Image to help understand the article
Police investigation could determine customer relief
South Korean authorities could seek to let LG Uplus customers cancel service without paying early termination penalties if a police investigation finds the wireless carrier deliberately destroyed evidence or obstructed an inquiry into a hacking incident, the country’s science and technology minister told lawmakers.
Bae Kyung-hoon, who also serves as deputy prime minister, made the remarks during a National Assembly audit of the Ministry of Science and ICT. Responding to questions from Rep. Cho Kyung-tae of the governing People Power Party, Bae said the police investigation remained underway.
“If the investigation finds deliberate destruction of evidence or interference with the inquiry, we should of course request a waiver of termination fees,” Bae said. He added that the government would act when a major service failure or breach of a company’s core contractual duties warranted such relief.
LG Uplus’ service terms already allow customers to cancel without penalties when the company is responsible for the underlying problem. The National Assembly Research Service has said malicious destruction of evidence or obstruction could qualify because it would deny customers the opportunity to determine whether their information was exposed and could undermine trust in the carrier’s obligation to provide secure service.
Discarded server left questions unanswered
According to Cho, LG Uplus received a hacking report from the Korea Internet and Security Agency on July 19 last year and discarded one compromised server on July 31. After the ministry requested an internal review on Aug. 11, the carrier reinstalled the operating system on another affected server the following day. On Aug. 13, the company told the ministry that it had found no evidence of an intrusion.
The compromised system managed passwords for multiple internal server accounts. A joint government and private-sector investigation confirmed that data taken from the system was valid, but investigators could not determine the full route or scope of the breach because one server had been discarded and the other’s operating system had been reinstalled.
The ministry referred the matter to police in December on suspicion of obstruction of official duties by deception. South Korea’s Personal Information Protection Commission decided in July to seek a police investigation on the same grounds.
Subscriber identifiers raise separate security concerns
Lawmakers also questioned LG Uplus’ method of generating International Mobile Subscriber Identity numbers, or IMSIs. The 15-digit identifiers are stored on SIM cards and allow wireless carriers to distinguish among subscribers.
Cho’s office said South Korea’s three major carriers use different methods. SK Telecom combines four digits from a phone number with five randomly generated digits, while KT uses serial numbers assigned by SIM manufacturers. LG Uplus has incorporated subscribers’ phone numbers into IMSIs after its carrier code since 2011.
Cho warned that devices known as IMSI catchers, which imitate cellular base stations to collect identifiers from nearby phones, could expose LG Uplus customers’ phone numbers. In April, a security researcher released a video showing a homemade IMSI catcher gathering identifiers from nearby LG Uplus phones, deriving a phone number and then placing a call to it.
Cho also said only about 30% of affected SIM cards had been replaced. He criticized LG Uplus for promoting free replacements as a way to use a “safer telecommunications service” without specifically warning customers about the risk of unauthorized phone-number collection.
Bae said LG Uplus would provisionally begin automatic remote updates related to the identifiers on Dec. 22. Cho asked the government to report its security testing results and customer-protection measures to the National Assembly before the audit period ends.
Comments
Post a Comment