2 ms·

Thanks for the summary. From this, it does appear that they used an antivirus update server as the attack vector. And about SK's internet infrastructure--belie

by kyllo 14y ago

Thanks for the summary. From this, it does appear that they used an antivirus update server as the attack vector. And about SK's internet infrastructure--believe me, I know. I had an account at Woori Bank when I lived in Korea. For internet banking authentication, they gave me two different PIN numbers (one 4-digit and one 6-digit) and a scratch-off card with a password matrix on it (at each login it would require me to enter digits found in different positions on the card), in addition to username/password and requiring me to install an AhnLab antivirus program, an "anti-keylogger" program, and 2-3 ActiveX encryption programs. I believe it was actually written in South Korean law until very recently that browser security/encryption MUST be implemented in ActiveX, and HTTPS/SSL was completely unheard of in Korea. I think these other authentication measures were devised to make up for the weaknesses of the ActiveX encryption. When I asked the bank rep why they had so many different authentication measures, the response was, and I quote, "Because Chinese people do the fake things."

kijin 14y ago
The scratch-off card is a poor man's one-time password generator. In fact, it's remarkably effective at preventing scammers from draining people's accounts, as long as you're not stupid enough to take a photo of your card and post it online (yeah, people do that). That little card is what prevents the whole ActiveX fiasco from crumbling down like a house of cards, precisely because it's so low-tech (i.e. requires physical access). A lot of the other crap is understandable when you take into account the fact that online banking was first introduced to Korea in the mid-1990s. HTTPS was useless at the time because of U.S. export restrictions limiting it to 40 bits. Home-brewed ActiveX controls were used to implement 128-bit encryption. Korea also decided to use public keys and X.509 client certificates to identify people, way ahead of the rest of the world, but of course no browser supported them so someone had to write custom software. After that, inertia and regulatory capture allowed what was supposed to be a stopgap measure to continue for another 15+ years, long after proper HTTPS became available in every browser. The only benefit I can think of is that Koreans don't have to worry about those stupid password restrictions that a lot of American banks impose on their customers :)

by kyllo 14y ago

kijin 14y ago

The scratch-off card is a poor man's one-time password generator. In fact, it's remarkably effective at preventing scammers from draining people's accounts, as long as you're not stupid enough to take a photo of your card and post it online (yeah, people do that). That little card is what prevents the whole ActiveX fiasco from crumbling down like a house of cards, precisely because it's so low-tech (i.e. requires physical access). A lot of the other crap is understandable when you take into account the fact that online banking was first introduced to Korea in the mid-1990s. HTTPS was useless at the time because of U.S. export restrictions limiting it to 40 bits. Home-brewed ActiveX controls were used to implement 128-bit encryption. Korea also decided to use public keys and X.509 client certificates to identify people, way ahead of the rest of the world, but of course no browser supported them so someone had to write custom software. After that, inertia and regulatory capture allowed what was supposed to be a stopgap measure to continue for another 15+ years, long after proper HTTPS became available in every browser. The only benefit I can think of is that Koreans don't have to worry about those stupid password restrictions that a lot of American banks impose on their customers :)