South Korea’s online security dead end
palant.info
South Korea’s online security dead end
1–10 of 144 posts
Re: South Korea’s online security dead end
#2I see two candidate alternatives to your "Getting out of the dead end":
1. Give SK a few months/years until it realizes it is losing billions revenue nationally due to hacking by foreign entities and it will naturally invest in its application security landscape.
2. Reconsider your position on SK's current situation by factoring actual risk in the equation (likelihood of threat, in particular). What you seem to have discovered are client-side vulnerabilities that would require direct network access to the client machines to be exploited (i.e., no firewall, no NAT, no etc.). First, these limitations greatly reduce the attack surface and second, they may actually cost the attacker more to exploit than simply sending a well-crafted message with an attachment to click on.
I would be much more convinced by your conclusions if you added elements that would support the hypothesis that the situation is similar (or worse) server-side.
(edit: removed ugly formatting)
Re: South Korea’s online security dead end
#3Overall an interesting post, thanks for sharing.
Nitpick for OP (@palant): on mobile Safari (haven't checked any desktop browsers), the images embedded into the post appear stretched out vertically (i.e., too "slim"). It is still technically readable, but very noticeable and jarring. This only applies to the images when embedded, opening direct image URLs in a dedicated browser tab renders them properly without any stretching. I suggest checking CSS, but that's just my first guess and could be entirely wrong.
I think just keeping the same horizontal size of images, but reducing the vertical size, would make it much more aesthetically pleasing + readable.
Re: South Korea’s online security dead end
#4I see two candidate alternatives to your "Getting out of the dead end": 1. Give SK a few months/years until it realizes it is losing billions revenue nationally due to hacking by foreign entities and it will naturally invest in its application security landscape. 2. Reconsider your position on SK's current situation by factoring actual risk in the equation (likelihood of threat, in particular). What you seem to have…
Note: I am the author of this article.
Where did you get the idea that direct network access is required? To quote the article: “large applications interacting with websites in complicated ways.”
Most attacks can be launched by an arbitrary website. And given the number of people affected, this is way worse than any individual server being vulnerable. Besides, I’m definitely not going to look for server-side vulnerabilities without permission.
Re: South Korea’s online security dead end
#5One of the reasons for maintaining is to transfer consumers to security responsibility.
Re: South Korea’s online security dead end
#6I see two candidate alternatives to your "Getting out of the dead end": 1. Give SK a few months/years until it realizes it is losing billions revenue nationally due to hacking by foreign entities and it will naturally invest in its application security landscape. 2. Reconsider your position on SK's current situation by factoring actual risk in the equation (likelihood of threat, in particular). What you seem to have…
> What you seem to have discovered are client-side vulnerabilities that would require direct network access to the client machines to be exploited
It’s so weird how many people (developers!) actually seem to believe this.
Websites can send bad stuff to local ports!
Re: South Korea’s online security dead end
#7> This prompted South Korea to develop their own cryptographic solutions.
I've had an opportunity to interact directly with Korean security culture in my time working for Samsung.
I am sure there exists more secure examples out there, but I saw some extremely bad practices like trivially-reversible password shuffling used throughout the entire org. Anyone with access to a certain manufacturing database and knowledge of a particular stored procedure could immediately reverse all passwords and typically use them to go sideways into other engineering/facility systems.
They always seemed substantially more interested in the theatrical aspects of security than focusing on any first principles. Lots of time was spent talking about reactionary crap like a fleet of hardware ARP sniffers installed throughout the network. Not a lot of time was spent talking about PBKDFs, system boundaries and determinism.
Re: South Korea’s online security dead end
#8> This prompted South Korea to develop their own cryptographic solutions. I've had an opportunity to interact directly with Korean security culture in my time working for Samsung. I am sure there exists more secure examples out there, but I saw some extremely bad practices like trivially-reversible password shuffling used throughout the entire org. Anyone with access to a certain manufacturing database and knowledge…
In 1999, the adoption of its own 128bit algorithm was reasonable.
- https://en.wikipedia.org/wiki/SEED - https://en.wikipedia.org/wiki/ARIA_(cipher)
Of course, it's close to technology debt now.
Re: South Korea’s online security dead end
#9Very interesting read. I'm looking forward to the details in the followups (1/9, 1/23, 3/6). However, I'm surprised that there are no KR banks who build their reputation on their technical acuity and who have eliminated (or avoided) reliance on these types of applications. The markets I'm familiar with tend to have a few banks who have a reputation for good websites, good apps, etc. Or perhaps that bit of context was omitted, and these types of banks do exist in KR?
Note for the author: small typo at "requires outmost care".
Re: South Korea’s online security dead end
#10Very interesting read. I'm looking forward to the details in the followups (1/9, 1/23, 3/6). However, I'm surprised that there are no KR banks who build their reputation on their technical acuity and who have eliminated (or avoided) reliance on these types of applications. The markets I'm familiar with tend to have a few banks who have a reputation for good websites, good apps, etc. Or perhaps that bit of context was…
Disclaimer: I am the author of this article.
I think that this issue is really universal across all banks in Korea. I was told (but couldn’t confirm) that this is a liability question. Supposedly, there was a court ruling that held a bank liable for a customer’s losses due to lack of security precautions. So now all of them implement “security precautions” to avoid liability.
Thank you for the hint, I fixed the typo. Not being a native speaker, I had to ask a search engine what I did wrong in this sentence. :-)