Original subtitles

Subtitles brought to you by Cyberghosts Team @viki.com

So, who is the decision maker ?

That is...

The decision...

will be made by me.

I will introduce myself. I'm the CEO of Se Kang Security,

Jo Hyun Min. I will introduce myself. I'm the CEO of Se Kang Security,

Jo Hyun Min.

Episode 5

June 11th, Monday, 8:35 AM 25 minutes before Market opening

Let's summarize the situation.

Last Friday was the date of the first DDoS attack. (DDoS: Distributed Denial-of-Service)

The suspects warned us of the second attack this morning...

and asked for $1million.

Security Team Leader? How's our preparation of the second attack?

Yes. We got help from the Financial Supervisory Service and have finished all the preparation.

A DDoS attack only blocks access of the site, but attacking Home Trading System means they are aiming at the server itself.

Those are totally different problems.

We tightened the security on that area as well. All Se Kang Security's systems are safe.

There is a rumour that the Securities companies and the no. 1 financial institutes spent tons of money for internet security.

There are many security machines which are worth about more than $100,000. and scout the best cyber security team

and update the security program.

You are right. The security of internet of Se Gang Securities is perfect.

The front entrance is perfect,

but how about the back door?

The back door?

The people.

I am talking about the people.

Wherever you go, people are more of a problem than machines.

Let's see the route authority as an example. (The route authority is that it can change set-up and take control of the whole system)

That needs only ID and the password.

That ID and the password are taken care of by the server manager.

You'd think so, right?

That's wrong.

The people from the server's subcontractor come and visit a few times a month.

Even if the employees of the subcontractor come, the server manager is supposed to put the ID and the password in by himself.

While sleeping in the middle of the night and in the middle of a company dinner,

he has to come and input the ID and the password. Who will do that willingly?

But, therefore, the server manager tells the employee of the subcontractor

the ID and the password as a secret. Do you think the guy would keep it as a secret?

No, because everytime a different person comes for service, so he tells the other person the ID and the password as a secret again. And everything is repeated.

No, because everytime a different person comes for service, so he tells the other person the ID and the password as a secret again. And everything is repeated.

So, there are the dozens of people who know the ID and the password despite the strict security.

Let's assume that the server manager of Se Gang Securities is very faithful man; and he comes in the middle of the night and inputs the ID and the Password.

So, he is the only one who knows it. Then, what will you do about malignant codes that come from the employees' computers?

We have our own WI-FI system in the company You can't access it from the outside.

How about the USB?

You said your company has its own WI-FI system, right?

If one of the computers is infected, there will be a malignant code everywhere in the company.

If someone just pushes one button,

"BANG!" The system will be shut down.

There are a few more cases, if you want, I can tell you more.

I wish to hear more if we have more time, but we don't have much time left.

How much time do we have?

It's 10 minutes before the Market opens.

If the Home Trading System should be destroyed, we will have billions in loss.

Team Leader of Security? Is what he said just now, a possibility?

That is... it's fifty-fifty.

Fifty-fifty.

What do you think about it? Let's speak candidly.

Speaking candidly,

I think it's a bluff.

Hey? Are you sure about it?

Although I just told you about the possibility, destroying the Home Trading System is very difficult work.

Why did they do the DDoS attack only for a few seconds? Who has the ability to destroy the Home Trading System?

It's 5 minutes before the Market opens.

Representative?

Director Moon? Could you pass me the account number of the suspect?

From now on, let's see what will happen!

June 11th, Monday, 8:59 AM. Approximately 1 minute before the market opens.

It's now 10 seconds before opening.

5 seconds before opening.

4 seconds before opening.

3 seconds before.

2 seconds before.

1 second before.

The system is working normally.

Good work!

I heard you had a very big accident. I think you are not fully recovered yet.

It seems that you can't remember me.

Inspector Kim Woo Hyun? No,

since you got demoted a rank, should I call you Lieutenant Kim Woo Hyun?

Representative? You have to attend the press conference with reporters from the financial newspapers.

Yes.

Then...

Subtitles brought to you by Cyberghosts Team @viki.com

Subtitles brought to you by Cyberghosts Team @ viki.com.

