South Korean ID System To Be Rebuilt From Scratch After Massive Leaks

AmiMoJo writes: South Korea's national identity card system may need a complete overhaul following huge data thefts dating back to 2004. The government is considering issuing new ID numbers to every citizen over age 17, costing billions of dollars. The ID numbers and personal details of an estimated 80% of the country's 50 million people have been stolen from banks and other targets. Some 20 million people, including President Park Geun-hye, have been victims of a data theft. Citizens are unable to change their credentials, which are used in many different sectors, making them an attractive target for hackers.

Comments

Re:20 million out of 50 million stolen?

[mlts]

We have the same thing here in the US, but good luck getting a new SSN if it gets compromised.

But the ID shouldn't have to be secret

[Lorens]

Granted it's not good if the IDs are easy to guess, nor if the list of IDs+names gets out, but as long as you're not using the ID to authenticate people, only to identify them, it shouldn't be a terrible problem. Think ID=username, not password. What they say about the credentials seems a bit more worrying, but we'd need a lot more info here . . .

Re:But the ID shouldn't have to be secret

[rtb61]

So the real problem is not identity theft at all, the real problem is vendors failing to properly identify the person, allowing a fraudulent transaction to occur and then pursuing the wrong person.

Easy way to solve the problem, charge the vendor with fraud with they make a false claim against person when then vendor can not prove a fraudulent transaction was made against them.

It should never ever be a innocent parties fault who had not part in the transaction, they should not need to prove anything. First in the firing line should always be the vendor for making a fraudulent claim against an innocent party. You can bet it will not take long for vendors and credit providers to tighten up on identification requirement once they start facing penalties for fraudulent charges.

Re:But the ID shouldn't have to be secret

[dgatwood]

So the real problem is not identity theft at all, the real problem is vendors failing to properly identify the person, allowing a fraudulent transaction to occur and then pursuing the wrong person.

Exactly what I've been saying for years. There's no such thing as identity theft. You can't steal an identity, by definition, because an identity is who you are, not some arbitrary piece of information used to represent you. An SSN is an identifier, not an identity. (This is not precisely correct in the cryptographic sense of the term, but neither is an SSN in any way cryptographic, so that distinction is largely moot.)

With that said, identity fraud isn't entirely the fault of vendors. Much of the fault lies with the credit bureaus. Their business involves making claims about a person based on insufficient authentication, then charging money to consumers for "protection" against them making false claims when they fail to do their jobs correctly. Credit bureaus are the very definition of a protection racket (minus the physical violence).

The easy way to solve the problem is that when someone makes a false claim about you, sue the credit bureaus. Because you have no ongoing contractual relationship with them, they cannot compel you to binding arbitration, and because they are making false claims about you in writing, they are guilty of libel. It would only take a few thousand people doing this to force the credit bureaus to take authentication more seriously, such as providing call-back authentication at no cost to consumers—something that they should have been doing all along.

Re:20 million out of 50 million stolen?

[Anonymous Coward]

Let South Korea be an object lesson in why we should not be using the Social Security Number as a unique ID here in the States.

As a security measure, services available via Internet in South Korea require registration using the KSSN. Naturally, they were hilariously easy to steal because of this. In fact most gamers these days who want to play in the South Korean sandbox have access to South Korean KSSN generators because the issuing algorithm was cracked almost as soon as it was created.

Identification != Authentication

[Anonymous Coward]

In Switzerland the equivalent of a Social Security Number (AHV-Nummer) is pretty much public knowledge.
E.g mine is 114.77.233.114, and I'm posting as AC!! There is even an online tool to calculate the number from birthday, name and gender.
And we don't have more problems with identity theft than the rest of the world.
The difference is for authentication for important stuff we have to show up in person with an ID and a real human checks the identity.

Re:Identification != Authentication

[IamTheRealMike]

The difference is for authentication for important stuff we have to show up in person with an ID and a real human checks the identity.

For some things you can also use a SuisseID which is just a regular PKI smartcard USB dongle thingy. I have one. After installing the software, you can log in to some Swiss websites by just clicking the login button in the web page. You might have to enter a password and the dongle then signs the SSL session. It's all standards based and the certificate in the hardware is based on your legally verified identity, i.e. you show a passport at the post office and get your personalised stick through the mail a few days later.

Re:20 million out of 50 million stolen?

[Jane Q. Public]

We have the same thing here in the US, but good luck getting a new SSN if it gets compromised.

That is a perfect illustration of why any kind of "National" ID system is a bad idea: it's a bill-board-sized, high-value target.

There are other reasons, too, but that one alone is sufficient.

Re:20 million out of 50 million stolen?

[Reason58]

National identifaction is perfectly fine. The problem is when it is also used as the national authentication.

Re:20 million out of 50 million stolen?

[Reason58]

Identification even.

Re:20 million out of 50 million stolen?

[TubeSteak]

The hardest part of getting a new SSN is gathering up originals/certified copies of the documents you need to support your application.
http://www.consumer.ftc.gov/articles/0248-do-you-need-new-social-security-number

Applying for a New Number or Replacement Card

The SSA may assign a new Social Security number to you if you are being harassed, abused, or are in grave danger when using the original number, or if you can prove that someone has stolen your number and is using it. You must provide evidence that the number is being misused, and that the misuse is causing you significant continuing harm.

Please don't spread misinformation.

Re:20 million out of 50 million stolen?

[mlts]

Going on a limb here, why not replace the national ID system with a bunch of decentralized CAs that sign certificates with a piece of data. For example, a user would have some cryptographic token. This could be a smartphone, a card, a USB keyfob, a SIM card, or something similar.

Then, the state would add a signed entry with the person's name and photo to the key as a certificate. The actual public key is not affected. It just gets a cert attached that can be deleted by the user just like a PGP/gpg cert.

With this in place, the state can add a series of certs if they are true:

User is a citizen.
User is 18+ years of age.
User is 21+ years of age.
etc.

This way, when a cardholder goes to a bar, the bar has a reader that shows a signed picture, perhaps the name of the user, and the signed fact that the user is of legal age. No other information needs to be shared. Not citizenship, not anything... just who the user is, and that they are legal (doesn't matter what their age is as long as it is above the drinking age). No cert, no booze.

Another example is a NGO use. A university signs a certificate that the key's owner has a diploma from them. When getting vetted for a job, this means that the employer knows that the applicant has a degree, but other info isn't given.

Done this way, here is what the criminals can attack:

1: The CA. If it is a distributed service, damage done can be minimized, as opposed to having everything in one basket.

2: The actual card or token. This is a solved problem. SIM card hacking on LTE networks is minimal, satellite piracy is nonexistant, and there isn't any such thing as pirated software on the XBox One. Even things like CAC/PIV cards are very rarely broken.

3: The user (yes, xkcd.com/538 applies.) However, this can be dealt with through means in place.

4: The PKI. Using different algorithms (so a document is signed by multiple keys of RSA, ECC, and something quantum-factoring resistant, and hashed with multiple algorithms) will bring some robustness.

So, there can be a national ID system, but if it is based on a PGP-like web of trust that is decentralized, it can be quite secure, but yet extremely protecting of privacy.