• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2013.05a
• /
• pp.284-287
• /
• 2013

Recently target oriented attacks which target an enterprise and a government agency are increasing. The starting point of APT(Advanced Persistent Threat), called as target oriented attacks, is the spear phishing email that is personalized based on the information collected via Internet of the target personnel. It is known that 94% of target oriented attacks use spear phishing emails. Therefore, in this paper, we analysed spear phishing methods in detail and the characteristics and recent trends of spear phishing threats and proposed the effective prevention method of spear phishing for the end user.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.17 no.12
• /
• pp.2753-2762
• /
• 2013

Recently the paradigm of cyber attacks is changing due to the information security technology improvement. The cyber attack that uses the social engineering and targets the end users has been increasing as the organization's systems and networks security controls have been tightened. The 91% of APT(Advanced Persistent Threat) which targets an enterprise or a government agency to get the important data and disable the critical service starts with the spear phishing email. In this paper, we analysed the security threats and characteristics of the spear phishing in detail and explained why the technical solutions are not enough to prevent spear phishing attacks. Therefore, we proposed the administrative prevention methods for the spear phishing attack.

• Convergence Security Journal
• /
• v.20 no.3
• /
• pp.61-69
• /
• 2020

Since spear-phishing mail attacks focus on a particular target persistently to collect and take advantage of information, it can incur severe damage to the target as a part of the intelligent and new attacks such as APT attacks and social engineering attacks. The usual spam filtering services can have limits in countering spear-phishing mail attacks because of different targets, goals, and methods. In this paper, we analyze mail security services of several enterprises hosted by midium and small-sized enterprises with relatively security vulnerabilities in order to see whether their services can effectively respond spear-phishing mail attacks. According to the analysis result, we can say that most of mail security hosting services lack in responding spear-phishing mail attacks by providing functions for mainly managing mails including spam mail. The analysis result can be used as basic data to extract the effective and systematic countermeasure.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.1
• /
• pp.215-223
• /
• 2019

The recent trend of cyber attack threat is mainly APT (Advanced Persistent Threat) attack. This attack is a combination of hacking techniques to try to steal important information assets of a corporation or individual, and social engineering hacking techniques aimed at human psychological factors. Spear phishing attacks, one of the most commonly used APT hacking techniques, are known to be easy to use and powerful hacking techniques, with more than 90% of the attacks being a key component of APT hacking attacks. The existing research for cyber security threat defense is mainly focused on the technical and policy aspects. However, in order to preemptively respond to intelligent hacking attacks, it is necessary to study different aspects from the viewpoint of social engineering. In this study, we analyze the correlation between human personality type (DISC) and cyber security threats, focusing on spear phishing attacks, and present countermeasures against security threats from a new perspective breaking existing frameworks.

• Convergence Security Journal
• /
• v.23 no.5
• /
• pp.165-172
• /
• 2023

Nation-state social engineering attacks are steadily being carried out as they are highly effective attacks, primarily to gain an advantage over secret information, diplomatic negotiations or future policy changes. As The Ukraine-Russia war prolongs, the activities of global hacking organizations are steadily increasing, and large-scale cyberattack attempts against major infrastructure or global companies continue, so a countermeasure strategy is needed. To this end, we determined that the social engineering attack cycle excluding physical contact among various social engineering models is the most suitable model, and analyzed the preferred social engineering attack method by comparing it with geopolitical tactics through case analysis. AS a result China favors phishing attacks, which prefer quantity over quality, such as man-made tactics, Russia prefers covert and complex spear phishing reminiscent of espionage warfare, and North Korea uses geopolitical tactics such as spear phishing and watering holes for attacks on the US and South Korea Most of the other countries aimed to secure funds with ransomware. Accordingly, a Clean Pass policy for China, periodic compulsory education in Russia, and international sanctions against North Korea were presented as countermeasure strategies.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2015.05a
• /
• pp.712-714
• /
• 2015

