Global security company Trend Micro has reported another wave of targeted cyber-attacks on South Korean government and media agencies. The attack began on last Wednesday morning 9.30 am that marked the Korean War anniversary with the defacement of the Presidential Office – Cheong WaDae’s web site, and extending to the office of Government Policy Coordination.
The defaced website showed message that read “Great leader Kim Jong-un” – North Korea’s top Leader. The unidentified attacker claims to be part of the hacktivist group, Anonymous, who was involved in recent #OpPetrol and #OpUSAoperations and has posted online what may be 20,000 military personnel information. Website defacement is only the tip of the iceberg; personal identifiable information of the members of the military and government, including the Presidential Office and the ruling Saenuri party has been compromised.
Sharda Tickoo, Product Marketing Manager, Trend Micro India said, “The cyber attack involves the compromise of the auto-update mechanism related to the legitimate installer file SimDisk.exe. The incident shows that users need to be vigilant about the security of the auto-update mechanism of the vendors they choose to trust. Software vendors are also required to prioritize safeguarding product servers and the overall security of their network using products, considering the impact that a compromise in this area has on their software’s users.”
According to Trend Labs, the attacker took an unprecedented approach in compromising a cloud storage provider to harvest a large number of botnet in a short period of time. By compromising the server which hosted the client installation program (SIMDisk Installer EXE) and its update server, a significant number of PCs are compromised when the cloud storage client program automatically updates. Compared to the previous cyber-attack in March, the attacker has taken this to a whole new level. Instead of compromising an update server within an organization, the attacker compromised a cloud storage provider.
Trend Micro predicts that cyber-attacks will continue to breach critical systems such as application update servers. Therefore, application provider must take greater care in securing their update infrastructure. Secondly, end users should be cautious of freeware and only install programs from trusted vendor.To prevent such an attack, organizations must ensure their critical systems are patched immediately and monitored for unauthorized changes.