Easy to Hack
In South Korea, about 63% of residents live in apartment buildings. Many of these apartments come fitted with the newest IoT devices, including wall pads, smart security cameras, smart locks, connected doorbells, lights, and more. Unfortunately, many of these devices are vulnerable to attacks. Especially when users fail to reset default passwords, use weak passwords or don’t install the latest security updates. Moreover, often several households use the same network. This means that if a cybercriminal manages to hack just one household, they can hack all devices connected to that network. It is worth noting that South Korea also has the highest rate of smartphone ownership amongst adults. 99.5% of households have access to internet. And the country also has one of the world’s fastest internet speeds.
Reoccurring Issue
People have raised security issues with IoT devices in South Korean apartment buildings before. A couple of years ago, the Korean language newspaper Busan IIbo hired two computer science students to try and hack the camera system of a brand-new apartment building. They easily succeeded. In June, Human Rights Watch released an extensive report about the “digital sex crime epidemic” in South Korea. Digital sex crimes involve digital images that are captured without consent and sometimes shared. Or images captured with consent but shared non-consensually. A third category involves sharing fake or manipulated footage. Woman living in South Korea also told a reporter from The Times that they avoid using public toilets and feel anxious about hidden cameras in public places and in their homes. They fear intimate photos and videos may end up online without them even knowing.
Intimate Footage Sold Online
The South Korean website IT Chosun was the first to reveal the latest security breach. They discovered someone was trying to sell intimate footage on the dark web for 0.1 bitcoin per video ($5,712.65 in today’s value). IT Chosun said: “It’s creepy that someone is looking into our houses, but it’s even more shocking that they’re selling footage to third parties!” Upon contacting the cybercriminal, IT Chosun’s reporter discovered that the hacker was selling videos taken in multiple apartments, not just in one or two. To make things worse, the hacker claims that he has access to most apartments in Korea and extracts video footage from people’s wall pads and other smart home devices. As proof, the cybercriminal uploaded dozens of thumbnails, including provocative images, such as nude pictures, of both men and women. As well as footage of people having sex. In some cases, the image quality was good enough to identify individuals.
South Korea Reviews Laws
To prevent wall pad hacking, measures such as having IoT devices on a separate network, are necessary. This prevents cybercriminals “jumping” from a poorly secured IoT device to other systems. Following a police investigation into the latest security incident, the South Korean government decided to revise various laws and regulations. These include the “Smart Home Network Installation and Technical Standards”, which stipulate rules about network separation. A security industry official commented that “network separation is not an option, but a necessity and should therefore be mandated.” An official from the Korea Internet & Security Agency (KISA) added that, “in most cases, smart home devices such as wall pads and webcams are password-protected.” Thus, leaving it up to the consumer to keep their devices secure.
It’s Not Enough
Unfortunately, simply having tougher laws and regulations won’t be enough. South Korean law enforcement often downplay complaints involving digital sex crimes. According to Human Rights Watch, prosecutors in South Korea dropped more than 43% of digital sex crime cases in 2019, compared to approximately 28% of homicide cases and 19% of robberies. Moreover, judges often impose low sentences. In 2020, more than half of the perpetrators convicted of taking intimate footage without consent received only a suspended sentence. 82% percent of the people convicted of distribution received a suspended sentence, a fine or a combination of the two. More than half of them received only a fine.
