KT Corp Under Investigation for Malware Attack on P2P Users

A South Korean media outlet has reported that KT Corp, a local telecom giant, allegedly intentionally infected certain customers with malware in response to their extensive use of peer-to-peer (P2P) downloading tools. This malware, aimed at concealing files and causing service disruptions, was purportedly introduced into the Grid Program, which enables data exchange via P2P methods.

The number of infected users of “web hard drives” – a term used in South Korea for online storage services that allow content sharing – has allegedly reached 600,000. Affected users experienced disrupted file exchange services, leading to numerous complaints on bulletin boards and forums. The issue came to light through an investigation by the Korean news organization JTBC, which revealed that KT had been targeting users of torrent services since May 2020.

This operation, which was active from May 2020, aimed to curb the use of P2P downloading software and affected hundreds of thousands of users. The compromised Grid Program, used by Webhard, a Korean cloud service provider, led to service disruptions, raising suspicions of a deliberate hacking attack.

The incident has attracted serious attention, prompting a police investigation. Authorities have searched KT’s headquarters and data center, seizing evidence to determine if the company violated South Korea’s Communications Secrets Protection Act (CSPA) and the Information and Communications Network Act (ICNA). These laws are designed to protect the privacy and confidentiality of communications and ensure the security of information networks.

Investigations revealed that KT had established a dedicated team within its data center to detect and interfere with file transfers. This team was responsible for developing, distributing, and operating the malware and wiretapping. Thirteen KT and partner employees have been identified and referred for potential prosecution.

Further scrutiny showed that all affected users were KT’s internet service customers. The malware led to disruptions, such as creating strange folders or making files invisible on users’ PCs. The malware sometimes completely disabled the Webhard program or the computer itself. The police’s ongoing investigation aims to hold those involved in these illicit activities accountable.

According to local media, KT’s stance is that it had no choice but to control the web hard drive P2P service, which it deemed a malicious program. P2P sites and legitimate streaming services can burden networks, a problem that led South Korean telcos to engage in a legal dispute with Netflix over network operation costs.

However, while curbing inconvenient traffic aligns with local practices, distributing malware and deleting customer files raise serious ethical concerns about privacy and consent.

The main issue, however, was not the use of the BitTorrent protocol but the unauthorized installation of malware on customer devices. Webhard and KT have a history of conflict over network usage, with Webhard benefiting from reduced storage costs by using P2P services and KT facing network strain.

The judiciary ruled in favor of KT, stating that Webhard did not pay network usage fees and failed to explain the Grid Service to its users in detail. Despite this legal backing, the method KT employed to control the P2P traffic by installing malware without consent is highly controversial and could result in significant legal and reputational consequences for the telco.

Also Read: