[Editorial] Gaping Holes in Internet Banking Security

Four young people have been arrested for breaking into an internet financial transaction system using the most basic hacking technology. According to Friday's announcement by the Seoul Police Agency, they used a program that read users' user names, passwords, and their security certificate passwords from their computers. Their methods have rendered useless the four-level security procedure that starts with logging in, bank account passwords, security certificate password, and the bank's own security authorization card, and they are shocking because it was a simple interception of people's data by entered using their computers.

What must be guarded against at this point is extreme reactions of either encouraging baseless anxieties about internet banking or ignoring the problem as not that big a deal. What is needed right now is to carefully review what the holes in the system are. What the case shows is that the bank believed in the multi-level security system and then were negligent with the little loopholes that existed in each level. It demonstrates that when it comes to security the slightest lapse can lead to terrible results.

They say that this would not have happened if the site had been designed to establish a firewall automatically and if it had been made so that users were unable to stop the firewall from functioning. The security certificate process, an important security provision, is also a problem. The hackers took advantage of the fact that people could be reissued certificates by entering their Resident Registration Numbers without having to confirm whether they were really the name behind the number. Certificates are like "internet identity cards" and more than 10 million internet users have them, so the process urgently needs to be strengthened. Financial institutions need to work on their own firewalls and security cards. It must be realized that holes in the security of online financial transactions are a serious problem for having the potential to send the whole of the economy into a state of confusion.

The Hankyoreh, 4 June 2005.

[Translations by Seoul Selection (PMS)]