Forensic Analysis of MERS Smishing Hacking Attacks and Prevention

In June 2015, Smishing text and malicious code designed to take advantage of the confusion caused by the Middle East Respiratory Syndrome(MERS-coV) appeared. The Korea Internet & Security Agency(KISA), says recent MERS-related information is used for Smishing text messages with the malicious code disguised as a document being circulated via e-mail attachments. Because the infection following attached e-mails intends to remotely control the system of the infected PC, there is a possibility to cause that further damage may result. This study aims to analyze the Smishing text and malware contents, and the form of hacking attacks taking used to take advantage of the confusion caused by MERS. Smishing is based on text messages. The principle of damage resulting from smishing incidents is described below. A hacker sends messages in SMS(Short Message Service) to a targeted user. As soon as the targeted user clicks the attached link, it causes the application with malicious code to be downloaded. The hacker distributes malicious code like Trojan horse to targeted user"s smartphone while the user is not aware of it. The hacker then acquires text messages, reception alarm, camera, phone numbers, financial information, and personal information in the smartphone through the malicious code or malicious application, while controlling the functions of the smartphone. The hacker masquerades as the targeted user to use user"s personal information to cause financial damages through banking approval. A smishing attack for inducing installation and execution of a malicious application(masquerading APP Store) through SMS. Victims of the attack are installed with the malicious application "APP Store". The victims are displayed with a message "Error: installation fails. Because the file is corrupt, you cannot use it. Check it in the homepage". When the victims click the link connected with the URL, the message that asks deletion of the application is displayed. In this case, although any one of Ok and Cancel is pressed, the malicious function is executed. The text message sent to the victims is then sent to the hacker to conduct hacking (3).