I want to die. All I want to do is to die. Good bye.

To the editor of 8 o'clock News,

I want to report a serious illegal act.

Please open the attached file.

Get out.

I have nothing more to say.

I heard that you were in a serious accident.

It looks like you haven't fully recovered yet.

As it seems you don't remember me.

Inspector Kim Woo Hyun.

No, since you were demoted a rank,

should I call you Lieutenant Kim Woo Hyun?

Jo Hyun Min.

You...

killed Shin Hyo Jung?

That's right.

I killed her.

Kim Woo Hyun.

He didn't remember me.

Wasn't that a symptom of PTSD?

No it wasn't.

It seemed like...

he had met me for the first time.

What do you want me to do?

I will do as you wish.

Was it worthwhile to do, Lieutenant Yoo?

Kang Seo Ra, she came, right?

What?

Was she here because of the Ms. K video?

Kang Seo Ra was photoshopped into the video.

She was here because of that? What did she say?

Is it for real?

Hey you!!Seriously!

You are the detective, not Kang Seo Ra! You go find out!

Why are you asking me such things?

Don't be like this, how was she?

Isn't she prettier in person?

Pretty my butt. Lieutenant Yoo is prettier.

Stop jumping to conclusions

and go analyze those video files.

This punk is so noisy!

- Oh? What is this? - Hey, hey!

Isn't this Kang Seo Ra's autograph?

My son's her fan, so I just got one.

Your son's name is Detective Han?

You're doing too much now.

She drew a heart too!

- Let me just see it. - No way.

Organization: National Police Agency ID: kimwoohyun Password: *******

Jo Hyun Min

No entry found.

Se Gang Securities

No entry found.

Did Woo Hyun ever talk about

the name Jo Hyun Min before?

No. I have never heard of such a name before.

There is something more important than that.

Do it at a later time.

The Crazy Cow found evidence

that you illegally hacked into the Police Department.

From researching all the computers in the Police Department,

there was no computer that illegally hacked Jung Seo Eun's computer.

Then, are you saying that it wasn't an inside job that hacked into her computer?

Probably not.

It wasn't a computer that was officially recorded

as a Police Department computer.

Then, someone secretly used a different computer?

Yes. It is reasonable.

Did you win the lottery or something?

What are you smiling at?

And that day,

you told me to look into the whereabouts of Lieutenant Kim.

I used the security cameras in this building to find out where he had been.

I found this.

It has been found that he entered the Evidence Room.

The time matches when

the hacking had started.

Subtitles brought to you by Cyberghosts Team @ viki.com.

Team Leader.

I already looked here.

There was no computer that could be used to hack.

And I checked the list of items that were present on that day, and

there weren't any missing or moved pieces of evidence.

It is for sure.

Hades' virus was used here.

But there is no proof.

Hades..

So someone hacked into Jung Seo Eun's computer with this laptop?

It is not for certain.

But if you check the log records or whatever, we can know for sure.

Like what Team Leader Kim Woo Hyun once said, we should have kept the rules.

I think you forgot...

that I am Hades.

I will not be caught that easily.

What are you saying?

It is impossible?

We tried to analyze this laptop ever since the Shin Hyo Jung case.

But there was a password lock on the entire hard disk drive,

so we couldn't open it.

Who said he wasn't Hades? It's incredible what he did!

You couldn't access this laptop?

You have a doctorate degree.

So, analyzing the log records is impossible.

And hacking into Jung Seo Eun's computer with this laptop is also impossible.

Well, if it wasn't Hades himself, that is.

"If it wasn't Hades himself,"

is that what your saying?

What if they break the password?

If they find out the password, then that laptop

is the best proof that you are Hades, and not Kim Woo Hyun.

Now we will begin our overview of the DDoS attack on Sae Kang Securities which happened last Friday.

Detective Han? Yes?

Let's skip the hard words and the introduction,

and get right into the main points.

Oh, okay. I see.

Then we will skip the log records and all that.

The servers and bank accounts the culprits used all originated from Hong Kong, so we asked for backup from the Hong Kong police.

