Server Takeover Without Logging In? Over 110,000 Vulnerable Servers in South Korea

[Anchor]

As we just reported, a security vulnerability has been discovered in PHP, prompting urgent responses in South Korea as well. What kind of issue is this, and how dangerous is it?

Reporter Choi Seung-hun breaks down everything from the attack mechanism to the current situation in the country.

[Reporter]

When we log in or order items on an online shopping mall, there is a program acting like an employee that checks the request and returns the result.

A representative language used to build such programs is PHP.

First released in 1995, it is still widely used in shopping malls, internet bulletin boards, and blogs.

However, it has been revealed that the program makes two mistakes while handling memory, where information is temporarily stored.

When hackers send specific requests to exhaust the memory available to PHP, it causes errors. Issues were discovered where it mistakes incorrect information for valid data or pulls out already discarded information as if it belongs to the next user.

Taking advantage of this confusion, hackers could make servers follow their commands.

This means they could steal personal information or install malicious programs without even logging in.

The development team kept the attack method a secret until the vulnerability was fixed, but controversy arose when a security patch distribution company released the modified program six hours ahead of schedule.

This is because if hackers closely examine where the fixes were made, they can deduce where the security holes originally were.

[Thai Duong / CEO, Cyber Security Firm Caliph: Now, just by looking at the security patch, you can create exploit code. Everything has changed.]

South Korea is also on high alert.

Cybersecurity firm AhnLab estimated that there are approximately 112,000 domestic servers installed with vulnerable PHP versions.

The government raised the cyber crisis alert level to Caution on October 22 and sent urgent notices to about 28,000 companies and organizations.

Site operators must install the updated PHP with the security fix and restart their server programs.

Domestic hosting providers such as Cafe24 and Gabia have also launched emergency patches.

However, older websites may stop working when updated, so small and medium-sized enterprises lacking security personnel may struggle to respond.

If immediate updates are difficult, blocking external access temporarily should also be considered.

(Video editing: Won Hyung-hee, Design: Seo Seung-hyun)
※ Please note: This article was translated by AI and may contain errors.