4 ms·
Expect more of the same from South Korea in the weeks, months, and (unfortunately) years to come. These massive attacks have been happening for many years now,
by kijin 14y ago
Expect more of the same from South Korea in the weeks, months, and (unfortunately) years to come. These massive attacks have been happening for many years now, and nobody seems to have learned a thing.
The latest news here in Korea says that bank employees' PCs were infected through a compromised third-party package management system. Only two years ago, 35 million accounts at one of South Korea's most popular social networking services was compromised through a similar route: the attackers broke into the update servers of a popular antivirus software, which was used on employees' PCs. Same story, only with different companies.
And of course, by "PC", I mean machines running Windows XP with the user always logged in as administrator and IE's security setting somewhere between Medium-Low and Low, because how else are you going to browse the ActiveX web? The companies that provide package management systems and antivirus software probably also use similar PCs, which is likely to be one of the reasons why they got compromised in the first place.
Macs are getting popular nowadays among chic teenagers and college kids, but on the other hand, a long-time member of an IT forum that I frequent recently asked whether he should upgrade from IE6 to IE8 on his primary computer. We might make the best Android phones in the world, but the rest of South Korea's IT infrastructure is nothing but a series of facepalms.
And the first thing the leaders do is blame North Korea. Which they have been doing every time something similar happened in the last 4-5 years. I don't know whether it's actually NK or not, but as for improving the system, nope, my brother's university still asks him to disable several of IE9's security measures every time he logs in.
- chao- 14y agoA year ago we looked into how feasible it would be to expand operations of our company beyond the US. Because we have a Korean-born Korean as a core team member, it was placed very high on the list of countries to explore. That spot lasted about fifteen minutes. By law in South Korea, you have to use an ActiveX plugin (and therefore IE) to process eCommerce transactions [1]. Looking it up just now to see what has changed in six months, I see that it's not strictly true anymore. The official policy allows for other browsers, but none of the steps necessary to allow those browsers have occurred. [1] http://gadgets.ndtv.com/internet/news/how-south-korea-became-slave-to-microsoft-internet-explorer-223429 http://gadgets.ndtv.com/internet/news/how-south-korea-became...
- kijin 14y agoYep, the official policy now allows for other browsers, and even encourages banks to implement web standards. But nobody is willing to implement the software that is necessary to port the current public key infrastructure to non-Windows, non-IE platforms, simply because there is not much money to be made. Some of the large banks have come up with half-baked cross-platform services to appeal to rich kids with Macs, but payment gateways have not changed at all. Only geeks use Chrome here, and I'm probably the only person in my town who uses Firefox. Mobile, of course, is a very large market, but banks just write their own Android & iOS apps and call it a day.
- waps 14y agoOh well, another country where it is a matter of (little) time until visa/mastercard/16 digit number cards breaks through. I don't understand these people's reasoning. Relentless innovation is how you become and stay the best. Kicking down the competition, secure in your market position is how you die. It may take a bitcoin, but sooner or later these companies are doomed.
- kyllo 14y agothe attackers broke into the update servers of a popular antivirus software, which was used on employees' PCs. Are you referring to Ahnlab? I'm convinced that Ahnlab's virus scanner software is itself a form of spyware. Wouldn't surprise me at all if it has been used as an attack vector.
- kijin 14y agoNo, I'm referring to the Nate/Cyworld incident, in which an update to the Alyak (알약) antivirus program, developed by ESTsoft, was regarded as a prime suspect. Alyak is extremely popular in Korea, due to the fact that it is free and comes bundled with Alzip (알집), a popular compression utility. IMO the entire Altools (알툴즈) family of programs is utter shit. Their entire domain is blacklisted in every PC I manage. Ahnlab is a much more respectable company, and I have yet to hear of a major security incident where Ahnlab software was implicated. Their V3 line of software are clearly not the best in the industry, but I would be very surprised if they were any worse than other antiviruses. Edit: According to the latest news, today's malware was disguised as a component of an antivirus program sold by Hauri, Inc. (하우리)