3 ms·

No no no, it doesn't work that way. These banking websites don't expose a well-defined API that you can emulate. Instead they force you to install a bunch of

by yongjik 13y ago

No no no, it doesn't work that way. These banking websites don't expose a well-defined API that you can emulate. Instead they force you to install a bunch of ActiveX plugins (usually with administrative privilege) and you have to just trust that they won't, say, read the whole content of your hard disk and stream it to a third-party site. A few years ago (when I was still in Korea), it was usually impossible to open two different bank's pages at the same time: I'd assume that's still the case now. As far as I know, the reason is that both banks will force you to install "anti-hacking" plugins, which hooks directly into your Windows Kernel and makes sure nobody else snoops on what you type. Yes, these webpages try to establish a direct connection between your keyboard and the website, completely bypassing every layer. Now imagine the fun when two such plugins try to run at the same time. And of course without these plugins you can't use the site. Hell, sometimes these sites spontaneously break just because you're accessing it from the US, because nobody had thought to test them from a client with ping time > 200ms. Now try emulating that in client. (I don't know if I should laugh or weep.) EDIT: Besides, if you seriously try to make a platform that can emulate these "security" plugins, sooner or later you will be arrested for making tools to circumvent security measures, and people will be reminded that they should never install anything from "suspicious" sites. (But of course install everything from banking sites.) As a bonus, some news media will claim you were paid by North Korea, and many will believe that.

viraptor 13y ago
Thanks, that's the part I haven't heard of before - good explanation of the issue. So if someone wanted to reimplement the client, they would have to reimplement a different one for every single site. Depending on the difficulty of working around the issue though, I wonder if it's a business opportunity: offer a web proxy which is transparent for all purposes, apart from the activex part - it would replace them with something that's either pretending to run the verification itself, or provides some replacement script. If you ran the company outside of Korea that took subscription money to bypass a number of the most popular services' auth, it would be hard to shut down. (but it would become a cat and mouse game of updating the algorithm until one side got bored...) Unfortunately this would have to be written in some interesting way that guarantees the passwords / tokens / sessions are never captured by this system, otherwise noone would use it. But that's a technical problem - should be doable in some way.
jessaustin 13y ago
Thanks for the great explanations. It actually makes some sense that Koreans are getting hacked all the time, since the binary rootkits they're required to install have probably not seen the scrutiny that more open solutions have. Secure systems used in the rest of the world get hacked because of weak entropy or through timing attacks: fairly esoteric stuff. It wouldn't surprise me if these ActiveX blobs have basic algorithmic errors. Do they crash quite a bit?
- yongjik 13y ago
  Sure, they crash (or do something funny) a lot of time, but that's the problem with these ActiveX controls. If you buy anything from a Korean site you end up with an unknown number of plugins downloaded from everywhere, so how do we know if it's a bug in some plugin, a plugin already infected with virus, or just some malware you downloaded accidentally? (The last one, because you have to hit "OK" all the time: actually recent versions of Windows is being quite reasonable and wants to warn you when you install binaries from random websites, but this is exactly what Koreans are asked to do every day, so Korean bank websites contain these helpful pages showing how to lower Windows' "security level" and override the warnings.)

by yongjik 13y ago

viraptor 13y ago

Thanks, that's the part I haven't heard of before - good explanation of the issue. So if someone wanted to reimplement the client, they would have to reimplement a different one for every single site. Depending on the difficulty of working around the issue though, I wonder if it's a business opportunity: offer a web proxy which is transparent for all purposes, apart from the activex part - it would replace them with something that's either pretending to run the verification itself, or provides some replacement script. If you ran the company outside of Korea that took subscription money to bypass a number of the most popular services' auth, it would be hard to shut down. (but it would become a cat and mouse game of updating the algorithm until one side got bored...) Unfortunately this would have to be written in some interesting way that guarantees the passwords / tokens / sessions are never captured by this system, otherwise noone would use it. But that's a technical problem - should be doable in some way.

jessaustin 13y ago

Thanks for the great explanations. It actually makes some sense that Koreans are getting hacked all the time, since the binary rootkits they're required to install have probably not seen the scrutiny that more open solutions have. Secure systems used in the rest of the world get hacked because of weak entropy or through timing attacks: fairly esoteric stuff. It wouldn't surprise me if these ActiveX blobs have basic algorithmic errors. Do they crash quite a bit?

yongjik 13y ago
Sure, they crash (or do something funny) a lot of time, but that's the problem with these ActiveX controls. If you buy anything from a Korean site you end up with an unknown number of plugins downloaded from everywhere, so how do we know if it's a bug in some plugin, a plugin already infected with virus, or just some malware you downloaded accidentally? (The last one, because you have to hit "OK" all the time: actually recent versions of Windows is being quite reasonable and wants to warn you when you install binaries from random websites, but this is exactly what Koreans are asked to do every day, so Korean bank websites contain these helpful pages showing how to lower Windows' "security level" and override the warnings.)