure, while maintaining compliance and control. All Cybercrime and Hacking White Papers | Webcasts