Financial authorities, banks, etc. detect the use of AI in hacking incidents... Emergency inspection of all financial sectors

(Seoul = Yonhap News) Reporter Kang Soo-ryun and Kang Ryu-na = In recent hacking incidents at banks, it was discovered that the same attacker used artificial intelligence (AI) tools to attack.

According to the financial authorities on the 4th, the same attacker's Internet address (IP) was found in several places in the breaches of seven companies, including Shinhan, KB Kookmin, Hana, BNK Busan Bank, Yegaram, Welcome Savings Bank, and Hyundai Capital.

It was discovered that the attacker continued to attack by changing the IP.

It is believed that the attacker used AI tools to carry out mass automated attacks targeting multiple financial companies.

According to data reported by Shinhan Bank to the National Assembly, in the case of the Shinhan Bank hacking incident, the attacker used IPs from several countries, including Korea, the United States, Japan, Hong Kong, Singapore, Vietnam, Thailand, and the United Kingdom.

Information was leaked from an additional system for employee and loan recruitment, and it was found that there was no impact on customer services such as internet or mobile banking or any financial damage.

Financial authorities categorized hacking incidents into three types and responded to them.

In the case of the information inquiry service, it was confirmed that the development was incorrect so that loan application details or company representative information could be searched without identity verification. Accordingly, all services missing the authentication process were investigated and the errors corrected or the service blocked.

In the case of employee work support services such as PB and RM, information was believed to have been stolen because mobile terminal access control was omitted or web vulnerabilities that could be accessed without permission were not addressed. Financial companies must strengthen controls to ensure access only through pre-registered terminals, and immediately improve vulnerable web services.

It was discovered that a hacker had dug into a known security vulnerability in the homepage service, installed malware, and stolen log files containing customer information. As a result, security controls are strengthened, such as taking action on known vulnerabilities or blocking services.

The Financial Supervisory Service disseminated attack IPs and security precautions to about 500 companies across the financial sector. Banks and credit cards must complete emergency inspections by the 6th, and securities, insurance, savings banks, and electronic finance companies must complete emergency inspections by the 8th.

They must be checked according to a checklist that includes 12 items, including ▲blocking the attacking IP and investigating damage, ▲identifying externally exposed IT assets and services, and ▲whether security has been strengthened. If any insufficiencies are found, they must be immediately supplemented.

Financial authorities plan to inspect the company where the accident occurred and inform the entire financial sector of vulnerability factors and improvement cases based on the inspection results to prevent similar accidents from recurring.

Meanwhile, financial authorities have held a total of three emergency response meetings since the hacking incident occurred until today. On this day, chairmen of all financial sectors and executives of financial companies that experienced breaches were convened to discuss response plans.

Financial Services Commission Chairman Lee Eok-won said, “It is time for the entire financial sector to be seriously aware of the current situation and have the highest level of alertness,” and called for thorough security checks and consumer protection measures.