Photo by SumUp on Unsplash
Log in to a Korean bank’s website on a Windows PC for the first time and you will probably not reach the login form. You get a page of Korean bank security programs you have to install first: a keyboard protection tool, a firewall, a certificate module, sometimes an installer whose only job is to manage the other installers. Foreigners find this baffling, and a lot of Koreans quietly hate it too.
These programs were supposed to disappear years ago. The certificate system they grew up around was abolished in 2020. They are still here, and in 2025 a team of Korean researchers showed that the software meant to protect bank customers had become one of the easier ways to attack them.
How Korea ended up here: a timeline
| When | What happened |
|---|---|
| Late 1990s | Korea builds its own encryption, the SEED cipher, and delivers it to browsers through Microsoft’s ActiveX plugins |
| 1999 | The accredited public certificate (gongin injeungseo) is introduced for government sites and online banking |
| Around 2015 | ActiveX is phased out. The same functions come back as standalone .exe installers that run outside the browser |
| December 10, 2020 | The accredited certificate loses its special legal status. Nearly 46 million people held one |
| 2023 | North Korean attackers exploit the security software itself to break into South Korean systems |
| August 2025 | KAIST, Korea University, Sungkyunkwan University and Theori publish 19 vulnerabilities across seven of these programs |
The table explains the odd shape of the problem. Each fix replaced a mechanism, not the habit behind it. When ActiveX went, the plugins became programs. When the certificate monopoly went, the programs stayed, because banks had built their login flows around them.
What the 2020 change actually did
On December 10, 2020, the government ended the mandatory use of the accredited certificate, a system that had been introduced in 1999 and held by nearly 46 million people in a country of 51.6 million. Private alternatives from Kakao, KB Kookmin Bank, NHN Payco, PASS and NICE were lined up to replace it.
The same Korea Herald report named the problem everyone wanted to be rid of: logging in involved “multiple rounds of support program downloads, such as ActiveX and anti-malware software.” Ending the certificate monopoly was meant to remove the reason for those downloads.
It removed a reason. It did not remove the software. A bank that had already wired keyboard encryption, device checks and certificate handling into its website had no deadline to take them out, and removing a security layer is a hard thing for a bank’s risk team to sign off on. The old certificate was also renamed rather than deleted. It lives on as the “joint certificate” (gongdong injeungseo), and many sites still accept it alongside newer options.
Photo by Jake Walker on Unsplash
What the researchers found
The 2025 study, presented at USENIX Security, looked at what the researchers call Korea Security Applications, or KSA: the programs banks and public services ask you to install. They were prompted by the 2023 North Korean attacks that used this software as a way in.
The numbers from KAIST’s summary and the paper’s abstract:
| Finding | Figure |
|---|---|
| Vulnerabilities found | 19, across 7 programs |
| What they allowed | Keylogging, man-in-the-middle attacks, private key theft, remote code execution, device fingerprinting |
| Banking users who had installed KSA | 97% of 400 surveyed |
| Users who did not understand what it does | 59% |
| Programs installed per PC | 9 on average, many of them years out of date |
The last row is the one I keep coming back to. Nine programs, installed once for a bank login and then forgotten, each running with more access to the machine than a web page would ever get. A keyboard protection tool that can itself be abused to log keystrokes is the clearest example of the irony the paper’s title points at: “Too Much of a Good Thing.”
Why banks still ask for them
If the legal requirement went away, why is the install page still there? From the outside, the likeliest answer is liability. A bank that removes a security program and then suffers a fraud case has to explain why it took protection away. A bank that keeps it can point to the program. That pressure pushes in one direction, even when the program adds risk of its own.
That is my interpretation, not something the banks have said. The study is careful on this point too. Its subject is the security of the software, not the motives of the institutions that require it.
There is a parallel with Korea’s identity verification system. In both cases Korea swapped one mechanism for another instead of rethinking the design, and the people who struggle most are the ones least familiar with the system.
Photo by Luke Southern on Unsplash
What to do if you bank in Korea
You usually cannot refuse the install and still use the website. But you can limit the exposure:
- Use the bank’s mobile app where you can. The installers in this story are Windows programs. Apps carry their own security checks, but not this pile of desktop software.
- Install only from the bank’s own site, reached by typing its address, never from a link in a text message or email.
- Uninstall what you no longer use. Open Windows Settings, then Apps, and sort by install date around the day you first logged in. If you have stopped using a bank’s website, its programs can go.
- Update the rest. The study found many copies years old. Most banks prompt an update at login, so do not click past it.
If you use Korean banking and government sites often, a separate cheap Windows laptop just for them is worth considering. It sounds excessive until you count nine programs with deep access to your main machine.
❓ FAQ: Frequently Asked Questions
Are Korean bank security programs malware?
No. They come from legitimate Korean security vendors and do what they claim. The problem found in 2025 is that several of them had serious vulnerabilities, and that they run with enough privilege to cause real damage if exploited.
Do I need these programs on a Mac?
Support varies by bank. Some offer Mac versions or browser-only logins, others do not. The mobile app is often the simplest route on any platform.
Is the old public certificate still valid?
It was renamed the joint certificate after December 2020 and many services still accept it. It simply no longer has a legal monopoly, so banks and agencies also accept private certificates and app-based sign-ins.
Did anything change after the 2025 study?
I have not found a public, industry-wide response as of September 2026. Individual vendors may have patched specific flaws, so keeping the programs updated matters.
Figures on the 2025 study come from KAIST’s announcement and the USENIX Security abstract; I did not reproduce any of the vulnerabilities. Certificate history is from The Korea Herald, December 9, 2020. The explanation of why banks keep these programs is my own reading, not a stated position of any bank or regulator.