INCIDENT REPLAY · 2022-02-03
KLAYswap / Kakao SDK hijack
Announcements from AS9457 covering Kakao prefixes redirected requests for a JavaScript SDK that KLAYswap's site loads. The attacker obtained a valid TLS certificate for the hostname while holding the route and served modified code that diverted users' transfers, about $1.9 million, over roughly two hours.
A reconstruction, not the operator's network. Hammerhead's authors rebuilt the change from the public record as a small network of their own. No configuration here is the operator's. What follows is what the tool reported on that reconstruction; it is not a claim that the tool would have prevented the outage.
What happened
Who: Attacker announcing as AS9457 (Dreamline, believed spoofed or abused rather than complicit); Kakao (AS10158, AS7625, AS38099) and KLAYswap users hurt
The summary at the top is paraphrased from the sources below. Hammerhead's catalog rates its confidence in this account high.
Sources
- https://manrs.org/2022/02/klayswap-another-bgp-hijack-targeting-crypto-wallets/
- https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600
- https://therecord.media/klayswap-crypto-users-lose-funds-after-bgp-hijack
- https://www.bankinfosecurity.com/crypto-exchange-klayswap-loses-19m-after-bgp-hijack-a-18518
- https://freedom-to-tinker.com/2022/03/09/attackers-exploit-fundamental-flaw-in-the-webs-security-to-steal-2-million-in-cryptocurrency/
What the public record says
- Announcements from AS9457 covering Kakao prefixes redirected requests for a JavaScript SDK that KLAYswap's site loads. The attacker obtained a valid TLS certificate for the hostname while holding the route and served modified code that diverted users' transfers, about $1.9 million, over roughly two hours.
- Who: Attacker announcing as AS9457 (Dreamline, believed spoofed or abused rather than complicit); Kakao (AS10158, AS7625, AS38099) and KLAYswap users hurt
What the reconstruction assumed
Decided by Hammerhead's authors to build a network that runs. None of it describes the operator's network.
Everything below is ours.
- Kakao is modelled as one edge router, KAKAO-1 (AS 10158), announcing one aggregate, 198.18.96.0/19 (stand-in), to an upstream outside the snapshot. The SDK host sits in 198.18.104.0/24 inside it.
- The loose ROA is 198.18.96.0/19 maxLength /24 AS 10158. The record says the victim-side finding is a ROA whose maxLength permits more-specifics, with no /24 self-announcements; the exact ROA contents are not in the sources we used.
- Nothing here says how the attacker's announcement validated. The audit's claim is narrower: with this ROA, an announcement of 198.18.104.0/24 carrying AS 10158 as its origin is RPKI-Valid and more specific than anything Kakao announces. A minimal ROA (maxLength /19) makes it Invalid; it does not stop a hijack that validation does not see.
- Cisco IOS syntax and stand-in address space throughout. A reconstruction, not any operator's configuration.
- Nothing here claims the outage would have been prevented. The replay says what the tool reports on the reconstruction.
What Hammerhead said
Each run below is pinned by Hammerhead's replay tests at commit 0ee9732: the verdict and the quoted text are checked against the tool's output, and a run that disagrees fails the test. Reason lines are copied verbatim; a pinned line can be part of a longer reason. Every preflight run uses --max-blast-radius 100, so a change is never counted as caught merely because it touched many devices of a small network.
Kakao's own network, no change: the ROA authorises every /24 and none is announced
now: exit 2hammerhead rpki-audit with --roas @klayswap_2022/roas-loose.json. Pinned exit code: 2 (findings).
Output pinned (the output contains each line)
- ROA 198.18.96.0/19 maxLength /24 AS 10158 authorises more-specifics that AS 10158 does not announce
- It announces 198.18.96.0/19 (KAKAO-1) to other networks
- not announced at /24: 198.18.96.0/19 down to /24
- validates Valid and wins by longest match
Pinned in tests/gauntlet/replays-rpki-drift.yaml.
Kakao's own network, a minimal ROA (maxLength /19): the control
now: exit 0hammerhead rpki-audit with --roas @klayswap_2022/roas-minimal.json. Pinned exit code: 0 (none).
Output pinned (the output contains each line)
- "roas_audited": 1
- "loose": []
- "unmeasured": []
Pinned in tests/gauntlet/replays-rpki-drift.yaml.
Limits
- The configurations are a reconstruction. Where the record is silent, the assumptions above fill the gap; if one is wrong, the replay is wrong in that respect.
- A verdict describes the reconstructed network's converged state. Timing, traffic load, and anything a device does that no configuration states, such as software reacting to a health check or a firmware bug, are outside it.
- A pass is reported as a pass. A fail says a gate fired on the reconstruction, nothing more.
- Why the catalog counts this outage as partly in scope: Victim-side audit can report ROAs whose maxLength permits more-specifics and the absence of /24 self-announcements; the attack path itself is outside any reviewed change.
Imported from docs/replays/klayswap-2022/FACTS.md and the replay manifests in the Hammerhead repository at commit 0ee9732.