Slashdot Mirror
20 Million People Exposed In Massive South Korea Data Leak
wiredmikey writes "While the recent data breach that hit Target has dominated headlines lately, another massive data breach was disclosed this week that affected at least 20 million people in South Korea. According to regulators, the personal data including names, social security numbers, phone numbers, credit card numbers and expiration dates of at least 20 million bank and credit card users was taken by a temporary consultant working at the Korea Credit Bureau (KCB). The consultant later sold the data to phone marketing companies, but has since been arrested along with mangers at the companies he sold the stolen data to. A similar insider-attack occurred at Vodafone late last year when a contractor made off with the personal data of two million customers from a server located in Germany. According to a study from PwC, organizations have made little progress developing defenses against both internal and external attackers, and insiders pose just as great a security risk to organizations as outside attackers."
The data at some stage will be unencrypted or there will be some developer or admin who knows how to unencrypt it.
It doesn't matter if you pay your staff well - people can still be blackmailed / need money to pay of debts.
" . . . but has since been arrested along with mangers at the companies he sold the stolen data to."
How do you arrest a manger? Why would you arrest a manger?!?
After all S.Korea uses an activeX plugin for all their security needs...massive single point of failure and all that.
Om, nomnomnom...
Eventually we're just going to have to face the fact that there is no data privacy anymore, whether accidental or intentional. Rather than hiding information through obscurity and security, some day I foresee global systems that have the "official" data publicly available, including the public keys used to identify people when they access their information services.
So the onus will be on retailers and others to have the user log in with their private key to identify themselves, rather than presenting a pin card with a weak identifier. Much though I loath to admit it, smart devices are going to take over for smart cards in due time, simply because you'll need to have some sort of carrier and key system for those private keys.
Not that we've ever really had that much privacy in the first place -- anything but a social insurance number/social security number has always been fair game for corporations and organizations to use as an identifier. Here in Saskatchewan, our health card numbers are heavily abused by just about everybody as an identifier, because they're allowed to use that id by law, and because it's an id that everyone has, even underage children.
I do not fail; I succeed at finding out what does not work.
I did not access beta.slashdot.com. I accessed the main website. Breaking my UI is not welcome...
You're not alone.
As somebody who has worked in the software industry for decades now, I find it stunning that the Slashdot beta project has not been terminated yet. It's a failure in every single sense. The users here almost all absolutely hate it. It looks worse than the existing site. It functions worse than the existing site. I think it's slower than the existing site. There is so much wasted empty space. The fonts are harder to read. The discussion is much, much more difficult to follow. It's harder to post a comment. Being forced to use it unexpectedly affects users trying to use the existing site!
And those comparisons are to an existing Slashdot site that was Web 2.0-ified a while back, making it even shittier than the site that preceded it!
While we should be accustomed to social media web sites shitting all over their users with bad redesigns, Slashdot is really taking it a step beyond with this beta site. I can sincerely see a Digg v4-style disaster happening again if the beta site goes live, it's just that bad. The beta will drive away the few remaining users of value.
I sure hope that Slashdot does the right thing, and puts an end to this beta site project. Nothing good will come out of it, aside from lessons about what not to do. Everything about the beta site is just plain bad. Terminate the project, throw away the code, and move on. And do this well before the beta site ever replaces the current one!
I guess you don't have much physical security when your servers are at a horse farm!
Insiders don't pose "just as great" a risk, they're by far the bigger risk.
Nearly any attack vector usable by an outsider is also usable by an insider, but the converse is not true. This means that insiders are the primary risk to consider, in fact insiders are almost the only risk you need to think about. "Almost" because attack vectors aren't the only consideration, you also have to look at motivations and capabilities, and it may be that external attackers have motivations or capabilities that insiders do not. In most contexts, though, if you can protect against insiders, addressing the remaining external risks will be trivial.
My day job is about securing a substantial database of very sensitive information, in a commercial context that has highly capable insiders. Insiders are, to a first approximation, the only attackers I think about. This sometimes annoys people who really want to say "But I can be trusted!" (but mostly are smart enough not to actually say it).
