Slashdot Mirror
Korean Banks Forced to Compensate Hacking Victims
An anonymous reader writes "A brief story over on Finextra reveals that the Korean government is introducing new legislation that will force banks to compensate customers who have been victimized by identity theft even if the banks are not directly responsible. This action obviously will not stem identity theft but the hope is that this will push banks into security improvements that will make identity theft much harder."
From TFS:'Brief' is right...'skimpy' is the adjective that comes to my mind.
A much more detailed report on this story can be found at The Korea Times.
Reading through the above referenced story, two things pop out at me:
Given these two paragraphs, this looks like I'm going to be paying higher systems costs because others can't be bothered to practice responsible computing (when this initiative moves out of Korea into the rest of the world, that is...).
____
~ |rip/\/\aster /\/\onkey
Does anyone here really think the banks are going to pay this money out from their bottom line? They'll recover it from those customers who do protect their identity through increased fees and interest.
FTA: "Under the new legislation customers will still be required to implement safety measures and won't be compensated for losses incurred from online scams if they are careless with card details, PINS and passwords." (emphasis mine)
There's 50% of it right there.
I'm not trolling here, I have a question:
Does using Windows constitute being careless? How about using unpatched Windows? How about using Windows without malware scanners installed?
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
This is exactly what Bruce Schneier has been advocating for a while...here's his take on this story.
While I was working for Harvard Law School, the Secret Service came and spoke to the different IT communities at Harvard. What they came to tell us was that if there was any security breach, they would help us minimize the damages and then went through their plan on how to do that. The plan was essentially to not scare the public, not tell anyone, and hide as much of the damage as possible and try to recover. That basically does nothing for anyone interested in *actually* knowing how safe they are.
Kudos to to Korea having the balls to blame the people leaving the doors to security breaches WIDE open.
Reality is nothing but a collective hunch.
This action obviously will not stem identity theft but the hope is that this will push banks into security improvements that will make identity theft much harder.
I agree. I was listening to Clark Howard a couple of weeks ago on the radio and he was talking about how 99.9% of US banks have atrocious security when it comes to online banking. I know that identity theft also happens offline, but I also think that you have to criminalize grossly negligent behavior, or else you end up with a situation like what we have today: banks see it as more fiscally reasonable to absorb the cost of the problem than to even attempt to fix it. The problem is that this has tragic consequences for the individuals that are victimized. Hopefully the US congress will jump on board and start dealing with serious problems, instead of concerning themselves with things like college sports and drug testing among athletes, which ultimately shouldn't be of importance to the federal government.
The banks will use the new rules as an excuse to require Trusted Computing [or other restricted hardware/software] for home users, which in practice will mean some form of MS Windows. No MacOS, no Linux, no BSD, etc.
1) Put money in bank account
2) Have your pal steal your identity and the money
3) Bank recompenses you
4) Split PROFIT!!!!!
Only three things are certain; death, taxes, and apocryphal quotations - Ben Franklin.
If the SSL ceritifcate does not match the IP address of the host you are connecting to, it should raise big red flags in your head.
Sometimes, there are legitimate reasons for this (such as a bank moving servers and not having time to get a new cert), but they are usually very temporary, so to be safe you can just not do any banking during that period.
Sure, you can still bypass this via a man in the middle attack using ARP poisioning - but in order to do that the hacker has to be on your local subnet if you have a home router, or else working at your ISP if you are directly connected.
Either case is highly unlikely, and **any** way you look at it, even if your original DNS thing was an actual issue, online banking is much more secure thank banking at an ATM or via debit payment, and I bet you do that every day.
All I need to steal your money at an ATM is to install a hidden swipe reader inside the ATM/debit machine and a hidden camera to capture your PIN number. This happens *all the time*, far more than publicized. It is very easy to do, and a smart crook who just leaves the setup installed for a few hours then takes it down is rarely caught either
Even easier is to just capture the cazd swipe, us eit to make a fake identical copy of your own card, and going into the bank and convince the teller to let you change the PIN on the card cause "you forgot it". Also simple to do. Much simpler than hacking itno the DNS servers of your ISP, that's for sure.
...now if the Nigerian government would just do something to get my money back from that doctor fellow!
Dark Reflection
SSL certifcates are almost never issued to IP addresses, only to fqdn hostnames. In fact I've never seen a certificate with an IP address in the CN field, and I'm not even sure how a browser would handle it. In fact, issing a certificate to an IP address would make things even less secure. With a hostname, the broswer can check against a forward and reverse looklup, theoretically maximizing the number of machines that would have to be compromised to hijack the connection. It also subverts the only real check most certificate authorities do - verifing that the cert request is coming from the domain owner on record.
Imagine if you owned a ski resort operation and you just dropped twenty mil on a souped-up chair lift. As the lift company advised, you hired people to go regular examinations and keep it lubed up. Then one day the stress of a chair switching from the slow loading track to the high-speed main line caused the cable to snap, killing dozens of people, including lots of pregnant women carrying pandas. Checking the line integrity was not on the company-issued checklists of the maintainers you hired but the chair lift company said they'll have a look at it every six months to run stress tests themselves and they found a problem that seemed small enough not to bother fixing. The chairlift company, hopefully insured, ought to be the ones exposed to liability, and this Korean bank incident should be no different. The software company (assuming it's not Debian (in which case this wouldn't have happened anyway)) should be the ones absorbing the heat. That may not be the law, but it strikes me as common sense.
I may be wrong but I believe this is covered for every bank in Canada is it not? I had my card double swiped and my bank account emptied (along with 50,000 other people in Vancouver I believe). I had the money back in my account within 2 weeks. All money in a bank is insured, just like your creditcard is insured. What's the difference between this and a robber stealing money from a bank?