News for hackers. Stuff that matters.
Re:Update on campaign targeting security researchers by tape_measure on Wednesday March 31, 2021 @10:37PM (#26656038)
It's basically required in South Korea for online shopping. The link to the IE 0 day is written in Korean.

More on IE in South Korea: https://www.nationthailand.com/Startup_and_IT/30321025

Re:Update on campaign targeting security researchers by cmeacham98 on Wednesday March 31, 2021 @10:43PM (#26656074)
No longer required by the government as of recently: https://www.theregister.com/2020/12/10/south_korea_activex_c...

Unsure on whether major sites have gotten around to removing it though, perhaps a Korean HN reader could comment.

Re:Update on campaign targeting security researchers by thephyber on Wednesday March 31, 2021 @10:41PM (#26656062)
I remember IE was required for the South Korean government issued digital certificate (required for all internet-based retail transactions and likely others).

I guess I had assumed that the standard was compatible with newer versions of Windows or MS browsers. Really sad if it isn’t.

Re:Update on campaign targeting security researchers by neom on Wednesday March 31, 2021 @11:00PM (#26656159)
For some things in SK you have to download a bunch of weird proprietary government .exe's that seem to only run in conjunction with specific combinations of windows and IE. I was pretty shocked when my wife and I went to get our marriage certificate from the government, and going to get our marriage certificate was finding an old windows NT system at her college library that everyone used to do their government related .exe stuff. We had to download 2 or 3 apps to do it, I'm not even sure what they all did, just a bunch of programs you had to run in a specific order, some of them provided iFrame type windows to logins, it was really strange.
Re:Update on campaign targeting security researchers by bawolff on Wednesday March 31, 2021 @10:59PM (#26656156)
I wonder why they needed an active x control for that. TLS/SSL client certificates have been supported by all browsers since basically forever, going back even further than active x.
Re:Update on campaign targeting security researchers by thephyber on Wednesday March 31, 2021 @11:19PM (#26656293)
If I had to guess, HTTPS / SSL was governed by US export restrictions above a certain strength so S Korea managed to use the existing extensibility built into the browser the government wanted to support.
Re:Update on campaign targeting security researchers by freeone3000 on Wednesday March 31, 2021 @10:53PM (#26656120)
It's ActiveX-based, which essentially runs nowhere but IE. Edge's support for ActiveX is running it in an IE tab.
Re:Update on campaign targeting security researchers by thephyber on Wednesday March 31, 2021 @11:23PM (#26656314)
Yes, I roughly understand the limitations of the existing implementation. but it is not the only browser or platform and it’s not like the S Korean government is not capable of noticing the market share / cybersecurity trends of the past decade+.
Re:Update on campaign targeting security researchers by coldcode on Thursday April 01, 2021 @10:08AM (#26660675)
I was under the impression that SK was a technologically advanced country. I guess not the government then.
Re:Update on campaign targeting security researchers by ronsor on Wednesday March 31, 2021 @10:42PM (#26656067)
If Microsoft suddenly disabled all IE installations in South Korea, they'd have no choice but to change. Sometimes I wonder if the Apple-style "this just won't work at all anymore" attitude isn't that bad.
Re:Update on campaign targeting security researchers by eptcyka on Wednesday March 31, 2021 @10:55PM (#26656131)
It has its places, given the correct trade-off, it works well. Not allowing flash was good because iOS was a growing market with no preexisting businesses relying on flash on iOS to work.
Re:Update on campaign targeting security researchers by fshbbdssbbgdd on Wednesday March 31, 2021 @11:48PM (#26656485)
Sounds like a great way for Microsoft to lose a lot of market share fast.
Re:Update on campaign targeting security researchers by mimsee on Thursday April 01, 2021 @02:18AM (#26657167)
There's no ActiveX on macOS or Linux either.
Re:Update on campaign targeting security researchers by williamchangnpu on Thursday April 01, 2021 @12:29AM (#26656696)
Not in SK, but in China Here basically all banks require ActiveX, and if you don't have an Windows computer(Mac), what you can do is to use their app, which of course is super sluggish.
Re:Update on campaign targeting security researchers by meibo on Wednesday March 31, 2021 @10:40PM (#26656058)
This is probably it, thank you for clarifying - I've got a few friends in SK and they always complain about this, should have thought of that!
Re:Update on campaign targeting security researchers by tape_measure on Wednesday March 31, 2021 @10:45PM (#26656083)
Do you know the latest on IE use? The article I posted is from 2017 and promises modernization.

I submitted the article here, hopefully we get an on-the-ground update. https://news.ycombinator.com/item?id=26656052

Re:Update on campaign targeting security researchers by easton on Wednesday March 31, 2021 @10:57PM (#26656144)