North Korea created a fake version of Naver, South Korea’s largest internet portal, as part of a sophisticated phishing attack designed to harvest personal information, Seoul’s spy agency said Wednesday.
One of South Korea’s biggest tech companies, Naver’s myriad services — including Google-like maps, financial services similar to Apple Pay, and popular blogs and chat forums — are used daily by many Koreans.
South Korea’s National Intelligence Service said Pyongyang had created a phishing site that replicated Naver’s main page, including its real-time news, trading and real estate sections.
The site, naverportal.com, was designed to hack South Koreans’ Naver IDs and passwords, giving Pyongyang access to valuable personal data, NIS added.
“As North Korea’s hacking attack methods against our people are becoming more sophisticated, we ask people to be extra vigilant,” NIS said in a statement, adding measures have been taken to block the phishing site from South Korean users.
“Please cease accessing it immediately if you spot a page that’s not a standard Naver access domain URL,” it said.
North Korea has previously attempted to steal South Korean IDs and passwords by duplicating Naver’s log-in page but creating a fake portal was a new approach, the agency said.
“The North has upgraded its attack scheme in order to better extort private information,” it said.
“We are tracking the activities of the hacking group in cooperation with foreign agencies as the server is located overseas.”
Naver warned users to continue to exercise caution.
“We urge users to check if the address is the right one and pay extra attention when accessing Naver,” the company said.
Experts said that, on close inspection, the fake Naver site appeared “clumsy” but was probably more than good enough to fool people who were not paying attention.
“By the nature of this kind of attack, South Koreans are at a disadvantage because we are on the receiving end,” Choi Gil-il, a former national security official, told AFP.
“We have to be constantly on guard to fend off cyber phishing.”
The Yonhap news agency reported that North Korea — possibly the state-backed hacker group Kimsuky — hacked into the intranet of the Seoul National University Hospital in May and stole personal information about more than 800,000 patients and workers.
According to Seoul, Tokyo and Washington, Pyongyang stole as much as $1.7 billion in cryptocurrency last year alone and supported its weapons programmes in part by gathering information through “malicious cyber activities”.
Seoul’s foreign ministry also announced Wednesday it had decided to strengthen its collaboration with Mandiant, an American cybersecurity firm and Google subsidiary, to better respond to North Korea’s cyber activities.
“North Korea is carrying out omnidirectional cyberattacks, such as theft of cryptocurrency and hacking of sensitive information, all over the world,” the ministry said in a statement.
That activity “not only causes property damage to innocent individuals and companies, but also poses a serious threat to the global IT ecosystem as a whole”, it said.
