10 ms·

South Korean telecom company attacks torrent users with malware

• Aerroon 2y ago
  Unsurprisingly, terrible Korean internet strikes again. ISPs try to charge companies insane fees because customers want to connect to their servers. Company decides to use peer-ro-peer instead so the ISP starts installing spyware on customer computers. Makes me wonder where this myth of "good Korean internet" even came from if everything ends up so bandwidth constrained. Is it because all the customers and services are in the same city so it appears low latency? I hope everyone involved in this catches criminal charges, all the way up the chain. Completely unacceptable behavior.
  • nayuki 2y ago
    Another memory from the terrible South Korean Internet is how the national banks required customers to log in using Internet Explorer because of mandatory ActiveX blobs of code.
    • TheRoque 2y ago
      They have such weird constraints. Even Coupang Play refuses to load their video when I'm on Linux, which makes no sense at all.
    • lifthrasiir 2y ago
      It makes me sad that all of these started with US's restriction on the export of cryptography, which prompted South Korea (among others) to develop a domestic algorithm that was unsupported by contemporary browsers at that time.
      • quanto 2y ago
        The US export restriction applied to other countries as well. The question is what has made Korean internet uniquely bad.
        • lifthrasiir 2y ago
          I think the answer itself is clear to me: SK bit the bullet much earlier than most other countries, having implemented a nationwide ADSL infrastructure by circa 2000. The same thing happened to Japan for example, where early mobile services were so successful that they essentially stagnated further development until SoftBank's introduction of iPhone.
        • rfoo 2y ago
          It wasn't unique to Korean. 15-20 years ago Chinese banking website did exactly same things. Maybe they got the idea from SK, don't know. It only ended with widespread adoption of mobile phones and Chrome.
        • seoulmetro 2y ago
          One guy who developed and marketed and then lobbied a single solution that aged extremely poorly. https://en.wikipedia.org/wiki/Ahn_Cheol-soo https://en.wikipedia.org/wiki/Ahn_Cheol-soo
        • makeitdouble 2y ago
          One answer is internet banking being way more cumbersome and less advanced in other countries. At that time spending time on the phone or have the customer come spend a miserable time at the agency was the prefered way from the bank's perspective. To this day many banks won't allow all operations from the online interface.
        • citrin_ru 2y ago
          Active-X was AFIK a common requirement for banking e.t.c. during crypto export restrictions but once they where lifted almost everyone switched to https. What different about SK is the laws which keep their IT security in the past.
    • tonetegeatinst 2y ago
      Can I get a link to a few of those sites? I want to see what happens when I visit using Firefox and tor browser.
  • lifthrasiir 2y ago
    > Makes me wonder where this myth of "good Korean internet" even came from if everything ends up so bandwidth constrained. It is not a myth! A decade ago, though. I would still consider it is "good" in terms of objective metrics, but other countries have since caught up. > Is it because all the customers and services are in the same city so it appears low latency? No, because it would only apply to a quarter of the entire population of South Korea if it were true.
  • yongjik 2y ago
    South Korea at least used to have blazingly fast internet infrastructure. Of course that didn't make up for shitty banking websites that you could only use by running Internet Explorer and allowing it to install "security plugins" that hook into Windows kernel, but at least the internet was fast, and it did give Korea an edge for its IT industry. That was, I think, about twenty years ago. I've been living in the US for 10+ years so I'm not very well informed, but basically the ISP industry ended up in an oligopoly where everybody's friends with the government, and they kept raising prices while neglecting infra upgrade. Until nobody can call Korea's internet "fast" any more. Now all we've got is shitty websites. (To be fair, they are somewhat less shitty now... you can now access your banking websites on Mac!)
    • seoulmetro 2y ago
      Korean internet is still extremely fast. It hasn't decreased in price sadly though.
      • metadat 2y ago
        Gigabit links to the home were cheap in South Korea 20 years ago, something like $50USD/month, IIRC. The population is so dense, it was comparatively quick and easy to put in the infrastructure. Some of the fastest pirate FTP sites in the world were .kr at the time, it was crazy seeing 125MB/sec inter-site transfers back then. The ops must've set the machines up with a /dev/shm ramdisk or similar for uploads. There were no SSDs those days, so no way to even write at 125MB/sec, unless you had an unreasonably large Raid-0 array of WD Raptor HDDs, also possible.