The Hong Kong police said, the fact that they used fake bank accounts and the server history,

makes Dae Young, a team of hackers that work primarily in Hong Kong, as our prime suspects.

Dae Young?

Yes.

If you watch the Hong Kong Movie, Ttaguh, you know, Ttaguh?

That is Dae Young.

You know, Dae Young?

It's the team of the whole collection of the best hackers.

The hacking incident of the Japanese Ministry of Foreign Affairs two years ago,

and the New York Wall Street Stock Exchange incident of last year, they are suspected to be responsible for those as well.

If it is the Dae Young team,

they would have infiltrated the Home Trading System during their second attack on Se Kang Securities.

they would have infiltrated the Home Trading System during their second attack on Se Kang Securities.

Are you sure it's the Dae Young team?

I don't know. That's what the Hong Kong police told me.

How come you know so well?

They are not only skillful but also working secretly.

So, no one knows who the members are.

Ah, Professor Dam Sa Myung at Hong Kong University...

might be the boss of the team.

You're right. That's correct.

He is Dam Sa Myung who might be the boss of Dae Young team.

He is the professor of Seong Ji University now.

They found the hacker who is the Head of Action of Dam Sa Myung.

His name is Wang Ji Wi,

25 years old,

he doesn't have a certain job,

there is talk that he used to be a model, too.

Yes.

But there is a strange thing,

Dam Sa Myung and Wang Ji Wi have vanished recently.

It seems they left Hong Kong.

There is a rumour

that they are planning another Dae Young project.

But everything is guesswork.

There is nothing concrete.

What is this?

While I was analyzing Miss K's video, I found something strange.

What?

The malignant code which was used in Se Gang DDoS inccident

was hidden inside.

When the suspect makes a Zombie PC, they hide a malignant code

inside an adult video which people download a lot.

The Dae Young team also used the Miss K's video and made a zombie PC.

That sounds reasonable.

Where are you going Kim Woo Hyun?

To catch the suspect, didn't you hear it?

The Dae Young team spread Miss K's video.

If we catch the first one who spread it, we'll be able to find out whom and where the suspect is.

He always does it on his own! Really!

Search: Miss K's video

Seller: KimJS* Subject: D-cup the hottest woman, Miss K's video sale.

Download

Subtitles brought to you by Cyberghosts Team @Viki.com

The man whom we saw before, killed Kim Woo Hyun, right?

I will send a letter to Hong Kong Police requesting the positon of that suspect.

Didn't you hear what the Detective said?

Hong Kong police also doesn't know where they are, because they have vanished.

Then, what will you do?

I told you before, I will catch the first person who spread Miss K's video.

When they spread a video in a large quantity, they hire part time workers who are paid 10-20 cents for each video.

Those part time workers are connected with

the Dae Young team in some sort of way.

I have to find those part-time workers.

I will go and get the car.

We also tried to analyze this notebook computer since the Shin Hyo Jeong case.

But he locked the whole hard disk, we couldn't open it.

Who wouldn't believe he's Hades? It's really something.

That IP belongs here.

This is the first place that the video spread.

This guy is a big fan of baseball, I guess.

While he uploaded the video, he kept checking the baseball games and the strategies of each team.

Is there anything wrong?

They could make hundreds of thousands of zombie PC by using Miss K's video.

If they have that many zombie PC and the ability of Dae Young team, they could paralyze the whole communication network of our country.

But they just paralyzed Se Gang Securities's homepage.

Isn't it strange?

There's definitely something up with this incident.

I checked the building where True Story was in.

But because they couldn't find a successor, it's still empty.

True Story Park Gi Young

Reporter Choi Seung Yeon?

Why did you come here?

Detective?

How did you come to be here?

Why are you here, Detective?

You used to work here with Park Ki Young, right?

So what?

Do you happen to know a password that Park Ki Young used often?

For a computer, or maybe a house passcode?

Why?

Because it helps the investigation.

Do you know it or not?

I know.

But why do I have to give you that information?

Is the information that certain?

Give and take.

If I tell you, then you should also tell me something I want to know.

Will that be okay?

Seriously.