In my previous job, I was a security consultant, working with many fortune 500 firms, and the same viewpoint was the right perspective nearly all of the time there as well. Of course, most clients didn't want to hear that, because protecting against insider threats is generally hard, tedious and unsexy.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
The whole technical implementation of a credit card is flawed. The banking industry desperately needs another solution, magnetic stripe and pin is toast, magnetic stripe, pin and chip is also toast (man in the middle attack) and to do an online payment you have to provide a card number, pin code and CCV. On an internet which is full of personal information, provided by users or hacked out of badly secured databases. And instead of replacing what is flawed, insurances pay for the losses which are then charged back to users of the cards, by increasing fees or whatever. Yet, several institutions and countries mark Bitcoin as dangerous, it's a strange world we live in.
Really. You'd need military-grade security and strictly planned access levels -- and then look at what Snowden did.
Even more, in most companies there's just no way to implement this. Data is just what they're working with and often the most basic security is bypassed or never implemented just because it's too bothersome while being without any immediately visible gain.
Come on, every admin out there will know that just too well. Security against attacks from the outside, yes. Security against attacks from the inside? Forget it. People need to work with the data and even just to make sure that people have only the access they really need often is so much bother that nobody wants to start with that.
We need to get rid of the idiotic idea that quasi-public information like SSNs and CC numbers are "secret".
I'm 38, my father is about twice my age. When I was a child I remember some philosophically strong arguments against the use of SSNs in any venue other than the government program they were created for. My father wasn't religious, though later I discovered myself the whole "number of the beast" thing (i.e. christian prophecy about things like the tattooed ID numbers on jewish prisoners of the nazis. To a lesser extent, the idea of humans viewed as consumer cattle by society. I.e. you can't buy or sell or basically function in society without providing your unique numerical identifier to help you be tracked to that level of detail.
Now it seems we've infected south korea with our Social Security Number system. Que Sera Sera.
South Korea uses SSNs? AND they misuse them just like the US?
This is baffling. Any decent country would look at the way the US uses these numbers and learn from our mistakes. I.e. have a number but don't make it the key to unlock credit or subject to tax refund abuse or any of the dozens of other ways SSNs are misused.
Sig for hire.
It's fairly easy to get to 'mostly secure' with off the shelf appliances and training/education. But each percentage more secure a network becomes beyond that point becomes exponentially more expensive in both IT implementation costs and user productivity lost. Unfortunately this cost is too much for a very large percentage of companies when it comes to their overall profitability from both the implementation and productivity end.
Personally I think the corporate world needs to shift away from maintaining any sort of data that should be considered 'highly sensitive' in the first place. Instead of such data being desired, it should be shunned. And only in the most required of circumstances allowed by leadership. As it stands now leadership is grasping for this highly sensitive data like random citizens grasping for cash falling from an overturned armored truck on a bridge - and they don't want to put the money and resource into keeping it safe.
OK, ensure that punishment fits the crime by all means, and crooked employees have been yielding to temptation for centuries.
Still, I can't help thinking that maybe, just maybe, if financial institutions developed their employees properly, and had enough of them, plus paid them just a fraction of their traders and CEOs, then they would have loyal, competent and trustworthy staff instead of having to rely on contractors.
Hey, they might even not have to spend that much money; I've been in plenty of situations where there were dozens of contractors, and not one of them costing less than 1000 per day...and usually plenty more than that.
I see a pattern here -- "contractor", "temporary consultant", "external employee", and so on.
You tell your workers up front that you don't give enough of a fuck about them to actually hire them. Then, you feign shock and indignation when it turns out that they don't have your best interests at heart. Yes, you really must be that fucking stupid. Reap what you sow, bastards, and I will shed no tear for you.
Repeat after me: “Security is a process, not a product.”
They managed to arrest the guy, that is good defense. Who want to steal stuff if the outcome is guaranteed to be jail?
Luckily, South Korea is soon to have its first VC-backed Bitcoin exchange. Soon such privacy breaches will be a thing of the past.
Maybe its time retail companies didn't record these things for posterity? Rather a record of the transaction, and a one-way hash of the last 4 numbers of the CC, but never the CC number in total or the expiration. Are these retail parties keeping this info to sell demograpic data?
Its time for a change here too. JW
social security?