• Proceedings of the Korea Information Processing Society Conference
• /
• 2008.11a
• /
• pp.1510-1512
• /
• 2008

사이버 공간에서 미래 최대 위협 중 하나로 인식되고 있는 봇넷의 공격이 점차 증가함에 따라, 봇넷 공격에 기반한 피해가 증가하고 있으며, 금전적인 피해 유발로 그 심각성이 점차 증대되고 있는 실정이다. 특히, 봇넷은 좀비 PC를 활용하는 측면에서 제 2차, 3차 피해가 우려되고 있다. 따라서 봇넷의 탐지를 1차적으로 끝나는 것이 아니라 지속적인 관찰과 관리를 통해 변종 봇넷을 탐지 하고 이에 기반한 악성행위를 탐지하는 것이 무엇보다도 중요하다. 따라서 본 논문에서는 이러한 봇넷을 능동적으로 탐지하기 위한 능동형 봇넷 탐지 및 관리를 위한 단계적 마이닝 프로세스를 제안하고 기존 탐지 알고리즘과의 비교 평가를 하여 향후 적용을 위한 고려사항들을 논의 하고자 한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2019.05a
• /
• pp.170-173
• /
• 2019

Windows는 UAC(User Account Control)를 통해 사용자의 동의를 얻은 프로세스에게만 관리자 권한을 부여한다. 관리자 권한을 부여받은 프로세스는 시스템 파일 변경, 환경 변수 변경 등 표준 권한을 가진 프로세스가 수행하지 못하는 작업을 수행할 수 있다. 일부 악성코드들은 사용자 동의 없이 관리자 권한을 획득하기 위해 UAC Bypass 기법을 이용한다. 그러나 UACMe에 공개된 56개의 UAC Bypass 기법 중 20개의 기법에 대한 보안 패치가 현재까지 이루어지지 않고 있다. 따라서 본 논문에서는 현재 Windows 시스템의 UAC Bypass에 대한 안전성 수준을 분석하기 위해 시스템 디렉터리 내부 82개의 프로그램을 대상으로 UAC Bypass가 가능한 DLL Hijacking 취약점을 분석한다. 또한 UAC Bypass에 악용 가능한 50개의 신규 취약점을 발견하고 악용 시나리오에 따른 공격가능성을 보인다.

• Journal of Advanced Navigation Technology
• /
• v.15 no.6
• /
• pp.1220-1227
• /
• 2011

According to the development of IT technology, life itself is becoming the change to Knowledge-based systems or information-based systems. However, the development of IT technology, the cyber attack techniques are improving. And DDoS a crisis occurs frequently, such as cyber terrorism has become a major data leakage. In addition, the various paths of attack from malicious code entering information in the system to work for your company for loss and damage to information assets is increasing. In this environment, the need to preserve the organization and users of information assets to perform ongoing inspections risk management processes within the organization should be established. Processes and managerial, technical, and physical systems by establishing an information security management system should be based. Also, we should be introduced information security product for protecting internal assets from the threat of malicious code incoming to inside except system and process establishment. Therefore we proposed enterprise and government information security enhancement scheme through the introduction of information security management system and information security product in this paper.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.2
• /
• pp.251-258
• /
• 2017

Most malware, including Ransomware, is built for the Windows operating system. This is because it is more harmful to target an operating system with a high share. But in recent years, MacOS's operating system share has steadily increased. As people become more and more used, the number of malicious code running on the MacOS operating system is increasing. Ransomware has been known to Korea since 2015, and damage cases are gradually increasing. MacOS is no longer free from Ransomware, as Ransomware for MacOS was discovered in March 2016. In order to cope with future Ransomware, this paper used Ransomware's modified file extension to detect Ransomware. We have studied how to detect and block Ransomware processes by distinguishing between extensions changed by the user and extensions changed by the Ransomware process.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.6
• /
• pp.1339-1350
• /
• 2019

Ransomware is a malicious software which requires money to decrypt files that were encrypted. As the number of ransomware grows, the encryption process in ransomware has been more sophisticated and the strength of security has been more stronger. As a result, analysis of ransomware becomes more difficult and the number of decryptable ransomware is getting smaller. So, research on encryption process and decryption method of ransomware is necessary. In this paper, we show encryption processes of 5 ransomwares which were revealed in 2019, and analyze whether or not those ransomwares are decryptable.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.3
• /
• pp.591-603
• /
• 2018

Windows Event Log is a format that records system log in Windows operating system and methodically manages information about system operation. An event can be caused by system itself or by user's specific actions, and some event logs can be used for corporate security audits, malware detection and so on. In this paper, we choose actions related to corporate security audit and malware detection (External storage connection, Application install, Shared folder usage, Printer usage, Remote connection/disconnection, File/Registry manipulation, Process creation, DNS query, Windows service, PC startup/shutdown, Log on/off, Power saving mode, Network connection/disconnection, Event log deletion and System time change), which can be detected through event log analysis and classify event IDs that occur in each situation. Also, the existing event log tools only include functions related to the EVTX file parse and it is difficult to track user's behavior when used in a forensic investigation. So we implemented new analysis tool in this study which parses EVTX files and user behaviors.

