ID·Password Authentication Vulnerable to Brute-Force Hacking

As the Korea Financial Security Institute analyzed the possibility of hacking that bypasses the authentication procedures of nonfacetoface financial services, it found that the basic authentication method that relies on IDs and passwords is vulnerable to credential stuffing attacks. In March last year, the institute released a related report and warned of a tactic in which hackers randomly enter account information obtained from other sites into multiple login screens to steal additional information. In this process, simple services and systems that do not require joint certificates were identified as relatively weak links. Recently, as in the case of Shinhan Bank, there have been cases where customer information from some financial institutions was leaked and then additional information such as resident registration numbers and linked information was also stolen, and the financial authorities have instructed a full inspection of IT assets exposed externally and authentication and access control systems.