The 2nd Everyone’s Startup information leak also targeted ‘vulnerable API’… Similar to the first accident

It was discovered that the personal information leakage incident in the 2nd Everyone's Startup Project hosted by the Ministry of SMEs and Startups was caused by a hacking attack targeting a vulnerable application program interface (API), just like the 1st project.

The Ministry of SMEs and Startups previously announced that it had completely improved the API and strengthened the criteria for selecting participating companies to prevent recurrence after the first incident last July, but security weaknesses were still exposed.

According to this 'infringement leak report' obtained by Yonhap News on the 13th from the information technology (IT) industry and the Korea Internet & Security Agency (KISA), Amicus Rex, the AI ​​solution company where the hacking incident occurred, wrote, "We confirmed an attempt to steal some information through a SQL injection attack from the administrator page, so we took action to delete the vulnerable API code."

Previously, the Ministry of SMEs and Startups and the Korea Institute of Entrepreneurship and Entrepreneurship Development announced that at the time of the first project's personal information leak, it was possible to obtain it through specific API calls and web crawling, and that the security of some server APIs, such as challenger profiles and review reviews, was insufficient.

Even though the Ministry of SMEs and Startups announced follow-up measures for the first incident and pledged to 'comprehensively improve the API,' the vulnerabilities of the API were revealed again.

Although the first attacked server is everyone's startup platform, and the second is a company participating in the project, it is pointed out that the security measures were effective given that the leak targeted the same vulnerability.

In particular, the fact that an accident occurred at one of these companies a month after the Ministry of SMEs and Startups announced last month that it had selected 50 solution companies by comprehensively evaluating technology and security through an evaluation committee composed of AI and software (SW) technology experts raises questions about whether the selection process at the time was done properly.

Even though the Ministry of SMEs and Startups made this public only more than two days after the accident occurred, there are rumors.

According to the leak report submitted by Amicus Rex, the leak occurred at 5:38 a.m. on the 11th and was recognized at 8:30 a.m. on the same day. The reporting time is 3:45 pm on the same day.

However, the Ministry of SMEs and Startups disclosed this fact to the outside world only at 5:08 pm on the 13th, 60 hours after the accident and 49 hours after the report was received by KISA.

Kim Seung-joo, a professor at Korea University's Graduate School of Information Security, said, "The fact that the accident occurred just a few months after each ministry jointly conducted a comprehensive investigation at the time of the first accident is evidence that there is a problem with the entire government's security management system. We need to check whether everyone's startup platforms and participating companies have been properly inspected, and whether there are any problems with the management system."