{"id":77743,"date":"2024-06-26T09:00:34","date_gmt":"2024-06-26T09:00:34","guid":{"rendered":"https:\/\/www.cryptocabaret.com\/?p=77743"},"modified":"2024-06-26T09:00:34","modified_gmt":"2024-06-26T09:00:34","slug":"south-korean-isp-infected-torrenting-subscribers-with-malware","status":"publish","type":"post","link":"https:\/\/www.cryptocabaret.com\/?p=77743","title":{"rendered":"South Korean ISP \u2018Infected\u2019 Torrenting Subscribers with Malware"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.cryptocabaret.com\/wp-content\/uploads\/2024\/06\/kt-logo-300x175.jpg\" alt=\"KT logo\" width=\"300\" height=\"175\" class=\"alignright size-medium wp-image-253579\" srcset=\"https:\/\/www.cryptocabaret.com\/wp-content\/uploads\/2024\/06\/kt-logo-300x175.jpg 300w, https:\/\/torrentfreak.com\/images\/kt-logo.jpg 584w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\">From a networking perspective, most Internet providers are generally not thrilled with BitTorrent users. <\/p>\n<p>Historically, torrent traffic has placed quite a <a href=\"https:\/\/torrentfreak.com\/decluttering-the-tubes-bittorrent-080201\/\">burden on the network<\/a>, which is one of the reasons why <a href=\"https:\/\/torrentfreak.com\/comcast-to-compensate-throttled-bittorrent-users-091222\/\">Comcast quietly<\/a> began throttling torrent traffic many years ago. <\/p>\n<p>Another reason to limit torrent traffic is to reduce costs. BitTorrent users transfer large amounts of data that\u2019s not always covered by cheap <a href=\"https:\/\/torrentfreak.com\/indian-isps-speed-bittorrent-peering-torrent-site-160828\/\">peering agreements<\/a>, which can become quite costly.  <\/p>\n<p>Today, torrent traffic is a much smaller percentage of total traffic. Internet providers generally are better equipped to deal with it and all-out throttling has become a rarity in most countries. However, in South Korea, an even more concerning anti-torrent tactic was uncovered recently. <\/p>\n<p>Last week, an in-depth investigative report from <a href=\"https:\/\/mnews.jtbc.co.kr\/News\/Article.aspx?news_id=NB12201880\">JBTC<\/a> revealed that Korean <a href=\"https:\/\/en.wikipedia.org\/wiki\/KT_Corporation\">Internet provider KT<\/a>, formerly known as Korea Telecom, distributed malware onto subscribers\u2019 computers to interfere with and block torrent traffic.<\/p>\n<h2>Webhard Torrents<\/h2>\n<p>File-sharing continues to be very popular in South Korea, but operates differently than in most other countries. \u201cWebhard\u201d services, short for Web Hard Drive, are particularly popular. These are paid BitTorrent-assisted services, which also offer dedicated web seeds, to ensure that files remain available. <\/p>\n<p>Webhard services rely on the BitTorrent-enabled \u2018Grid System\u2019, which became so popular in Korea that ISPs started to notice it. Since these torrent transfers use a lot of bandwidth, which is <a href=\"https:\/\/torrentfreak.com\/korean-piracy-giant-noonoo-tv-shuts-down-citing-banwidth-costs-pressure-230414\/\">very costly<\/a> in the country, providers would rather not have this file-sharing activity on their networks. <\/p>\n<p>KT, one of South Korea\u2019s largest ISPs with over 16 million subscribers, was previously caught meddling with the Grid System. In 2020, their throttling activities resulted in a court case, where the ISP cited \u2018network management\u2019 costs as the prime reason to interfere. The Court eventually sided with KT, ending the case in its favor, but that wasn\u2019t the end of the matter. <\/p>\n<p>An investigation launched by the police at the time remains ongoing. New reports now show that the raid on KT\u2019s datacenter found that dozens of devices were used in the \u2018throttling process\u2019 and they were doing more than just limiting bandwidth. <\/p>\n<h2>KT Reportedly Distributed Malware to 600,000 Users<\/h2>\n<p>When Webhard users started reporting problems four years ago, they didn\u2019t simply complain about slow downloads. In fact, the main concern was that several Grid-based Webhard services went offline or reported seemingly unexplainable errors. Since all complaining users were KT subscribers, fingers were pointed in that direction.