South Korea says 16 financial firms had a breach in October
Police think that one hacker used an open-source AI tool to find and attack weak systems.
Claimed, not confirmed
On 14 October, the regulator of South Korea says that 16 financial firms had breaches. The regulator says that about 100,000 records were exposed. The records show names, loan limits and, in some conditions, national ID numbers. Investigators think that one hacker in China used ARTEX, an open-source AI tool that finds targets and attacks them.
What was hit
The attackers hit external systems that are not important, not the primary records of the firms.
- Shinhan: a portal for loan agents
- KB Kookmin: a mobile tool for staff
- Hana: a tool for sales staff
At BNK Busan, the data was about 11 external staff who make software.
The tool
The maker of ARTEX put it on GitHub in July. It finds targets, finds weak points, finds how to attack, operates the attack tools and examines the results.
The maker removed it from GitHub after the breaches. AhnLab, a security firm, says that copies operate on about 600 IP addresses around the world.
What is not known
The full quantity of damage is not known. Korea JoongAng Daily gave about 66,000 persons, and the regulator gives about 100,000 records.
CrowdStrike, a security firm, says that the attack servers connect to a person in Guangdong.
What to do
On 2 October, the regulator told each card issuer and savings institution to examine its external systems.
The attacks did not use one weak point that a patch can repair.
Sources
Posted
