Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

South Korea’s online security dead end

palant.info

Post reply on HN
Print view View original

41–50 of 144 posts

Re: South Korea’s online security dead end

#41

Post by flotzam »

ravel-bar-foo wrote: post #40
flotzam wrote: post #37

Earlier quoted context omitted.

There's a curious absence of Korean banking apps on this GrapheneOS compatibility list: https://privsec.dev/posts/android/banking-applications-compa... Does it mean none are usable on a modern clean Android? Or is there a total Samsung monoculture? Something else?

Korean banking apps usually are disabled in rooted Android, probably because in rooted Android the integrity of the binary cannot be verified.

GrapheneOS is not rooted though. Are all of them doing SafetyNet checks too, not just root checks?

Re: South Korea’s online security dead end

#42

Post by bobkazamakis »

userbinator wrote: post #39
r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

For example, the issue of password leakage due to a keylogger installed on a user's PC is considered to be a bank problem, not a user problem. In other words, they're authoritarians at heart. They want complete control over the environment and don't want users to have any personal responsibility.

[flagged]

Re: South Korea’s online security dead end

#43

Post by _8j50 »

For threat actors that target Korean users their favorite software to exploit for initial access is HWP (Hangul Word Processor). It's MS Word for Korean users. If you are being sent official docs of any kind, chances are it is a .hwp file that needs the program. Banking and internet access affects consumers but HWP is used by more interesting espionage/sabotage targets.

https://www.fireeye.com/content/dam/fireeye-www/global/en/bl...

I just looked up CVEs for it. I only see 2 in 2017. This is not a good thing, a complex word processor, even if it was rewritten in a memory safe language would have at least some low level non-memory vulns in 6 years!

Re: South Korea’s online security dead end

#44

Post by yjftsjthsd-h »

ravel-bar-foo wrote: post #40
flotzam wrote: post #37

Earlier quoted context omitted.

There's a curious absence of Korean banking apps on this GrapheneOS compatibility list: https://privsec.dev/posts/android/banking-applications-compa... Does it mean none are usable on a modern clean Android? Or is there a total Samsung monoculture? Something else?

Korean banking apps usually are disabled in rooted Android, probably because in rooted Android the integrity of the binary cannot be verified.

See, usually when I run into claims about rooted Android being less secure, I point out that they have no problem with regular laptops that the user has root/admin on, but in this case I suspect they try to DRM control of that, too...

Re: South Korea’s online security dead end

#45

Post by ravel-bar-foo »

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

It is worth mentioning that to make a bank transfer in Korea (used to[1]) require 3 factor authentication: the user's website password, the user's PIN, the user's encryption certificate signature/공인인증서, and two randomly selected codes from a paper numbers card (보안카드: https://file2.nocutnews.co.kr/newsroom/image/2013/07/02/2013...), which users are instructed to never copy or digitize.

Of all these solutions, the numbers card gives me the most peace of mind: even if my machine is fully compromised and all my passwords and certificates stolen, the attacker would likely need very long-term access (or access to the bank's server) to get all 35 numbers from the card. (If the attacker compromises the card by attacking the bank, I trust attackers will reveal themselves going after larger accounts). As long as I keep this piece of laminated plastic private and visit a bank branch to replace it every 17 to 35 transactions, I can have some peace of mind, at least regarding my bank account.

[1] There have since been efforts to streamline mobile payments, which I avoid because it leaves the phone as a single point for compromise.

Re: South Korea’s online security dead end

#46

Post by veeti »

flotzam wrote: post #37
second_brekkie wrote: post #34

I live in Korea. In my experience pretty much everyone I know uses banking apps which you can do everything through, not online banking through a browser. You would hope that these would be somewhat more secure as this may have required a 're-write' as the article suggested. Though even with mobile apps you sometimes have to install some 3rd party 'anti-virus' software that probably amounts to spyware. But hey you ca…

There's a curious absence of Korean banking apps on this GrapheneOS compatibility list: https://privsec.dev/posts/android/banking-applications-compa... Does it mean none are usable on a modern clean Android? Or is there a total Samsung monoculture? Something else?

No one uses GrapheneOS in Korea?

Re: South Korea’s online security dead end

#47

Post by ronsor »

Roark66 wrote: post #29

Oh boy... Once I saw this: >This starts with a simple fact: some of these applications are written in the C programming language, not even C++. I had to stop reading and come here to see if anyone else got annoyed by it. Seriously? "not even c++" are we still in 1990s?

Linux is written in C. Much of its basic userland is also written in C, including any graphical subsystems such as X11/Wayland.

Re: South Korea’s online security dead end

#48

Post by thorncorona »

ThePowerOfFuet wrote: post #13
physicles wrote: post #11

This mirrors the situation in China, likely for similar reasons. To this day, I can only do online banking with Internet Explorer 11. When logging in, of course the password field doesn't permit pasting. I have a couple ActiveX controls and certs installed, but I've forgotten which ones so I'll just have to keep that old laptop around. The one bright spot is that large transactions do require a USB dongle. At least o…

> At least one other website I've used (perhaps Alipay?) required you to install a browser plugin simply to be able to "securely" enter your PIN. Straight-up government malware right there.

AliPay is 3rd party?

Re: South Korea’s online security dead end

#49

Post by ravel-bar-foo »

yjftsjthsd-h wrote: post #44
ravel-bar-foo wrote: post #40

Earlier quoted context omitted.

Korean banking apps usually are disabled in rooted Android, probably because in rooted Android the integrity of the binary cannot be verified.

See, usually when I run into claims about rooted Android being less secure, I point out that they have no problem with regular laptops that the user has root/admin on, but in this case I suspect they try to DRM control of that, too...

It's definitely about full device control. How else would the mandatory "anti-keylogger" software work?

Re: South Korea’s online security dead end

#50

Post by xorcist »

yongjik wrote: post #27
palant wrote: post #10

Earlier quoted context omitted.

Disclaimer : I am the author of this article. I think that this issue is really universal across all banks in Korea. I was told (but couldn’t confirm) that this is a liability question. Supposedly, there was a court ruling that held a bank liable for a customer’s losses due to lack of security precautions. So now all of them implement “security precautions” to avoid liability. Thank you for the hint, I fixed the typo…

> Supposedly, there was a court ruling that held a bank liable for a customer’s losses due to lack of security precautions. You already wrote as much in the article, but (AFAIK) the reality is even worse: there were court rulings that exonerated banks, as long as they followed the standard "security practices." Some hacker from China could access the bank's website from a suspicious IP, drain all the money from a poo…

> security plugins

A contradiction in terms of epic proportions.

Post reply on HN