South Korea’s online security dead end • Hacker News Board

Re: South Korea’s online security dead end

#31

Post by g_p » Tue, Jan 03, 2023, 10:30 PM UTC

lfodofod wrote: post #6

nokya wrote: post #2

I see two candidate alternatives to your "Getting out of the dead end": 1. Give SK a few months/years until it realizes it is losing billions revenue nationally due to hacking by foreign entities and it will naturally invest in its application security landscape. 2. Reconsider your position on SK's current situation by factoring actual risk in the equation (likelihood of threat, in particular). What you seem to have…

> What you seem to have discovered are client-side vulnerabilities that would require direct network access to the client machines to be exploited It’s so weird how many people (developers!) actually seem to believe this. Websites can send bad stuff to local ports!

Indeed - this was my first concern. How many of these local web servers are properly implementing CSP and the myriad of other protections you need to (securely) run a local web server that isn't vulnerable to CSRF from other origins etc?

Zoom fell foul of almost exactly this before it became popular during the pandemic. https://www.theregister.com/2019/07/11/apple_removes_zooms_d...

Re: South Korea’s online security dead end

#32

Post by richbell » Tue, Jan 03, 2023, 10:36 PM UTC

wmf wrote: post #30

richbell wrote: post #20

This reminds me of krebsonsecurity's experience attempting to contact the FSB. https://krebsonsecurity.com/2021/06/adventures-in-contacting... A lot of countries seemingly did not have access to American encryption technologies or did not trust them — arguably for good reasons[0] — which has lead to this hodge-podge of homegrown security. [0] https://www.washingtonpost.com/graphics/2020/world/national-...

The problems aren't with cryptography though; they're basic software engineering failures.

They're problems with cryptography insofar as they are problems that can be traced back to a distrust of Western cryptography and a desire to create domestic security products.

Re: South Korea’s online security dead end

#33

Post by xwolfi » Tue, Jan 03, 2023, 10:37 PM UTC

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

I work in Hong Kong, in the securities industry. We interact a lot with Korean laws, and all of APAC, and Korea is special in that they enjoy nonsensical rules that provide no protection to anyone except the politicians who came up with them and can argue they did do "something".

It's, I think, even worse than China's philosophy, because China is young and pretentious in capitalism, while Korea seems more dishonest and cowardly.

Re: South Korea’s online security dead end

#34

Post by second_brekkie » Tue, Jan 03, 2023, 10:43 PM UTC

I live in Korea. In my experience pretty much everyone I know uses banking apps which you can do everything through, not online banking through a browser.

You would hope that these would be somewhat more secure as this may have required a 're-write' as the article suggested.

Though even with mobile apps you sometimes have to install some 3rd party 'anti-virus' software that probably amounts to spyware. But hey you can either lump it or leave it.

They do at least try to make you feel like it's secure. To set up mobile banking you need at least 3 different passwords and need to perform 2fa 3 times as well.

They have 'front end' security too, such as each time you enter a pass code the keyboard is in a different arrangement.

Re: South Korea’s online security dead end

#35

Post by kragen » Tue, Jan 03, 2023, 11:00 PM UTC

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

this is a cautionary tale for people who hope that government regulation will solve the current computer security disaster outside korea

you cannot solve problems by giving authority to people who are motivated to solve them, but do not understand what the problem is, so that they can tell the people who do understand the problem what to do

anyone who has dealt with pci-dss presumably knows this but that is a much smaller group than all south koreans

think of that the next time someone contrasts bitcoin with the heavily regulated conventional banking system

Re: South Korea’s online security dead end

#36

Post by Arnavion » Tue, Jan 03, 2023, 11:02 PM UTC

wmf wrote: post #19

gred wrote: post #9

Very interesting read. I'm looking forward to the details in the followups (1/9, 1/23, 3/6). However, I'm surprised that there are no KR banks who build their reputation on their technical acuity and who have eliminated (or avoided) reliance on these types of applications. The markets I'm familiar with tend to have a few banks who have a reputation for good websites, good apps, etc. Or perhaps that bit of context was…

Are there any US banks that are actually secure? AFAIK they're all using SMS 2FA or worse.

The credit union I use does have SMS 2FA as an option, but has other options via Entrust. Specifically there's a "soft token" that's a phone app which implements their own brand of not-TOTP, and a "hard token" that's a fob that generates their own brand of not-TOTPs.

Re: South Korea’s online security dead end

#37

Post by flotzam » Tue, Jan 03, 2023, 11:16 PM UTC

second_brekkie wrote: post #34

I live in Korea. In my experience pretty much everyone I know uses banking apps which you can do everything through, not online banking through a browser. You would hope that these would be somewhat more secure as this may have required a 're-write' as the article suggested. Though even with mobile apps you sometimes have to install some 3rd party 'anti-virus' software that probably amounts to spyware. But hey you ca…

There's a curious absence of Korean banking apps on this GrapheneOS compatibility list:

https://privsec.dev/posts/android/banking-applications-compa...

Does it mean none are usable on a modern clean Android? Or is there a total Samsung monoculture? Something else?

Re: South Korea’s online security dead end

#38

Post by chihuahua » Tue, Jan 03, 2023, 11:23 PM UTC

nokya wrote: post #2

I see two candidate alternatives to your "Getting out of the dead end": 1. Give SK a few months/years until it realizes it is losing billions revenue nationally due to hacking by foreign entities and it will naturally invest in its application security landscape. 2. Reconsider your position on SK's current situation by factoring actual risk in the equation (likelihood of threat, in particular). What you seem to have…

Regarding 1 - SK has apparently been doing this since the 1990s. If it was just a matter of time before they realize this is a bad idea, I think they've had enough time to figure it out.

Re: South Korea’s online security dead end

#39

Post by userbinator » Tue, Jan 03, 2023, 11:29 PM UTC

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

For example, the issue of password leakage due to a keylogger installed on a user's PC is considered to be a bank problem, not a user problem.

In other words, they're authoritarians at heart. They want complete control over the environment and don't want users to have any personal responsibility.

Re: South Korea’s online security dead end

#40

Post by ravel-bar-foo » Tue, Jan 03, 2023, 11:33 PM UTC

flotzam wrote: post #37

second_brekkie wrote: post #34

I live in Korea. In my experience pretty much everyone I know uses banking apps which you can do everything through, not online banking through a browser. You would hope that these would be somewhat more secure as this may have required a 're-write' as the article suggested. Though even with mobile apps you sometimes have to install some 3rd party 'anti-virus' software that probably amounts to spyware. But hey you ca…

There's a curious absence of Korean banking apps on this GrapheneOS compatibility list: https://privsec.dev/posts/android/banking-applications-compa... Does it mean none are usable on a modern clean Android? Or is there a total Samsung monoculture? Something else?

Korean banking apps usually are disabled in rooted Android, probably because in rooted Android the integrity of the binary cannot be verified.