South Korea’s online security dead end • Hacker News Board

Re: South Korea’s online security dead end

#61

Post by toiletfuneral » Wed, Jan 04, 2023, 12:41 AM UTC

kragen wrote: post #35

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

this is a cautionary tale for people who hope that government regulation will solve the current computer security disaster outside korea you cannot solve problems by giving authority to people who are motivated to solve them, but do not understand what the problem is, so that they can tell the people who do understand the problem what to do anyone who has dealt with pci-dss presumably knows this but that is a much sm…

[dead]

Re: South Korea’s online security dead end

#62

Post by martinald » Wed, Jan 04, 2023, 12:45 AM UTC

cameronh90 wrote: post #56

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

In the UK, the bank is also usually responsible for any unauthorised transfer, yet our banks are generally quite digitally enabled. Some banks solve the transfer authorization issue using an external bit of hardware that you type the transaction details into and it gives you a signature OTP.

I honestly dont know much much longer the banks can continue to refund people for fraud. The scale of it is enormous - £600m last year (which is likely to be the floor of it as I imagine it doesn't all get reported correctly).

If it continues growing (~40% y/y) at this kind of rate then it will soon outstrip any profits from retail banking (which is pretty low margin as it is compared to banks investment and commercial arms).

I wouldn't be surprised if we see UK banks exiting retail banking because of this.

Re: South Korea’s online security dead end

#63

Post by joshuaissac » Wed, Jan 04, 2023, 12:47 AM UTC

Large banks in the UK used to promote an application called Trusteer Rapport that secured the connection between the bank's server and the user's computer. It was not mandatory like the Korean apps, just strongly suggested. I can see that some banks still offer it.

Re: South Korea’s online security dead end

#64

Post by PradeetPatel » Wed, Jan 04, 2023, 12:49 AM UTC

thorncorona wrote: post #48

ThePowerOfFuet wrote: post #13

Earlier quoted context omitted.

> At least one other website I've used (perhaps Alipay?) required you to install a browser plugin simply to be able to "securely" enter your PIN. Straight-up government malware right there.

AliPay is 3rd party?

It has been established that large private enterprises in China have connections with the Communist Party of China, aka the government.

Re: South Korea’s online security dead end

#65

Post by maxgashkov » Wed, Jan 04, 2023, 12:55 AM UTC

ravel-bar-foo wrote: post #45

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

It is worth mentioning that to make a bank transfer in Korea (used to[1]) require 3 factor authentication: the user's website password, the user's PIN, the user's encryption certificate signature/공인인증서, and two randomly selected codes from a paper numbers card (보안카드: https://file2.nocutnews.co.kr/newsroom/image/2013/07/02/2013... ), which users are instructed to never copy or digitize. Of all these solutions, the num…

btw, this paper card approach was replaced by physical hardware OTP tokens (lasting multiple years until they have to be replaced), it’s as secure as the supply chain (which is also a factor for paper cards), so I’m not sure why Korea still clings to this as tokens are obviously a net gain in ops cost

Re: South Korea’s online security dead end

#66

Post by zinekeller » Wed, Jan 04, 2023, 1:03 AM UTC

maxgashkov wrote: post #65

ravel-bar-foo wrote: post #45

Earlier quoted context omitted.

It is worth mentioning that to make a bank transfer in Korea (used to[1]) require 3 factor authentication: the user's website password, the user's PIN, the user's encryption certificate signature/공인인증서, and two randomly selected codes from a paper numbers card (보안카드: https://file2.nocutnews.co.kr/newsroom/image/2013/07/02/2013... ), which users are instructed to never copy or digitize. Of all these solutions, the num…

btw, this paper card approach was replaced by physical hardware OTP tokens (lasting multiple years until they have to be replaced), it’s as secure as the supply chain (which is also a factor for paper cards), so I’m not sure why Korea still clings to this as tokens are obviously a net gain in ops cost

As pointed out, legislation detailing the exact measures needed to be done. I guess they copied over the idea of European TANs but they never found out about hardware OTPs.

Re: South Korea’s online security dead end

#67

Post by gkanai » Wed, Jan 04, 2023, 1:07 AM UTC

I was working at Mozilla in 2007 when I first brought this issue to the wider (i.e. beyond S. Korea) Internet. My post from then was widely covered by Slashdot and Boing Boing and other tech sites. S. Korea clearly doesn't care to 'fix' this because they've had more than enough time to do so.

https://archive.is/ermII

CNet back in 2007:

https://www.cnet.com/tech/tech-industry/about-south-koreas-d...

https://it.slashdot.org/story/07/01/26/1455224/why-south-kor...

Re: South Korea’s online security dead end

#68

Post by varenc » Wed, Jan 04, 2023, 1:10 AM UTC

I poked around the install page for Citibank's required software and it's pretty fascinating: https://www.citibank.co.kr/CusSecnCnts0100.act?P_name=ASTx

Some quick observations:

- That page intentionally disables right-click! Just by putting `oncontextmenu="return false"` on the tag. This gives me flashbacks to the late 90s when this technique was used to make it harder for users to copy images or inspect HTML source. Browsers all have built in developer tools so pretty silly seeing it now.

- The JS included on that page is a mix of heavily obfuscated code[0] and completely unminified code with all the internal comments left in[1].

- I was impressed that the required software seems to support Fedora and Ubuntu/Debian as well as macOS and Windows.

- One of the installations is checked by making a JSON-P call (another old tech flashback!) to `https://lx.astxsvc.com:55921/ASTX2/hello?...`. This works because lx.astxsvc.com resolves to 127.0.0.1 so you're just hitting your localhost. Presumably the installed software checks the referer header to ensure only citibank is making these requests.

[0] https://www.citibank.co.kr/aB-IFIZu8Pd7Zd1yjboonwGx/uYfEz6Dp...

[1] https://www.citibank.co.kr/3rdParty/wizvera/veraport/install...

Re: South Korea’s online security dead end

#69

Post by kragen » Wed, Jan 04, 2023, 1:14 AM UTC

MBCook wrote: post #59

kragen wrote: post #35

Earlier quoted context omitted.

this is a cautionary tale for people who hope that government regulation will solve the current computer security disaster outside korea you cannot solve problems by giving authority to people who are motivated to solve them, but do not understand what the problem is, so that they can tell the people who do understand the problem what to do anyone who has dealt with pci-dss presumably knows this but that is a much sm…

Isn’t this an issue of mandating the means and not the ends? If the regulations said banks had to be secure by ‘taking all due care’ and follow ‘best practices’ and such, this wouldn’t be such an issue. That gives room for improvements and for problematic standards to be weeded out over time. It sounds like the government instead said banks had to be secure by using (for example) SSL 1.0 with a 64-bit key. Because th…

that just leaves the courts to decide what the best practices are, and what due care is or isn't, which i think is actually what happened in south korea

that would be great if judges were hackers and legislators weren't, but that isn't the current situation

Re: South Korea’s online security dead end

#70

Post by astrange » Wed, Jan 04, 2023, 1:43 AM UTC

pessimizer wrote: post #51

userbinator wrote: post #39

Earlier quoted context omitted.

For example, the issue of password leakage due to a keylogger installed on a user's PC is considered to be a bank problem, not a user problem. In other words, they're authoritarians at heart. They want complete control over the environment and don't want users to have any personal responsibility.

In non-authoritarian countries like the US, the users are responsible for all of the bank's losses.

They certainly aren’t. That’s what FDIC / Reg E / Reg NMS and co are for. US financial regulation is pretty customer friendly.