<\/p>\n<p>According to an investigation by Korean news outlet JBTC, the Internet provider actively installed malware on computers of Webhard services. This activity was widespread and effected an estimated 600,000 KT subscribers. <\/p>\n<\/p>\n<p><center><strong>JBTC\u2019s Report<\/strong><\/center><br \/><center><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.cryptocabaret.com\/wp-content\/uploads\/2024\/06\/kt-virus-scaled.jpg\" alt=\"KT malware\" width=\"600\" height=\"328\" class=\"alignnone size-full wp-image-253576\" srcset=\"https:\/\/www.cryptocabaret.com\/wp-content\/uploads\/2024\/06\/kt-virus-scaled.jpg 2560w, https:\/\/torrentfreak.com\/images\/kt-virus-300x164.jpg 300w, https:\/\/torrentfreak.com\/images\/kt-virus-1536x840.jpg 1536w, https:\/\/torrentfreak.com\/images\/kt-virus-2048x1120.jpg 2048w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\"><\/center><\/p>\n<p>The Gyeonggi Southern Police Agency, which carried out the raid and investigation, believes this was an organized hacking attempt. A dedicated KT team allegedly planted malware to eavesdrop on subscribers and interfere with their private file transfers. <\/p>\n<p>\u201cThe team consisted of a \u2018malware development\u2019 section, a \u2018distribution and operation\u2019 section, and a \u2018wiretapping\u2019 section that looked at data sent and received by KT users in real time,\u201d a <a href=\"https:\/\/www.youtube.com\/watch?v=qaF0NSLZ4cU\">follow-up report<\/a> from JBTC explains. <\/p>\n<p>The explosive allegation accuses KT of accessing and altering data on users\u2019 computers to limit torrent traffic. Follow-up investigations have yet to get to the bottom of everything, but police have already identified more than a dozen persons of interest, who have been referred to the prosecutor. <\/p>\n<h2>Million-Dollar Questions<\/h2>\n<p>Why KT allegedly distributed the malware and what it precisely intended to do is unclear. The police believe there were internal KT discussions about network-related costs, suggesting that financial reasons played a role. <\/p>\n<p>To illustrate what\u2019s at stake, a sales manager from one of the Webhard companies said that torrent transfers save them significant bandwidth costs. This peer-to-peer upload bandwidth goes over KT\u2019s network instead, presumably costing the ISP many millions of dollars per year.<\/p>\n<p>KT, meanwhile, maintains that it merely intended to manage traffic on its network, presumably to keep everything running smoothly. Whatever the truth, that plan clearly backfired.<\/p>\n<\/p>\n<p><center><strong>The JBTC report<\/strong><\/center><br \/><center><\/p>\n<div class=\"embed-container\"><\/div>\n<\/p>\n<p><\/center><\/p>\n<p>From: <a href=\"https:\/\/torrentfreak.com\/\">TF<\/a>, for the latest news on copyright battles, piracy and more.<\/p>\n<p class=\"wpematico_credit\"><small>Powered by <a href=\"http:\/\/www.wpematico.com\" target=\"_blank\" rel=\"noopener\">WPeMatico<\/a><\/small><\/p>\n","protected":false},"excerpt":{"rendered":"<p>From a networking perspective, most Internet providers are generally not thrilled with BitTorrent users. Historically, torrent traffic has placed quite a burden on the network, which is one of the reasons why Comcast quietly began throttling torrent traffic many years ago. Another reason to limit torrent traffic is to reduce costs. BitTorrent users transfer large [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":77744,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[308],"tags":[],"class_list":["post-77743","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-torrent"],"_links":{"self":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts\/77743","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=77743"}],"version-history":[{"count":0,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/posts\/77743\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=\/wp\/v2\/media\/77744"}],"wp:attachment":[{"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=77743"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=77743"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cryptocabaret.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=77743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}