      • petre 2y ago
        How can prices decerease when every provider is a chaebol in bed with the government?
        • AlchemistCamp 2y ago
          The government could make upgrading the infrastructure and lowering prices a priority.
  • ryandrake 2y ago
    > According to the news report, KT said it directly planted the malware on its customers that use Webhard’s Grid Service, as it was a malicious program and that “it had no choice but to control it.” Looks like the major ISP and some cloud service provider are having some kind of ridiculous fight, and they're using their customers' computers as the battlefield. I'd be pretty disgusted if I were a customer.
    • petre 2y ago
      They should be dusgusted. KT's market share something like 80% of landline subscribers and 45% of high speed Internet usets. This is Korea's equivalent of AT&T. The National Pension Service owns ~13% of it.
  • bee_rider 2y ago
    I imagine keeping at the front of the pack on any infrastructure investment is very difficult. I mean, it’s an investment, you want to give it time to amortize, right?
    • deleted 2y ago
      [deleted]
  • NL807 2y ago
    How is this not criminal?
    • OsrsNeedsf2P 2y ago
      It is criminal. From the article, 13 KT employees and contractors were charged.
  • godelski 2y ago
    It's also worth noting the SK has some pretty terrible laws around the internet in general. Distribution of porn is illegal there and they do their best to block it from outside. They are pretty big on cyber defamation and will go after people who make fun of government officials[0]. They have a comparatively low internet freedom score because they do things like fine middle schoolers for having anti-government websites and the president pursues legal action against YouTubers[1]. It's pretty interesting when coming from the west where all the problems are often spoken about in the open. I mean the great American past time is complaining about the government. But in SK there's a lot more trust of the government and similarly, a lot more control by them. And it is a fairly tight knit group and there's only a few companies that dominate the country. [0] https://www.nytimes.com/2012/08/13/world/asia/critics-see-south-korea-internet-curbs-as-censorship.html https://www.nytimes.com/2012/08/13/world/asia/critics-see-so... [1] https://freedomhouse.org/country/south-korea/freedom-net/2023 https://freedomhouse.org/country/south-korea/freedom-net/202...
    • AtlasBarfed 2y ago
      It's a lot easier to buy into a government when the most horrid example of one in modern history (arguable, I get it) is only 100 miles to the north with a huge amount of artillery pointed at you.
      • godelski 2y ago
        Not to mention when you were also very recently occupied by a neighboring country. And an extremely brutal occupation at that. I mean there's still a handful of women still alive who were sex slaves, it wasn't that long ago. Korea really has had it tough, but I wish that would be a drive for more freedom, not less.
      • somenameforme 2y ago
        South Korea has a far crazier history [1] than I think most realize. This [2] is the first president of South Korea, installed by the US, and then eventually ferried off into exile in Hawaii by the US after a revolution, leading the 2nd Republic of Korea. That was followed by coups and all other sorts of great things, including 4 acting presidents that did not serve more than 50 days a piece, eventually leading to the 3rd Republic of Korea which was another dictatorship who then had his dictatorial powers codified in the 4th republic. Then he was assassinated and you get the the 5th republic where the dictator's friend was put in power. Then you get the 6th republic in 1987 (!!) and that's the South Korea we're somewhat more familiar with. Even in modern times, I think most don't realize how wacky Korean politics has been. For instance the president from 2013-2017 (Park Geun-hye, daughter of a former dictator) was involved in some sort of weird cult-like grooming controversy where she was being groomed and controlled by what some media called a 'Korean Rasputin.' She was eventually impeached and imprisoned for corruption/abuse of power, and is now serving decades in prison. And it seems the current president of South Korea has an approval rating in the 30s. So I have no idea how Koreans view their government, but it's really unlike anything I think that we can compare elsewhere. But I suspect "trust" and "integrity" are not the sort of words that'd be on top. [1] - https://en.wikipedia.org/wiki/History_of_South_Korea# https://en.wikipedia.org/wiki/History_of_South_Korea# [2] - https://en.wikipedia.org/wiki/Syngman_Rhee https://en.wikipedia.org/wiki/Syngman_Rhee
  • seoulmetro 2y ago
    >Is it because all the customers and services are in the same city so it appears low latency? Yes. It's because the internet of Korea is so well done between nearly all areas of the country with great speeds. But it's true that Korean internet is super fast only within Korea, but the borders are also normal fast borders to other countries so they're just as fast as say a 1gbps connection in Australia. Good Korean internet is not a myth, they had fibre everywhere by the time rich people in the US or Europe were getting it. Korean internet is good, it's just that their ISPs are also fairly evil like the rest of the world, but they have less freedom constraining their evils.
