Journal of the Korea Institute of Information and Communication Engineering (한국정보통신학회논문지)

The Korea Institute of Information and Commucation Engineering (한국정보통신학회)
권호 표지
DOI QR코드

DOI QR Code

Web Server Hacking and Security Risk using DNS Spoofing and Pharming combined Attack

DNS 스푸핑을 이용한 포털 해킹과 파밍의 위험성

  • Choi, Jae-Won (Department of Computer Engineering, Kyungsung University)
  • Received : 2019.07.12
  • Accepted : 2019.09.20
  • Published : 2019.11.30
Download PDF
⟨ Previous Next ⟩

Abstract

DNS spoofing is an attack in which an attacker intervenes in the communication between client and DNS server to deceive DNS server by responding to a fake IP address rather than actual IP address. It is possible to implement a pharming site that hacks user ID and password by duplicating web server's index page and simple web programming. In this paper we have studied web spoofing attack that combines DNS spoofing and pharming site implementation which leads to farming site. We have studied DNS spoofing attack method, procedure and farming site implementation method for portal server of this university. In the case of Kyungsung Portal, bypassing attack and hacking were possible even though the web server was SSL encrypted and secure authentication. Many web servers do not have security measures, and even web servers secured by SSL can be disabled. So it is necessary that these serious risks are to be informed and countermeasures are to be researched.

DNS 스푸핑은 공격자가 클라이언트와 DNS 서버 간 통신에 개입하여 실제 IP 주소가 아닌 가짜 IP 주소를 응답하여 DNS 서버를 속이는 공격이다. 웹 서버 초기화면 복제와 간단한 웹 프로그래밍으로 사용자 아이디와 비밀번호를 해킹하는 파밍 사이트 구현이 가능하다. 본 논문에서는 파밍사이트로 유도하는 DNS 스푸핑과 파밍사이트 구현을 결합한 웹 스푸핑 공격에 관해 연구하였다. 본 대학의 포털 서버를 대상으로 DNS 스푸핑 공격 방법과 절차 및 파밍사이트 구현 방법에 관해 연구하였다. 경성포털의 경우 SSL에 의한 암호화와 보안인증이 이루어진 웹 서버임에도 우회 공격과 해킹이 가능하였다. 현재 많은 웹 서버가 보안조치가 이루어져 있지 않고, SSL에 의해 보안이 이루어진 웹 서버라 할지라도 이를 무력화 시킬 수 있으므로 이의 심각한 위험과 대응조치가 꼭 필요함을 알리고자 한다.

Keywords

Acknowledgement

This research was supported by Kyungsung University Research Grants in 2018.

References

  1. D. I. Yang, Network Hacking and Security, Seoul, Korea: Hanbit Media Inc., ch. 3, pp. 128-129, 2016.
  2. J. W. Choi, "Research on Network Hacking and Implementation Techniques using ARP Redirect Method according to Server Types," Jounal of Kysungsung Univ. RIET, vol. 23, pp. 1-11, Feb. 2017.
  3. S. H. Moon, Learning hacking and security with Kali Linux, Seoul, Korea: BPAN Books Pub., ch. 1, pp.10-11, 2016.
  4. Naver Blog. Introduction to the sniffing tools Dsniff [Internet]. Available: http://kkn1220.tistory.com/72.
  5. J. W. Choi, "Network Hacking and Implementation Techniques using Faked ARP Reply Unicast Spoofing according to various Server Types," Journal of Korea Institute of Information and Communication Engineering, vol. 21, no. 1, pp. 61-71, Jan. 2017. https://doi.org/10.6109/jkiice.2017.21.1.61
  6. Deepak Devanand, ARP Cache in Windows [Internet]. Available:https://windowswizardry.wordpress.com/2017/05/22/arp-cache-in-windows, May 22, 2017.
  7. KISA, DNSSEC (Domain Name System Security Extension) Concept [Internet]. Available:https://kisa.kr/jsp/resources/dns/dnssecInfo/dnssecInfo.jsp, 2019.
  8. V. Bhavana, "Data Security in Cloud environments," Asia-pacific Journal of Convergent Research Interchange, HSST, ISSN : 2508-9080, vol.1, no.4, (2015,December). pp. 25-31, [Internet]. Available: http://dx.doi.org/10.21742/APJCRI.2015.12.04.
  9. RSEC.KR, HSTS (HTTP Strict Transport Security) Concept and Setup[Internet]. Available: https://rsec.kr/?p=315, Jul. 28, 2017.