1. Cyber Security Issues in South Korea and CSIRTs Cooperation September 17, 2014 Eunju Pak first-team@krcert.or.kr eunjupak@krcert.or.kr beunju@kisa.or.kr

2. AGENDA 01 LATEST NEWS 02 PHARMING 03 SMS PHISHING 04 CONCLUSION

3. 01 Latest News

4. 01. Latest News 2014-09-17 A GROUP OF CYBER FRAUD CRIMINALS WAS ARRESTED Unfair Profits 1 Billion KRW Victims’ financial information stolen Money withdrawn money from their bank accounts Cased by Phishing site, Pharming site and SMS Phishing 4

5. 02 Pharming Case

6. 02. Pharming Case 2014-09-17 Types of Malwares in South Korea Constant increase in the number of Phishing/Pharming Sites in South Korea 6

7. 02. Pharming Case 2014-09-17 Pharming Incident? Infection Web defacement 7

8. 02. Pharming Case 2014-09-17 Pharming Incident? Falsification hosts.ics falsified 8

9. 02. Pharming Case 2014-09-17 Pharming Incident? Information Leak Victims’ bank account information leaked 9

10. 02. Pharming Case 2014-09-17 JPCERT/CC’s ASSISTANCE NEEDED! Japanese IPs misused by Korean Pharming cases SOS to JPCERT/CC What JPCERT/CC is Doing: Analyzing malwares Monitoring servers distributing hosts.ics Discussing with relevant ISP (i.e Blocking sites) 10

11. 03 SMS Phishing Case

12. 03. SMS Phishing Case 2014-09-17 The more smartphone users are, the more SMS Phishing damages increase 2012Y 2013Y FH. 2014Y 569M 5,733M 330M Source : NPA Unit : KRW Damaged Amount of SMS Phishing in South Korea 12

13. 03. SMS Phishing Case 2014-09-17 Text Message Received SMS Phishing Incident? Promotion Coupon(for free) Link to the URL Add bookmark Copy the text Downloading Do you want to install? 13

14. 03. SMS Phishing Case 2014-09-17 ① Check Normal Banking Apps Malicious Application Installed SMS Phishing Incident? 14

15. 03. SMS Phishing Case 2014-09-17 ② Download the Additional Malicious Application Malicious Application Installed SMS Phishing Incident? 15

16. 03. SMS Phishing Case 2014-09-17 ③ Require Financial Information Malicious Application Installed SMS Phishing Incident? 16

17. 17 03. SMS Phishing Case 2014-09-17 Malicious Application Installed SMS Phishing Incident? ④ Send away PKI folder, financial Information to specific email address

18. 2014-09-17 03. SMS Phishing Case What KrCERT/CC is Doing: Providing CNCERT/CC with email addresses, related evidences, samples Requesting takedown of related email addresses What CNCERT/CC is Doing: Analyzing and Verifying malware samples Coordinating with relevant service provider to takedown the misused email addresses Chinese Famous Portal E-mail addresses are misused for Korean SMS Phishing incidents CNCERT/CC’s ASSISTANCE NEEDED! 18

19. 2014-09-17 04. Cooperation Web Browser Notification to Infected PC Users : Received infected IP list from trusted organization and partners Web browser notification to infected PC users Respond CVE-2014-0515(Adobe Flash Player) : Received malware distributing URLs, suspicious URLs Request for proper actions to the distributing URLs Support technical measures, extract & analyze logs Web browser notification to infected PC users What KrCERT/CC is doing for Global Collaboration: WAIT!!! Remove malware from your PC 19

20. 04 Conclusion

21. 2014-09-17 04. Conclusion Actions Required Each CSIRT has different capacities, rules,… Each CSIRT team’s circumstances to be explored Seek Ways to collaborate to Support Incident Handling Develop Information Sharing Protocol 21

22. 04. Conclusion Asia Pacific Computer Emergency Response Team Forum of CSIRTs/CERTs in Asia Pacific region since 2003 To help create a SAFE, CLEAN and RELIABLE cyber space in the Asia Pacific region through global collaboration APCERT will maintain a trusted contact network of computer security experts in Asia Pacific region to improve the region’s awareness competency in relation to computer security incidents 2014-09-1722

23. 감사합니다 THANK YOU