    • iforgotpassword 2y ago
      https://news.ycombinator.com/item?id=40806633 https://news.ycombinator.com/item?id=40806633 As said, it was good/impressive 20 years ago, now it's just what everyone else has. And SK software is a joke, like the linked post elaborates. I don't know if it changed during the last 5 years, but when I was there I wanted to use Google maps for navigation and it looked like shit, so after some digging around I found because apparently there are some SK patents that prevent Google from using a lot of modern tech. So no wonder SK people compare that to naver and think their IT tech is top notch, but if you compare it to the "real Google", it's a joke. It's the same in China actually, but there you simply can't access the western counterparts at all usually.
      • seoulmetro 2y ago
        The local variants of map apps are leaps and bounds ahead of Google Maps at any point in the last 10 years though. And that's not due to Google being restricted. Google is free to do what it wants in Australia, but it still sucks pretty bad. But yeah, SK software got sabotaged by people in power unfortunately. But the software also has some high standards from locals it has to live up to. So it's stuck in a situation where the app is quite neat, but it will be as stubborn as a mule if it needs anything to spec.
  • mrtksn 2y ago
    Wow, are they trying to have worse internet than DPRK? Funny how both spectrums of fully controlled market and fully free market can be terrible. Apparently what they did was a crime but it shows the spirit, they though at least that they can do it and get away with it.
  • pezezin 2y ago
    > Makes me wonder where this myth of "good Korean internet" even came from if everything ends up so bandwidth constrained. Is it because all the customers and services are in the same city so it appears low latency? Same here in Japan. The funny thing is that both me here and my parents back in Spain have gigabit fibre, yet my parents' connection is much faster than mine.
  • monkfish328 2y ago
    Wow I've always heard that South Korean internet is supposed to be one of the fastest in the world? How did that go wrong?
    • h4kor 2y ago
      Policy failure. South Korea enforced a "Sender Pays" rule for networks, eliminating peering between ISPs. This resulted in companies moving there server to neighboring countries to avoid paying for traffic, which was free before. More details: https://www.internetsociety.org/resources/internet-fragmentation/south-korea-sender-pays/ https://www.internetsociety.org/resources/internet-fragmenta...
• batch12 2y ago
  Did they exploit a vulnerability or MITM the traffic somehow? Edit: While looking for an answer, I ran across this article. Apparently they've been fighting for a while (2015): https://www.opennetkorea.org/en/wp/1529 https://www.opennetkorea.org/en/wp/1529
  • silotis 2y ago
    Bittorrent normally hash checks all content against metadata in the torrent file so a simple MITM wouldn't be enough to inject malicious data unless the torrent metadata itself is being sent in the clear.
    • cortesoft 2y ago
      I am wondering if this is one of those "using the term bittorrent for anything peer to peer" cases... maybe Webhard has its own peer-to-peer protocol that is more vulnerable, and they are just calling it bittorrent?
    • LightHugger 2y ago
      I had the same thought, i'm very confused about the details of the attacks. As an ISP if they detect you doing it, and they control DNS servers, maybe they mark your account for death, and they could like randomly hijack you going to google.com to some download for malware, and unsuspecting user clicks accept? Not sure, i'm curious how they pulled this off.
      • rightbyte 2y ago
        Any http exe-file download could be hijacked if you are an ISP. Maybe KT have some "dailup login" app the user needs to login with?
        • flerchin 2y ago
          But why would it be http?
  • 2y ago
• michaelmrose 2y ago
  Just charge them 250 a head for the equivalent for analysis and remediation should only cost about 150M usd plus about 10-20M to administer. Liquidate the executives holdings including stock then the companies assets and it will never ever happen again.
• brokenmachine 2y ago
  Unfortunately, it's not explained in the article how the malware was actually sent to users. I wonder how they did it.
