ALPass (알패스)

» see altools.co.kr as it lived, on the wayback machine

~ the last words ~

ALPass belonged to a family. ESTsoft built a row of free Korean Windows utilities all prefixed with the syllable al, and for years they were close to unavoidable on a Korean PC: ALZip for archives, ALSong for music, ALYac for antivirus, ALSee for images. ALPass was the one that remembered your passwords. It launched as a v1.0 beta in August 2001, announced on ESTsoft's own front page some time between the ninth and the fifteenth of that month.

The company described it as a login helper. It watched the address in your browser, and when you reached a site it had on file, a fill button appeared and put your ID and password into the form. The data file could be backed up and merged into another copy. It was four megabytes, it ran on Windows 2000 through Vista inside Internet Explorer, and it cost nothing.

Why that mattered in Korea specifically is a matter of how the Korean web was built. Registration was mandatory almost everywhere and real-name verification was common, so a single person could accumulate an enormous number of accounts simply by using the internet normally. The breach figures at the end give the clearest picture anybody ever published of what that felt like: the 166,179 affected users were holding an average of about 153 saved logins each.

~ the record ~

~ what the banks blocked ~

The product's own support pages carried a list of places it did not work, and that list is a better description of Korean internet security than anything written about it since. Korea Exchange Bank, Woori Bank, Korea Exchange Card and Korea Life all blocked it, because they installed keyboard-security plugins that sat underneath the browser and would not accept input from software. MapleStory's MyKeyDefense did the same thing.

Naver and Hangame were partial: ALPass worked at the first tier of their secure-login system and failed at the second and third, because those tiers were drawn in Flash and there was no form for it to fill. ESTsoft's published advice for all of these was to save the ID and type the password by hand. A password manager in a country that had armored its login boxes against automation had to negotiate with each site separately, and it lost to the ones holding money.

~ the fill button goes away ~

On 4 April 2012 ESTsoft stopped distributing ALPass as a standalone program. This is the date most references give as its death, including the Korean Wikipedia article, and it is the wrong kind of event. The notice says exactly what it is doing: only the standalone product download is ending, the ALPass inside ALToolbar remains usable, and here is how to move your data into the toolbar version.

So the function survived and only the delivery changed. It lived on inside ALToolbar, a browser add-on, and later inside Swing, ESTsoft's own Korean browser. That move is what mattered later, because the saved entries moved off your own hard disk and into an account on a company's server.

~ twenty five million passwords ~

Starting around 9 February 2017 and running to 25 September, an attacker worked out that signing in to a user's ALToolbar account exposed the ALPass entries saved under it, each one a website address with its ID and password. Using credentials gathered elsewhere and a purpose-written tool named after the product, the attacker worked through accounts until the haul reached 25,461,263 records covering 166,179 users.

The damage kept going outward. The recovered logins opened victims' portal accounts, which held photographs of identity cards and credit cards, and those images were used in turn to open mobile phone lines and rent five servers, with cryptocurrency withdrawn from exchanges. Korean regulators opened their on-site investigation on 2 September 2017, three weeks before the attack stopped. An arrest followed around December.

~ two days before the fine ~

ESTsoft gave notice on 19 January 2018 that ALPass would end during the first quarter, in ALToolbar and in Swing. The notice opened by saying the service had set out as a standalone program in 2001, gave instructions for exporting your saved entries to a CSV file while you still could, and closed with a line thanking everyone who had cared about ALPass. The execution shows up as one line in a changelog: ALToolbar version 4.02, released 26 March 2018, modifications, ALPass service terminated.

Two days after that, on 28 March, the Korea Communications Commission announced its penalty: a fine of 112,000,000 won plus a smaller administrative charge and a published corrective order. Asked about the sequence, ESTsoft said the ALPass service had simply been ended as originally planned, and denied any link to the data leak. No source contradicts that, and planned retirements of unprofitable free software are ordinary. The dates are also two days apart, and both of those things can be true at once.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »