If this were America, they’d be bankrupt.

A case has occurred in which a mobile small cell (femtocell) was loaded into a vehicle and driven around apartment complexes, collecting
personal information and
credit card payment information
from approximately 20,000 people.

The criminals went even further, using the stolen information to purchase gift cards and other goods
and turn them into criminal proceeds.

So far, 13 people have been identified as having been arrested.

The four key individuals, A, B, C, and D, were all found to be Chinese nationals.

A was the operative who drove around with the equipment in the vehicle and collected the information.
B stored and delivered the mobile small-cell equipment.
C converted the criminal proceeds into cash and transferred them to China.
D was involved in currency exchange and remittances.

This was a professionally and systematically prepared organization.

During the investigation, they stated that they had acted under orders from superiors in China,
raising the possibility that higher-ranking figures in China were directing the operation from behind the scenes.


The case has proceeded through the second trial in South Korea.
It remains to be seen whether it will be appealed to the Supreme Court.

Here is what happened in the rulings through the second trial.

A: Drove around apartment complexes in the Seoul metropolitan area with an illegal femtocell installed in a vehicle → 4 years and 6 months in prison
B: Stored and delivered illegal femtocell equipment → 3 years and 6 months in prison
C: Converted criminal proceeds into cash and transferred them to China → 2 years and 6 months in prison
D: Participated in the exchange and transfer of criminal proceeds → 8 months in prison, suspended for 2 years

So, let’s take a look at how A actually carried out the crime.

First, we need to understand what a mobile small cell (femtocell) is.

The smartphones we use both transmit and receive radio signals.
These signals reach the Internet communications network and are then delivered to their destination.

When receiving data, the process works in reverse.

However, a small device like a smartphone clearly has limitations in terms of transmission power
and the distance over which it can receive or transmit signals.

A base station is what helps bridge this gap.

A base station receives radio signals from smartphones
and transmits the information to the Internet communications network.


Areas within the coverage of a base station generally have reliable smartphone service.

In remote or rugged areas, such as deep in the mountains or on mountaintops, where there are no nearby base stations or they are too far away,
signals can become weak or mobile phones may lose service entirely.

In other words, when the base station’s coverage and signal strength are strong, the connection is also more reliable.


For this reason, smartphones are designed to automatically connect to the strongest available signal when it comes from a verified base station.

Please don’t ask why smartphones are designed to connect automatically and therefore allowed criminals to steal people’s information.

Because

Carrier	5G Base Stations
SK Telecom	121,252
KT	114,552
LG U+	109,991
Total	345,795

Do you see the number of base stations?

Yes, regardless of which carrier you use,

as you move from one area to another and the connected base station changes,

can you really be expected to press
“Do you want to connect to this base station?”
Yes / No?

Of course not.

That is why smartphones automatically connect to the strongest signal available,
making the service convenient for users.


Since this particular incident involved the illegal acquisition of information through a mobile base station,

if you had completely blocked all cellular connections by turning on Airplane Mode
and relied entirely on WIFI,
your information might have remained safe.

But why should the customer have to do that?

Why should customers have to pay for a service and then put up with this inconvenience?
Why should they have to come home and turn on Airplane Mode?
Are they pilots?

The responsibility for this incident lies entirely with the telecommunications company.
KT.

Customers pay for a service so they can simply use it conveniently.

Of course, customers should not expect to be protected from every conceivable situation.

But when the fundamental problem occurs because the security system of a service provider has been breached,
this is far removed from something customers should be expected to prevent themselves.

So how exactly was KT’s security system breached?

First, if we expand the purchasing market for mobile small-cell equipment to the entire world,

such equipment can apparently be purchased somehow.

In other words, the equipment itself cannot be considered sufficient to establish security.

So what is needed?

Yes, not just the equipment itself,
but first there needs to be a certificate proving that
“this is an officially authorized device.”

There would also need to be an authorized employee login ID.

An officially authenticated device
and
a verified login ID

If these two things are properly secured, most of the basic security structure can remain extremely strong.
How do I know?

Because that is the basic structure behind security systems everywhere.

Additional measures such as OTPs, which change passwords or authentication codes in real time,
are simply added to make the security even more stringent.

Just as someone taking your smartphone does not automatically mean they can access your banking app,
the same principle applies here.

So did A somehow obtain both of these things?

Even though KT is now a private company,
it was a company owned and operated by the government until 2002.
Could something like that really have been possible at KT?

No way. Right?

Yes. That’s right. They had both.

The certificate was extracted from an officially authorized device that had been decommissioned in 2020,
and the certificate was reportedly valid for 10 years.

Why wasn’t the certificate revoked? The device itself had already been decommissioned.
Could it really have been a system in which a single certificate could authenticate multiple devices?

Second, the ID used by the criminals was an unauthorized ID.

In other words, an ID that had not been officially approved by KT headquarters
was nevertheless able to log in and perform the functions of an authorized ID.

How does that make any sense? How could something this absurd happen?

Normally, even if someone somehow obtained a certificate and installed it on a fake base station,

an employee ID requiring approval from headquarters
would be difficult to obtain unless they recruited an employee as an accomplice
or purchased the ID from someone.

But here, an ID that was simply created was enough.

And the operation continued for a staggering 11 months.

Not 11 hours.


If an unauthorized ID was active for 11 months
without anyone noticing,

then it is reasonable to say that there was essentially no effective system for creating and managing IDs.


It would almost make more sense if this crime had required the kind of method I described as an example earlier.

If that basic security measure alone had been properly implemented,
this absurd crime would not have happened.

This is not me demanding something excessive.

For a company providing a service,
this was an obvious responsibility—perhaps one of the most important responsibilities of all.
Because it directly affected customers’ personal information.

But

the certificate was simply circulating outside proper control,
an ID could be created by criminals and still be used to access the system,

and headquarters failed to detect it for 11 months.

As a result, customers’ information was stolen,
including not only basic personal information but also credit card payment information.

The actual financial damage currently identified has already reached
250 million Korean won.

The information of 20,000 people being transferred to China
is something for which the full extent of the damage may never be possible to calculate.


I believe that if this had happened in a country with a highly litigious environment, such as the United States,
it could have seriously threatened the company’s continued existence.


But perhaps because this happened in South Korea,

it is simply frustrating to see news reports receiving more attention for something as trivial as a shark appearing in Busan,
with people even giving it a name,

while an incident like this receives comparatively less attention.