기존의 정보보호시스템들은 이미 확보된 시그니처 또는 이전에 분석된 정보를 기반으로 악성코드에 대응하고 있기 때문에, 시그니처가 알려지지 않은 악성코드 또는 변형된 악성코드의 경우, 탐지 및 식별에 한계를 지니고 있다. 본 연구는 이와 같은 문제를 해결하기 위해, 무결성을 검증하는 화이트리스트 기반의 응용프로그램 실행제어, 매체제어, 레지스트리 보호, 중요 파일 변경 방지, 프로세스 접근 역접속 IP/포트 통제 등의 기술을 복합적으로 적용하여, 악성코드의 침입뿐만 아니라 운영체제 및 응용프로그램 취약점을 기반으로 한 익스플로잇 공격으로부터 단말 PC를 더욱 확실하게 보호할 수 있도록 한 엔드포인트 응용프로그램 실행 통제 방안을 제시하였다. 본 연구의 결과는 프로토타입 형태로 개발하여 실 환경에서 통합테스트를 하여 공공기관, 금융기관, 통신사 등 실제 환경에 적합한 기술 및 기능임을 확인하였다. 본 연구를 통해, 실행 전 응용프로그램 무결성 검증과 실행 후 응용프로그램 실행 흐름 통제를 복합적으로 사용하여 알려진 악성코드 시그니처 정보에 의존한 기존 정보 보호 시스템과는 달리 알려지지 않은 악성코드까지 원천적으로 차단할 수 있을 것으로 기대된다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2020.05a
• /
• pp.177-179
• /
• 2020

최근의 사이버 침해 사고는 공격 대상을 지정하여 지속적으로 공격을 시도하는 APT(Advanced Persistent Threat)와 랜섬웨어(Ransomware) 공격이 주를 이룬다. APT 공격은 dirve by download 를 통하여 의도하지 않은 파일의 다운로드를 유도하고, 다운로드 된 파일은 역통신채널을 만들어 내부 데이터를 외부로 유출하는 방식으로 공격에 사용되는 악성 파일이 사용자 모르게 다운로드 되어 실행된다. 랜섬웨어는 스피어 피싱 (Spear-phishing) 과 같은 사회공학기법을 이용하여 신뢰 된 출처로 유장 된 파일을 실행하도록 하여 주요 파일들을 암호화 한다. 때문에 사용자와 공격자 사이 네트워크 중간에 위치한 패킷 기반의 보안 장비들은 사용자에 의해 다운로드 되는 파일들을 선제적으로 식별하고, 차단하여 침해 확산을 방지 할 수 있는 방안이 필요하다. 본 논문에서는 네트워크 패킷 레벨에서 알려진 악성파일을 식별하고 실시간 차단하는 방안에 대하여 연구하고자 한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.4
• /
• pp.847-857
• /
• 2019

Recently, various cyber threats such as Ransomware and APT attack are increasing by e-mail. The characteristic of such an attack is that it is important to take administrative measures by improving personal perception of security because it bypasses technological measures such as past pattern-based detection The purpose of this study is to investigate the human factors of employees who are vulnerable to spam mail attacks through field experiments and to establish future improvement plans. As a result of sending 7times spam mails to employees of a company and analyzing training report, It was confirmed that factors such as the number of training and the recipient 's gender, age, and workplace were related to the reading rate. Based on the results of this analysis, we suggest ways to improve the training and to improve the ability of each organization to carry out effective simulation training and improve the ability to respond to spam mail by awareness improvement.

• Journal of the Korea Convergence Society
• /
• v.12 no.5
• /
• pp.9-16
• /
• 2021

Due to the prolonged infectious disease of COVID-19 worldwide, there are various security threats due to network attacks on Internet of Things devices that are vulnerable to telecommuting. Initially, users of Internet of Things devices were exploited for vulnerabilities in Remote Desktop Protocol, spear phishing and APT attacks. Since then, the technology of network attacks has gradually evolved, exploiting the simple service discovery protocol of Internet of Things devices, and DRDoS attacks have continued to increase. Existing SSDPs are accessible to unauthorized devices on the network, resulting in problems with information disclosure and amplification attacks on SSDP servers. To compensate for the problem with the authentication procedure of existing SSDPs, we propose a hash-based SSDP that encrypts server-specific information with hash and adds authentication fields to both Notify and M-Search message packets to determine whether an authorized IoT device is present.

• Convergence Security Journal
• /
• v.23 no.2
• /
• pp.27-36
• /
• 2023

In recent years, ransomware attacks have become more organized and specialized, with the sophistication of attacks targeting specific individuals or organizations using tactics such as social engineering, spear phishing, and even machine learning, some operating as business models. In order to effectively respond to this, various researches and solutions are being developed and operated to detect and prevent attacks before they cause serious damage. In particular, honeypots can be used to minimize the risk of attack on IT systems and networks, as well as act as an early warning and advanced security monitoring tool, but in cases where ransomware does not have priority access to the decoy file, or bypasses it completely. has a disadvantage that effective ransomware response is limited. In this paper, this honeypot is optimized for the user environment to create a reliable real-time dynamic honeypot file, minimizing the possibility of an attacker bypassing the honeypot, and increasing the detection rate by preventing the attacker from recognizing that it is a honeypot file. To this end, four models, including a basic data collection model for dynamic honeypot generation, were designed (basic data collection model / user-defined model / sample statistical model / experience accumulation model), and their validity was verified.