  • zb3 2y ago
    Especially because BitTorrent is mitm-resistant (uses hashes).. did they find a 0day in the client?
    • gavinsyancey 2y ago
      Or mitm your download of the .torrent file (and/or anchor link site)
  • NL807 2y ago
    I reckon they used a good old fashioned honeypot. Seed a torrent of some random popular content that also contains malware payload, and let users download it.
  • WatchDog 2y ago
    Yeah, until any details are provided, I would just assume that the ISP already requires that users install some kind of software, and they just pushed the malware through that program.
    • kijin 2y ago
      You don't need to install any software to use the internet at home in Korea. You just get a modem that connects to fiber at one end and exposes an ethernet port (or wifi) at the other end. Just connect to that port and you're online immediately. ISPs also provide TV and a bunch of other services, though, and some of them might require installing specific software in order to use on a PC. Or perhaps they hijacked an unencrypted download of someone else's software, most likely some component of the file sharing service in dispute.
    • jowea 2y ago
      The torrentfreak article seems more informative and has links to the source video report https://torrentfreak.com/south-korean-isp-infected-torrenting-subscribers-with-malware-240625/ https://torrentfreak.com/south-korean-isp-infected-torrentin... From what I understand of the autotranslation, the ISP planted the malware somehow and that malware interfered with the P2P system, but no mention of actually using the P2P protocol to spread the malware https://news.jtbc.co.kr/article/article.aspx?news_id=NB12201880 https://news.jtbc.co.kr/article/article.aspx?news_id=NB12201...
• chunsj 2y ago
  South Korean internet had been one of the best and fast network in the world; especially up to the point before KT was privatized. After privatization, three internet service providers have been focusing on exploiting profits, not on making better and faster network infrastructure because they don't have to.
  • pennybanks 2y ago
    wouldnt competition naturally produce better products if there are 3 providers? from what i remember services from companies, or really any type of services were top notch in korea. due to culture, competition, etc. also noting pricing in general is very high in korea
    • arepublicadoceu 2y ago
      I’m not sure how is the reality in South Korea but, if my country is anything to go by, these 3 companies are probably a hidden cartel that monopolizes the price and offers while offering the bare minimum.
      • katbyte 2y ago
        Hello fellow Canadian?
    • pessimizer 2y ago
      There's no economic motivation to compete. The motivation is to raise prices slightly, wait for the other two companies to follow suit as a signal, then to raise prices again. If you raise and someone doesn't follow, backtrack to the previous level. This is assuming that they don't just have a meeting and set prices over drinks.
      • creer 2y ago
        Right. There are two possible very different strategies - even illegal collusion. There is no reason to compete aggressively until one of the "several" chooses to break ranks and do so. And if the one that breaks ranks is tiny, that might still not be enough reason for the others. Since there is a good chance they will just fail.
• lazydonkey456 2y ago
  MITM by ISP and the government! Even SK constitution said it is illegal. but they don't give a damn about it. They are scanning SNI field and manipulate packet to prevent user visit certain sites.
  • lifthrasiir 2y ago
    > Even SK constitution said it is illegal. but they don't give a damn about it. This is a popular meme that is also not entirely correct. I should stress that this incident is very different from the usual MITM from ISP and government though. I assumed you are talking about the general MITM because you mentioned SNI (because you can't put malwares with just SNI sniffing). The constitution only says about the "privacy of correspondence" in the Article 18, and several acts including the Protection of Communications Secrets Act (통신비밀보호법) [1] and the Act on Promotion of Information and Communication Network Utilization and Information Protection (정보통신망 이용촉진 및 정보보호 등에 관한 법률) [2] do have many exceptions that make them legal at least in principle. Indeed, most websites blocked by SK ISPs host either illegal obscene materials (distinct from the legal pornography in the SK legal system) or advocacy for North Korea (illegal due to the National Security Act 국가보안법). I'm not necessarily for such blocks but it is plain wrong to say that they are illegal. [1] https://elaw.klri.re.kr/eng_service/lawView.do?hseq=7235&lang=ENG https://elaw.klri.re.kr/eng_service/lawView.do?hseq=7235&lan... [2] https://elaw.klri.re.kr/eng_service/lawView.do?hseq=38422&lang=ENG https://elaw.klri.re.kr/eng_service/lawView.do?hseq=38422&la...
