Financial Security Institute, hacked, blocks 246 attack IPs... Nationality: Korean

(Seoul = Yonhap News) Reporter Jiyeon Kim = It was discovered that the Financial Security Institute, which had recently suffered a hacking attack, had completed blocking a total of 246 attacking Internet Protocol (IP) addresses.

According to data submitted by the Office of People Power Party Rep. Park Dae-chul, a member of the National Assembly's Political Affairs Committee, from the Financial Services Commission on the 13th, the Financial Security Service confirmed an abnormal access attempt through security control at 10:50 a.m. on the 9th.

Afterwards, as a result of collecting and analyzing unusual behavior (logs) recorded in the victim system at 11:11 a.m., a webshell attack to take over the victim system was confirmed at 1:54 p.m. However, this attack failed due to the application of security measures such as file encryption policy.

However, through log analysis at 2:11 p.m., abnormal signs were detected in unauthorized login attempts, and 8 minutes later, service on the victim system was immediately stopped and a detailed log analysis was conducted.

The time when Kumbowon confirmed the data leak was 3:50 p.m.

From 3:58 PM to 11:05 PM that day, the initial accident investigation was completed according to the request for investigation into the infringement accident.

The next day, at 1:30 p.m., an emergency response committee meeting was held, hosted by the Chief Information Security Officer and attended by heads of each department. A cyber crisis warning was issued and the crisis situation was shared.

Subsequently, the infringement incident was reported to the Financial Services Commission at 2:41 p.m. and at 3:48 p.m.

A leak was reported to the Personal Information Protection Committee at around 9:45 pm on the 11th.

On the 12th, based on the results of the second investigation into the infringement incident, a total of 246 attack IP addresses were blocked.

It was analyzed that the attack was carried out by exploiting a vulnerability that bypassed text message (SMS) authentication during normal membership registration.

Through this, they found a vulnerability in insufficient verification of access rights in the 'operational inspection function for regular evaluators' used by administrators after applying for a new account, downloaded the file, and leaked personal information.

The nationality of the IP used for hacking was confirmed to be Korean.

However, financial authorities emphasize that some IPs cannot specify the country, and even if the country is specified, there is a possibility of bypass, so caution is needed when interpreting them.

The hacker is said to have accessed the system by impersonating the Financial Supervisory Service.

It is estimated that about 130 files from 48 companies have been leaked so far.

The Financial Services Commission and the Financial Supervisory Service are already investigating the accident at the scene.