0
/ Getty Images Bank

The South Korean government launched an interagency crackdown last month aimed at eradicating websites distributing illegally filmed content, but operators are already finding ways to circumvent the measures. Such sites are moving to domains beyond the government’s reach and even using cyberattack techniques to hide their infrastructure. The key challenge now is how authorities can identify and disrupt overseas hosting providers that serve as the core infrastructure behind the sites.

According to an AsiaToday investigation on Sept. 10, a website referred to as Site A, which had traded more than 3,000 illegal videos since March, including footage linked to the “Nth Room” case and so-called directly filmed videos, was blocked by Cloudflare on Sept. 3.

The move followed an interagency plan announced on Aug. 20 by the Korea Communications and Media Commission, the Ministry of Gender Equality and Family and the National Police Agency, among others, to strengthen cooperation with overseas content delivery network, or CDN, providers. If a CDN provider blocks the transmission route for original data, access through domain changes or other circumvention methods can also be disrupted.

However, Site A was restored the very next day, on Sept. 4, with its videos, member information and other data intact.

According to the site operator, Site A’s original server sends data through a proxy server before it reaches a CDN server and is then delivered to users in South Korea. The servers use a technique known as DNS fast fluxing, which rapidly changes the IP address linked to a domain every few seconds. The method is commonly used in cyberattacks to conceal the actual location of malicious servers.

Even if authorities identify the DNS fast-flux pattern and obtain the IP address of a proxy server, that would only reveal an intermediate layer. In other words, blocking the CDN provider alone cannot fundamentally shut down the site.

The operator also circumvented efforts to block domain registration tied to the original server. During the restoration process, Site A switched to the country-code top-level domain of São Tomé and Príncipe, an African island nation.

South Korea uses the “.kr” domain, which is managed by the Korea Internet & Security Agency. São Tomé and Príncipe, however, has a population of fewer than 250,000 and may have delegated management of its national domain to a private operator.

Ultimately, authorities may have to seek cooperation from, or take compulsory action against, the web hosting provider that manages the original server itself. The government’s interagency response plan unveiled last month includes joint action targeting overseas hosting providers, but such efforts remain difficult.

Authorities have yet to establish a comprehensive information network on hosting providers, and even if they locate the servers, they have limited options if the provider refuses to cooperate.

In Site A’s case, the original server is also physically separated from other servers, raising the possibility that the criminal organization may be colluding with the hosting provider or even operating the hosting business itself.

“It is not easy for our requests to carry weight overseas,” an official from the Korea Communications and Media Commission said. “That is why government ministries are joining forces to send formal documents directly and seek cooperation.”

                                                                                                           Kim Hong-chan