I hate girls who play around, and such a small one to be playing games. Ugh, seriously.

I can't stand ugly guys too.

Am I ugly?

Is this an ugly face? Is it?

Really who looks like a boiled down potato make me crazy!

Boiled down popato?

Boiled down potato!

That's enough

A breakdown of negotiations.

Breakdown!

Hold on.

Then what do you want to know?

I want to know something about Kim Woo Hyun.

Doctor Hwang? Where is the Hades' notebook computer?

What are you talking about all of a sudden?

You can investigate once you have the password to the hard disk, right?

We shared the desktop computer, so I know the password to it.

The password is...

SINCE1999.

Are you sure?

Try it first.

Access Denied.

Why do you want to know about Kim Woo Hyun?

Give and take. Isn't that what you said?

There's something funny happening inside the National Police Agency.

If it becomes a scoop, I'll only tell you.

Lieutenant Kim Woo Hyun said something weird before Yang Seung Jae died.

The person who killed Shin Hyo Jung is still alive.

That the person who killed Shin Hyo Jung was still alive.

And even stranger was that when we first met, he already knew my name.

Choi Seung Yeon?

I don't know what is what, but I'm positive he is hiding something.

It's the same thing here.

There are records of uploading Miss K's video here.

And he also visited a baseball site.

It's the same here, too.

Since the sphere of action is limited to this town,

he probably lives or stays nearby.

He wouldn't spend the money for the transportation since it was 10 or 20 cent per one.

I understand. I'm finished here.

I'll be moving to the next PC room.

D-cup glamorous actress Miss K video

Please support Ghost by clicking "Follow" @ viki.com

Detective!

Please eat this and continue.

Subtitles and timing brought to you by Cyberghosts Team @Viki.com

If someone comes looking for me, tell them I'm not here.

Welcome.

What detective is that pretty?

Right? Isn't she pretty?

W...ho are you?

I'm a friend of the pretty detective.

It's me. Everything is set on your side?

Everything is all set. How about you?

We are done too.

Don't forget it has to look like DDoS.

I know.

Shinwoldong V: I'm a Shinwoldong part-timer. I have something to tell you.

Shinwoldong V: I'm a Shinwoldong part-timer. I have something to tell you.

So you're sure that the IP that the Dae Young team used is this one?

Yes..

But they told our side that we weren't allowed to contact them first.

That's your problem. Do what we told you to.

About the payment of this video work,

since I have an urgent need, could you pay me beforehand?

My mother is sick and I need money for the hospital bill.

Send what you have done with the video.

It's here.

Thank you.

File 120611

Open

The IP is originating from Hong Kong.

If it is Dae Young, they will detour the route. Ignore the IP.

The important thing is the origin. Where they are sitting in front of the computer right now.

Will it succeed?

On that side,

they just need to click on the file.

Pack your things.

We're moving from here to the next location.

It's the Dae Young team's boss.

What's this?

How come the boss is also there?

They are definitely preparing for something big.

Wait a minute.

D-day, June 12th, 9:00

What was the date of Sae Kang's DDoS?

It's June 8.

But why is the 12th written here?

Hasn't the DDoS situation already ended?

June 12,

it's today.

What could it be?

Hey, look at this.

Why?

It looks like the code from the Sae Kang DDoS situation.

Didn't it end already?

No, it has mutated and is spreading again!

Hey. Drink while you work. We've spent the whole night.

Detective...

Why?

Look at this.

Would I know what I was looking at?

The malignant code which was hidden in the Miss.K's video,

there is the attack date and time hidden.

The attacking date and time? They did it already.

Se Gang DDoS, they might hide it somewhere.

No...

The Sae Kang DDoS attack...

I think it was a test.

What do you mean now?

What are you talking about, again?

What?

- The real attack is - Yes, the real attack is

June 12, 9 o'clock.

June 12 at 9 o'clock.

There's not even 3 hours left.

What's this? Aish!

Hello?

First, call all experts.

The National Intelligence Service, Vaccine Laboratory, the Financial Supervisory Service, Korea Internet Security Agency...

Call everyone who is related.

It says 9 o'clock this morning.