    • lazydonkey456 2y ago
      So pornography threats national security? I don't think so. "Quis custodiet ipsos custodes?"
      • lifthrasiir 2y ago
        Even NK advocacy sites do not threat national security either, but I meant that such restriction is allowed by the law which was ultimately passed the Congress and so you are wrong to claim that it's "illegal". See also my other comment for the background. Also the watchmen argument against such restrictions is so old at this point that there are lots of counterpoints available for you, if you wish.
• shiroiushi 2y ago
  >Police officials acted on the information and discovered it came from KT’s own data center south of Seoul. ... They’ve since identified and charged 13 individuals, including KT employees and subcontractors directly connected to the malware attack last November,... I'm actually very impressed. If this happened in the US, the police wouldn't care about it at all, and would just tell everyone affected that "it's a civil matter" and they'll have to file a lawsuit if they don't like it.
  • jrflowers 2y ago
    This makes sense because the US does not have a set of laws that criminalize Computer Fraud and Abuse
    • shiroiushi 2y ago
      Maybe you're joking, but they certainly do. They'll happily use them against individuals too. But against a large company? I'll believe it when I see it.
      • boomboomsubban 2y ago
        The US law about this is the Computer Fraud and Abuse Act, it's clearly a joke. We're all in agreement it's not really used against large companies.
      • halJordan 2y ago
        [flagged]
        • squigz 2y ago
          What is this comment even referring to?
        • shiroiushi 2y ago
          Exactly which country do you think I live in?
• seydor 2y ago
  [flagged]
  • pelagicAustral 2y ago
    Private trackers, anyone?
  • squigz 2y ago
    This is really not even close to being true.
• poikroequ 2y ago
  The title is very clickbaity. These are not users downloading torrents in the normal sense. It's users that are using a specific piece of software that happens to utilize the BitTorrent protocol.
  • BillTthree 2y ago
    There is an enormous issue here. A service provider committed crimes against customers and their justification is the customers were using a protocol to exchange something. The service provider has no idea what the something exchanged was. It's similar to arresting someone because they are speaking French. I don't speak French and I don't like people who speak French because sometimes French people say stuff I don't agree with. I don't know what they're saying but I hate it.
• quanto 2y ago
  South Korea information technology (as distinguished from hardware-related technology) is unbelievably bad. Much of it is purely technical: domestic firms like Naver are simply not as good as global incumbents like Google, but also they are terrible compared to other regional players (The Kakao chat app is vastly inferior to Zalo, a Vietnamese chat app). However, just as much is due to poor cultural and interpersonal decisions. This news case highlights such a cultural factor. Note that KT, while relatively recently privatized, is still a national corporation that is considered a critical national asset under the law (thus if the North attacks, KT towers are first priority to be protected by the South's military). So, it is not as if some rogue SME infected its users with malware; it's a national corporation infecting its users over and not even be sorry about it (as in the article). Plenty of other comments detail the strange Active X requirement: The national law had dependency on Internet Explorer/Active X. (I do not know of any developed nation having a national legal dependency on a specific corporation's consumer technology at this scale.) Also, many comments on South Korea's purportedly great infrastructure (albeit two decades ago). There is more to this. Interestingly, if you ask an average Korean, he would say Korea is literally the best nation in IT/internet technology, topping or at least on par with the US. The national propaganda effort that went into forming this collective conscious should not be understated. Even many of the top programmers in South Korea I met strongly believe in this superiority. I wonder if this strong sense of superiority is both (1) preventing SK from improving its actually-lagging tech and (2) act in Dostoevskian-Raskolnikov manners thinking that it is above the law and consensus ("the best can break the rules and set new ones"). Whatever the underlying reason may be, there is a serious techno-cultural issue going on in the country. One of the biggest banks in South Korea blacklisted Amazon as a financial scammer because it's Prime subscription renews monthly and customers complained after seeing the renewal charge on their credit cards. The ban was national -- no customer of this bank could buy a product from Amazon unless he calls the bank personally and ask the charge to be approved. Again, the issue wasn't technical. It was cultural.
  • ken47 2y ago
    > many of the top programmers in South Korea Odd statement. How did you know that the people you met are "top programmers?"