• Journal of Platform Technology
• /
• v.9 no.3
• /
• pp.3-17
• /
• 2021

Advanced persistent threat (APT) attacks are attacks aimed at a particular entity as a set of latent and persistent computer hacking processes. These APT attacks are usually carried out through various methods, including spam mail and disguised banner advertising. The same name is also used for files, since most of them are distributed via spam mail disguised as invoices, shipment documents, and purchase orders. In addition, such Infostealer attacks were the most frequently discovered malicious code in the first week of February 2021. CDR is a 'Content Disarm & Reconstruction' technology that can prevent the risk of malware infection by removing potential security threats from files and recombining them into safe files. Gartner, a global IT advisory organization, recommends CDR as a solution to attacks in the form of attachments. There is a program using CDR techniques released as open source is called 'Dangerzone'. The program supports the extension of most document files, but does not support the extension of HWP files that are widely used in Korea. In addition, Gmail blocks malicious URLs first, but it does not block malicious URLs in mail systems such as Naver and Daum, so malicious URLs can be easily distributed. Based on this problem, we developed a 'Dangerzone' program that supports the HWP extension to prevent APT attacks, and a Chrome extension that performs URL checking in Naver and Daum mail and blocking banner ads.

• Journal of KIISE
• /
• v.44 no.4
• /
• pp.352-362
• /
• 2017

This paper analyzes security threats in Security Enhanced (SE) Android and proposes a new technique to efficiently protect application data including private information on rooted Android phones. On an unrooted device, application data can be accessed by the application itself according to the access control models. However, on a rooted device, a root-privileged shell can disable part or all of the access control model enforcement procedures. Therefore, a root-privileged shell can directly access sensitive data of other applications, and a malicious application can leak the data of other applications outside the device. To address this problem, the proposed technique allows only some specific processes to access to the data of other applications including private information by modifying the existing SEAndroid Linux Security Module (LSM) Hook function. Also, a new domain type of process is added to the target system to enforce stronger security rules. In addition, the proposed technique separates the directory type of a newly installed application and the directory type of previously installed applications. Experimental results show that the proposed technique can effectively protect the data of each application and incur performance overhead up to or less than 2 seconds.

• Review of KIISC
• /
• v.26 no.3
• /
• pp.50-57
• /
• 2016

최근 사물인터넷(IoT) 시장의 급격한 성장과 함께 적용 서비스 분야도 급격하게 늘어나고 있다. 다양한 객체와 인터넷의 연결로 무수히 많은 서비스가 제공되고 있으며 기업 및 공공기관은 이를 활용하여 다양한 콘텐츠를 개발하고 있다. 하지만 IoT인프라의 급격한 범위 확장 및 활용 표준화가 이루어지지 않았고, 이에 따라 인프라 프로세스의 혼란을 야기할 수 있다. 이는 내 외부적인 위협의 증가로 이어진다. 따라서 사물인터넷 기술이 현재 시장보다 활성화 되고 실 서비스 적용 분야가 증가할수록 제도적, 물리적, 기술적인 취약점이 원인이 되어 공격자는 사물인터넷 단말기 내부에 악성코드를 심어 원격 통제를 하거나, 일정 무선 주파수를 동기화 하여 스니핑이나 스푸핑 등의 공격으로 데이터 변조의 위협이 존재한다. 본 연구를 통해 콘텐츠 정보제공의 주 목적으로 활용되는 미들웨어장비인 Bluetooth 4.0 기반의 저전력 비콘(Beacon)의 기능을 활용한 서비스에서 발생될 수 있는 내재적 위협으로부터 정책적, 기술적, 물리적 통제 및 대응 방안을 제안하였다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2010.11a
• /
• pp.1180-1182
• /
• 2010

오늘날 소프트웨어를 대상으로 하는 악성코드로부터의 공격이 잦아지면서, 소프트웨어 개발 프로세스에서부터의 보안 취약성 점검이 중요시되고 있다. 본 논문에서는 소프트웨어 보안 취약점 분석 기법 중 하나인 정적 분석에 사용되는 도구들을 살펴보고 비교하여 그 구조 및 특성을 분석 파악한다. 그리하여 우리의 궁극적 목표인 향상된 성능의 새로운 정적 분석 툴 개발의 기반을 마련하고자 한다.