The real attack is today.

We have to go right now. What are you doing?

Wait a bit.

Why?

The suspects are in Korea now.

We are from the Financial Supervisory Service.

You are here.

Are you sure about the malignant code?

Yes. I checked it with Doctor Kang in the Vaccine Laboratory.

It looks sure that it will be at 9AM.

What has been going on since this morning!?

We don't have much time. Let's start immediately.

So, what has happened so far?

I will explain.

According to the malignant code, the attacking time will be 9AM.

We guess that the size of the zombie PC is houndreds of thousands.

Since we use the fiber optics in this country,

we can't compare the speed and the spreading power with other countries.

By the way, since there are hundreds of thousands...

How about the target of the attack? Did you find it?

Since it's connected to the Internet, it could be anywhere.

The Blue House, National Assembly, the National Intelligence Service, Ministry of National Defense, No. 1 Financial Institutes, and the National Police Agency.

All of our country's organizations can be the target.

But... no one knows where the suspects will attack.

Wherever it will be, we have to prepare for DDoS attack.

The National Intelligence Service will take care of the Blue house and the public organizations.

Korea Internet Security will take care of the press and portal sites.

The Financial Supervisory Service and Cyber Crime Squad will take care of the Securities companies and No. 1 Financial Institutes.

Wait!

There is an information that

the Dae Young team is in Korea.

In Korea?

Why? The DDoS attack can be done by pushing a button from abroad,

why did they need to come to Korea? Unless they want to be caught.

Although I also can't understand it,

it's a certain information. If they are here now,

what they aim to do, might not be a simple DDoS attack.

Where did you get the information?

Who told you? Where and how?

Now a days, someone is hacking using the Police IP,

it's a serious problem.

It wouldn't be something like that, right?

Huh?

I'm not sure what the information is, but it is more important to prevent DDoS now.

No time. Let's move!

Where are you going?

I have to find the office where the webcam shot.

According to the part timer, the payment was made from Shin Hyup Bank, Incheon branch.

Could you check it please?

The DDOS attack is right in front of our noses.

The boss Dam Sa Myung also is here.

If it's just a simple DDoS attack,

then there would be no reason to be here, like Doctor Kang said.

There must be a different plan.

If you want to chase the hackers like Dae Young,

we can't be chasing behind them.

We have to take a short cut...

and stop them.

There are a total of 9 of that outdoor brand's advertisement boards in the country.

The outdoor advertisement board is supposed to be located along the automobile road.

Except the highway without a building.

Please handle it right now.

The attack time will be 9AM today.

There is a big chance that the no.1 Financial Institutes will become a target.

Since it is the biggest number of zombie PC in the history.

So what happened?

They said it's DDoS attack. It will be much bigger than before.

Everyone, calm down and get ready.

I got a call from the Vaccine Laboratory.

The maximum traffic of this DDoS attack will be 30 GB.

30 GB?

Even if it is 2 GB, there will be a chaos. It's 30 GB?

It makes me crazy.

The police have found evidence of a large-scale DDoS attack.

The expected time of attack will be 9AM today.

To prevent the incident, each organization, local government, and financial institute

are preparing for the attack.

The Government has requested an update to the newest computer vaccine program

to protect the people from a DDoS attack and block the spreading of it.

The DDoS attack time will be at 9AM.

The suspects are the same ones who attacked Se Gang Securities last week.

The Security Team and the Financial Advisory Service are working together to prevent it.

A large-scale DDoS attack, you say.

It's a big problem.

I'm not forgetting anything...

Then, we are going. - Yes.

Have you seen Kim Woo Hyun?

I haven't seen him for a while.

I'll be leaving first.

SINCE1999.

Kim Woo Hyun,

what exactly are you?

Subtitles brought to you by Cyberghosts Team @Viki.com

It is 8:59!

Yes. There is no problem at the Blue House.

It's from Korea Communications Commission. There is no problem with the broadcasting companies.

The portal sites are fine too.

What's this. Is it a bluff?

Yes. This is the preparation team.

Where?

TAG bank?

The TAG bank got attacked.

Yes?

