South Korea's Ministry of Foreign Affairs launched an investigation after learning that the online education system of the Korea National Diplomatic Academy had been compromised for 10 months — from May last year through February this year — and confirmed that a significant volume of personal data had already been leaked.
"It is currently difficult to calculate the exact scale of the breach, but we are operating on the assumption that a significant amount of information has been leaked," the Foreign Ministry said Tuesday.
On the possibility that the attack was carried out by North Korea, the ministry said there is currently insufficient technical basis to definitively identify the perpetrator.
The ministry added that it "confirmed abnormal access following an inspection prompted by a notification from a relevant agency in early February, and launched an investigation," and said it had conducted a security review of the system, including checks for malware infection.
The Foreign Ministry disclosed the hacking Monday through an official press release. Upon receiving notification of the breach, the ministry immediately shut down the system and launched a joint investigation with relevant agencies.
According to the investigation, an unidentified attacker exploited a previously undisclosed zero-day vulnerability in the server software and misconfigured security settings to seize control of the server between April and May last year, then continued to access it through February this year.
The Foreign Ministry noted that "this attack exploited a zero-day vulnerability that even the software manufacturer was unaware of at the time, and then used legitimate software privileges — making detection through conventional means extremely difficult." It added that no security update was available at the time to address the vulnerability, which is assessed to have limited the ability to respond.
The compromised system was an online education platform that stored educational video content along with users' names, IDs and other information required to operate the training programs.
The Foreign Ministry said it views the increasingly sophisticated and wide-ranging expansion of cyberattacks as a serious concern, and plans to continue strengthening its internal security framework and management measures in close cooperation with relevant agencies.
moone@heraldcorp.com
