Smarter apartments, is your personal information safe? Security concerns over construction company hacking (comprehensive)

As apartment life becomes more advanced, from community facility reservations through smartphones to facial recognition access systems, concerns about the security of residents' personal information are growing following the GS E&C hacking incident.

As construction companies expand smart home and community services amid competition with premium brands, the scope of collecting and using residents' personal information is also expanding, and some point out that an appropriate security system must be in place.

According to the construction industry on the 1st, GS Engineering & Construction confirmed that an abnormal external access occurred to the apartment community facility reservation management system at around 11 p.m. on the 28th of last month.

GS Engineering & Construction believes that some residents' personal information may have been leaked and is reporting it to the relevant agencies and investigating the extent of the damage.

Information that may be leaked includes not only basic personal information such as name, date of birth, phone number, gender, email address, and address, but also membership number, residence type, household head status, membership registration date and time, last login IP address, RF card number, and administrator ID.

Passwords were also included in the list of items that could be leaked, but they were encrypted and unique identification information such as resident registration numbers and financial information such as account numbers and card numbers were not collected or stored, so they were excluded from the scope of leakage, GS E&C explained.

In particular, he added that the RF card number is a management membership number registered to use community facilities and is different from the entrance access authentication number.

This accident is noteworthy in that, with the advancement of apartment complexes, construction companies are now collecting and managing a wide range of information on residents' lives, housing, access, and authentication, beyond the customer information they secured during the sales and contract process.

In the past, it was common to apply for use of apartment community facilities through the management office, but recently, there is an increasing number of cases where member registration, household authentication, access management, visiting vehicle registration, and reservations for various community facilities are handled through a platform exclusively for residents.

GS E&C provides various services such as membership registration, household connection, common entrance access, visiting vehicle registration, community facility reservation, and smart home control through the integrated residential service application 'Xi Home'. Samsung C&T provides various digital residential services such as smart home control and community use through platforms exclusive to residents, such as 'Homenic' for Hyundai Engineering & Construction, 'My Hills' and 'My DH' for Hyundai Engineering & Construction, 'Prugio Smart Home' for Daewoo Engineering & Construction, and 'e-Pyeonhansesang Smart Home' for DL ​​E&C.

It is pointed out that while construction companies are expanding services for residents, information security may have been in a relative blind spot. Unlike the finance and communications industries, the construction industry has been recognized as a construction-oriented industry and large-scale personal information leakage incidents are relatively rare, so information security issues have not been greatly highlighted.

Heung-yeol Yeom, Professor Emeritus of Information Security at Soonchunhyang University, suggested that apartment services should check the vulnerabilities of the contact points connected to the Internet and prepare protection measures accordingly.

Professor Yeom said, "In particular, if the RF card number is exposed, it can be linked to access, which can not only damage privacy but also affect the physical security system. Recently, many apartments use biometric information such as facial information to control access, but if this information is leaked to the outside, the damage can be significant."

He emphasized that if information on residents of multiple apartment complexes is jointly managed in one information system, the scope of damage in the event of information leakage can increase, so the system operation structure for each apartment and vulnerabilities in Internet contact points must also be checked.

The current ‘Intelligent Home Network Equipment Installation and Technology Standards’ stipulates security requirements for home network equipment, such as network separation between complex servers and households. The Enforcement Rules of the Apartment Housing Management Act also require regular safety diagnosis by including intelligent home network equipment in the safety management plan.

However, since these regulations are mainly focused on the safety management of home network facilities and networks, it is pointed out that there is a relative lack of separate standards set according to the characteristics of apartment complexes, such as what personal information is collected and how much in community reservations or access/household authentication services, where it is stored, and who can access it.

Professor Yeom said, “As convenience increases, security must be strengthened proportionally,” and added, “There is a need for the Ministry of Land, Infrastructure and Transport to guide the basic security management system, network configuration, and necessary security services or devices to prevent information leaks that may occur due to the informatization of large-scale residential complexes.”

He continued, “As adding a security system after all apartments are built can increase the cost burden, security must be considered from the pre-sale stage,” and emphasized that “the principle of collecting only necessary information, protecting it thoroughly, and then completely destroying it when the purpose is achieved must be applied.”