Doctor? Citizen Bank got attacked.

I'm going crazy.

Call the Financial Advisory Service and Korea Internet Agency. Yes.

I got a call from Lieutenant Kim Woo Hyun. He said he found the office of the suspects.

What? Then, did he find the real location of the suspects?

No sir. The computers and the criminals have all vanished.

This is the address what Lieutenant Kim Woo Hyun told me.

Did you say Kim Woo Hyun?

I confirmed it with the CCTV,

but I can't see his face since it's covered with a hat.

Did you find the office?

I found it, but no one is here.

They must have known and fled.

What about evidence? Is there nothing?

There is an address.

This place is not far from the bank that they used sending the payment. I think this is another hiding place.

I understand. Give me the address.

We are now having a 3 GB DDoS attack.

I request the cyber shelter.

This is no joke.

There are too many zombie PC.

What are you talking about?

The hard disk is disappearing?

It can happen. But after we erase the malignant code, it will be fine.

Hurry up, we have no time.

I did analyze the malignant code collected from a zombie PC.

They're controlling it through a world internet server.

Please disconnect that IP.

I disconnected it, but it changed to another server and kept sending out commands.

There are not only one or two C&C servers. (C&C server controls the zombie server and order the attack remotely)

I think they have been preparing this for a long time.

D-Day June 12th, 9:30

It's not at 9 o'clock.

This was the actual time.

Noh Shin Il.

Have a cup of tea.

Yes.

Why is a person from the Cyber Crime Squad here?

That is...

I'd given the police all that there was to say.

Pardon?

You aren't here because of the recent robbery of my home?

Robbery?

Yes.

They took my wedding ring and all of my precious things.

Ah... yes.

Whenever I think about it, I get upset.

Hold on.

Yes.

It's not the DDoS attack.

There's another, the real one.

What are you talking about?

The DDoS attack was to trick the police officers and the Cyber Crime Squad into doing something else.

Then what were the criminals actually planning to do?

It's Stuxnet.

Stuxnet?

It is a virus that cripples the SCADA system, which includes the equator, water works, gas, and electricity.

An Iranian power plant almost blew up because of this many years ago.

If the Stuxnet is really going to be used, then with just a click of a button the whole system will be paralyzed.

This is at a whole different level.

It's impossible to get into the national infrastructure system, even if it is online or offline.

Please confirm your finger print.

The username and the password has to be accessed over four levels.

And I heard it changes every week.

Outside access is strictly prohibited.

Unless someone infiltrates into the company and moves the virus with a flash drive..

By any chance, could you tell me what your husband's job is?

He is a employee of the Korea Electric Power Corporation security team.

Korea Electric Power Corporation?

They said that there was a robbery in this house.

If that robber's goal was something else...

It is a Stuxnet virus code.

If a flash drive was plugged into the computer even once,

then the virus would be in it.

The Korea Electric Power Corporation controls the supply of electric power of the metropolitan area.

If the suspects get the system authority of the main control center,

the supply of electric power of the metropolitan area will be paralyzed within a second.

Once the USB is inserted, it's all done.

I don't know what the problem is, but let's do it later. We have no time.

What are you doing?

I'm taking you in for being the suspect of the Shin Hyo Jeong case.

Kim Woo Hyun... or should I call you Park Ki Young?

I heard there was a robbery in your house. What happened?

There's not even anything to steal... but they took my wife's things.

Hello.

I'm calling from the main control center.

Is there a problem with the machine?

No. There's nothing like that.

Oh? The computer isn't responding!

Park Ki Young?

What are you talking about right now?

Why? Hearing your real name after such a long time, are you nervous?

I don't have time to listen to meaningless talk.

Now, Korea Electric Power Corporation is getting attacked.

Korea Electric Power Corporation!

DON'T TALK BULL S***!

The computer isn't responding!!!

Ah, yes, yes, yes...

What's going on?

Is this the police? Everything's gone crazy!

How many cars have collided! This makes me crazy.

This man, really. -What is this?

It's spreading.

Are there people inside?!!?

Excuse me!

Subtitles brought to you by Cyberghosts Team @Viki.com