Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

South Korea’s online security dead end

palant.info

Post reply on HN
Print view View original

21–30 of 144 posts

Re: South Korea’s online security dead end

#21

Post by palant »

0xCMP wrote: post #18
palant wrote: post #10

Earlier quoted context omitted.

Disclaimer : I am the author of this article. I think that this issue is really universal across all banks in Korea. I was told (but couldn’t confirm) that this is a liability question. Supposedly, there was a court ruling that held a bank liable for a customer’s losses due to lack of security precautions. So now all of them implement “security precautions” to avoid liability. Thank you for the hint, I fixed the typo…

aside: I think the year on the dates is wrong :)

Ah, yes. Fixed. :-/

Re: South Korea’s online security dead end

#23

Post by csydas »

palant wrote: post #17
acchow wrote: post #16

Earlier quoted context omitted.

Thanks for the writeup. Do you think getting out of this mess could be as simple as government regulationL: banking (and government and other necessary websites) are not allowed to require installation of plugins or other software to log in.

That’s in fact what I suggest in my blog post. But I am pretty certain that it is far from simple. I’m told that the previous Korean government already tried to tackle this issue and failed. It’s a huge and complicated mess.

My information here may be outdated, but when I was in Seoul for awhile, it wasn't limited to just banking apps, many services had similar requirements for specific plugins, even requiring Internet Explorer 11 and a bunch of plugins for that.

I remember trying to get tickets for an event, and it was not possible within MacOS at the time due to the various Windows only requirements. I remember even having to re-download another version of Windows 7 as Tiny7 had various Windows Services removed that for some reason the plugins/apps relied on.

My cynical guess is that the plugins/apps include user data/telemetry that the companies get a cut for, but of course this is just supposition. It's entirely possible it's just some liability thing that has become entrenched in Korean IT, who knows.

But the practice was everywhere.

Re: South Korea’s online security dead end

#24

Post by [deleted] »

richbell wrote: post #20

This reminds me of krebsonsecurity's experience attempting to contact the FSB. https://krebsonsecurity.com/2021/06/adventures-in-contacting... A lot of countries seemingly did not have access to American encryption technologies or did not trust them — arguably for good reasons[0] — which has lead to this hodge-podge of homegrown security. [0] https://www.washingtonpost.com/graphics/2020/world/national-...

[deleted]

Re: South Korea’s online security dead end

#26

Post by giaour »

nokya wrote: post #2

I see two candidate alternatives to your "Getting out of the dead end": 1. Give SK a few months/years until it realizes it is losing billions revenue nationally due to hacking by foreign entities and it will naturally invest in its application security landscape. 2. Reconsider your position on SK's current situation by factoring actual risk in the equation (likelihood of threat, in particular). What you seem to have…

> What you seem to have discovered are client-side vulnerabilities that would require direct network access to the client machines to be exploited

We don't know what a user has installed on their local machine, so a bank mandating that users install an application with known vulnerabilities has reduced its security posture to whatever client-side chicanery is happening on a given computer. This may shift liability (i.e., it's not the bank's fault if malware intercepts traffic sent to a localhost web server) but does not improve security.

As a user, you might be able to use software with known client-side vulnerabilities safely by constructing isolated sandbox environments for each permutation of required client-side "security" software, but it's unrealistic to expect everyday users to do so.

Re: South Korea’s online security dead end

#27

Post by yongjik »

palant wrote: post #10
gred wrote: post #9

Very interesting read. I'm looking forward to the details in the followups (1/9, 1/23, 3/6). However, I'm surprised that there are no KR banks who build their reputation on their technical acuity and who have eliminated (or avoided) reliance on these types of applications. The markets I'm familiar with tend to have a few banks who have a reputation for good websites, good apps, etc. Or perhaps that bit of context was…

Disclaimer : I am the author of this article. I think that this issue is really universal across all banks in Korea. I was told (but couldn’t confirm) that this is a liability question. Supposedly, there was a court ruling that held a bank liable for a customer’s losses due to lack of security precautions. So now all of them implement “security precautions” to avoid liability. Thank you for the hint, I fixed the typo…

> Supposedly, there was a court ruling that held a bank liable for a customer’s losses due to lack of security precautions.

You already wrote as much in the article, but (AFAIK) the reality is even worse: there were court rulings that exonerated banks, as long as they followed the standard "security practices." Some hacker from China could access the bank's website from a suspicious IP, drain all the money from a poor guy's account, but the bank has zero obligation to do anything as long as it mandated that all users install half a dozen security plugins all the time.

Re: South Korea’s online security dead end

#28

Post by r2vcap »

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking.

As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail.

For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the form of files called authorized certificates(공인인증서) to be used for certification was added in 1999. (The contents were revised only in 2020.) As a result, most banking was accessible only using IE and Active-X. Now that Active-X cannot be used, various software is installed using separate installation files.

Korea's financial regulators are strict, but Korean politicians and media are paternalistic, so if there's a problem with finance, most of them try to side with financial consumers. For example, the issue of password leakage due to a keylogger installed on a user's PC is considered to be a bank problem, not a user problem. For this reason, banking websites require all kinds of security software, such as keylogger checking programs and firewalls. (This problem is gradually being mitigated.)

The problem with Korean security software is that the buyer of the security software (in this case, the bank) only requires that it meet the requirements of laws and regulatory authorities, so there is little room for improvement. Security software can be delivered only after CC certification (CC 인증) issued by the National Intelligence Service(국가정보원). By the way, the NIS is interested in which encryption algorithm is used (whether Korean algorithms such as SEED, ARIA, LEA, etc.), but it is not interested in whether Visual Studio Runtime is 2008 or 2019.

Also, financial institutions do not take cybersecurity issues seriously. For example, when I was in the security industry, a financial company asked for security software for ATMs running Windows XP SP2. Even at that time, Windows XP was EOL, and our security software was only supporting Windows XP SP3 or later. Significantly, the company suffered a cyber attack a few years ago that paralyzed its entire financial services for several days.

Most of the things I mentioned here refer to Korean-language materials, so giving references is somewhat limited.

Re: South Korea’s online security dead end

#29

Post by Roark66 »

Oh boy...

Once I saw this: >This starts with a simple fact: some of these applications are written in the C programming language, not even C++.

I had to stop reading and come here to see if anyone else got annoyed by it. Seriously? "not even c++" are we still in 1990s?

Re: South Korea’s online security dead end

#30

Post by wmf »

richbell wrote: post #20

This reminds me of krebsonsecurity's experience attempting to contact the FSB. https://krebsonsecurity.com/2021/06/adventures-in-contacting... A lot of countries seemingly did not have access to American encryption technologies or did not trust them — arguably for good reasons[0] — which has lead to this hodge-podge of homegrown security. [0] https://www.washingtonpost.com/graphics/2020/world/national-...

The problems aren't with cryptography though; they're basic software engineering failures.
Post reply on HN