  • 2y ago
• kmeisthax 2y ago
  Hell Joseon strikes again. For context, the legal situation of network usage in South Korea is something akin to Ajit Pai's wet dream. Network operators are legally empowered to charge troll tolls on both ends of any connection they want. Infrastructure costs are to be borne by literally anyone BUT the network operators. To compound this, South Korea is economically an authoritarian hellscape. Large megacorporations[0] own everything and the government is just a clearinghouse and mediator for their interests. Corruption is so rampant that even administrations run by ardent anti-corruption activists wind up being toppled by rampant and widespread corruption. I guarantee you that not one SK Telecom executive will spend time behind bars for this blatantly illegal conduct. Anyone with the power to put people behind bars in South Korea will be unmade if they touch a chaebol. [0] These are specifically called chaebols and the group includes LG, Hyundai, Samsung, Lotte, and a few others. Japan used to have something similar, but they ate their rich... and then brutally invaded and colonized half of East Asia.
  • pezezin 2y ago
    > [0] These are specifically called chaebols and the group includes LG, Hyundai, Samsung, Lotte, and a few others. Japan used to have something similar, but they ate their rich... and then brutally invaded and colonized half of East Asia. More like the Allied occupation forced them to dissolve the zaibatsu. They later reformed as the keiretsu, and while still immensely powerful, are nowhere the level of the old zaibatsu or the Korean chaebol.
  • ken47 2y ago
    > I guarantee you that not one SK Telecom executive will spend time behind bars for this blatantly illegal conduct. I mean, you're assuming that an SK Telecom executive did something illegal. I don't think anyone here is a supporter of corruption, but you're making a huge, completely unjustified leap to say that an SK executive was involved.
• Copenjin 2y ago
  Not best Korea anymore.
• j-bos 2y ago
  Facinating to see the same game played across nations, technologies, and time: https://slate.com/technology/2010/02/the-little-told-story-of-how-the-u-s-government-poisoned-alcohol-during-prohibition.html https://slate.com/technology/2010/02/the-little-told-story-o...
• beeboobaa3 2y ago
  > The judiciary actually ruled in favor of KT. It said that Webhard didn’t pay KT network usage fees for its peer-to-peer system and didn’t explain to its users how the Grid Service works in detail Huh? The users are paying for their network, so they should be free to do with it as they wish. How is Webhard involved in this discussion? This is something the ISP may wish to discuss with its users, if the ISP feels the users are consuming more than they paid for.
• hsbauauvhabzb 2y ago
  How exactly was the malware deployed?
  • cronex 2y ago
    In Korea, ISPs often encourage their customers to install programs to access additional services. For example, antivirus and parental control programs are quite common. Parents also use these programs to monitor and restrict their children's gaming and internet usage. Distributing malware as part of the installation process for these services is not difficult for ISPs.
    • hsbauauvhabzb 2y ago
      Thanks for your insightful response, the different behaviours across countries is extremely interesting - I don’t think my ISP has ever recommended software like that (though, my isp is targeted at tech savvy people, where I assume this ISP is targeting the masses )
• Lockal 2y ago
  As a former resident of Russia, I'm not the least bit surprised. The practice of implementing parasitic scripts there began in 2014, and to date has been continued at the level of the largest provider as well as the monopoly owner of international channels (Rostelecom). Good luck to the believers that someone there will be punished for this. For everyone else, switch to encrypted protocols.
• ken47 2y ago
  Reminds me a lot of the telecom situation in the US. There are lots of people who e.g. hate Comcast but basically have no choice in their area if they want broadband. Granted, a malware attack, is another level of terrible, but isn't it "interesting" how pseudo-monopolists seem to be resistant to meritocratic forces?
• deleted 2y ago
  [deleted]
• dolf 2y ago
  [flagged]
• mateusz_ 2y ago
  KT built fiber connection here in Poland ~15y ago. Project was made in a large part of the country, strongly subsidised and thought as a backbone for other ISPs. 4k km of fiber underground and multiple nodes. Project is now being nationalised as kt: - didn't pay subcontractors. Many of them went bankrupt - offered prices so large, that other isps would rather create their own infra than use theirs - abandon the project totally Of course i shouldn't put this under KT's name, as they used a subcompany - SungGwang - for all the dirty stuff. So, fast forward: we laid a new infra parallel to this one in many cases and that one lays in the ground and rots.