• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.2
• /
• pp.263-277
• /
• 2021

Taint analysis techniques are popularly used to detect web vulnerabilities originating from unverified user input data, such as Cross-Site Scripting (XSS) and SQL Injection, in web applications written in JavaScript. To detect such vulnerabilities, it would be necessary to trace variables affected by user-submitted inputs. However, because of the dynamic nature of JavaScript, it has been a challenging issue to identify those variables without running the web application code. Therefore, most existing taint analysis tools have been developed based on dynamic taint analysis, which requires the overhead of running the target application. In this paper, we propose a novel static taint analysis technique using symbol information obtained from the TypeScript (a superset of JavaScript) compiler to accurately track data flow and detect security vulnerabilities in TypeScript code. Our proposed technique allows developers to annotate variables that can contain unverified user input data, and uses the annotation information to trace variables and data affected by user input data. Since our proposed technique can seamlessly be incorporated into the TypeScript compiler, developers can find vulnerabilities during the development process, unlike existing analysis tools performed as a separate tool. To show the feasibility of the proposed method, we implemented a prototype and evaluated its performance with 8 web applications with known security vulnerabilities. We found that our prototype implementation could detect all known security vulnerabilities correctly.

• Journal of Information Technology and Architecture
• /
• v.11 no.2
• /
• pp.175-185
• /
• 2014

This study is based on the information security management system, the threat from mobile office, mobile office configuration item type, vulnerability analysis and control at the level of the current possibilities for technology to its purpose. To perform exploratory study for mobile Office to target the new technology, we were used the integrated research methods such as the documentary survey, expert FGI and real user's survey. To identify the main risk areas of mobile office services, we develop the mobile service layer model that separated the place, terminal, network, server according to service deliverly system. Finally, the result of survey for threats and vulnerabilities showed that the control of the terminal of user is a significant.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2013.05a
• /
• pp.227-230
• /
• 2013

Financial transactions using a mobile terminal and the Internet is activated, it is a stock exchange enabled using mobile devices and the Internet. Koscom in charge of IT operations of securities transaction-related in (securities ISAC), to analyze the vulnerability of information security related to securities transactions, which corresponds to running the integrated security control system. Online stock trading is a subject to the Personal Information Protection Act, electronic systems of related, has been designated as the main information and communication infrastructure to, damage financial carelessness of the user, such as by hacking is expected to are. As a result, research on the key vulnerabilities of information security fields related to securities business cancer decoding of the Securities and Exchange packet, through the analysis of security events and integrated security control is needed.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2013.05a
• /
• pp.690-692
• /
• 2013

Cloud computing is an Internet-based technology, one of the Big Data era aspiring technology. Bring on the internet whenever you need to use multiple physical servers into one virtual server, cloud Cloud technology and large companies, such as leading U.S. IT company, Amazon, IBM, Google, Microsoft and the domestic firm Samsung, SK, KT, NHN the cloud market at home and abroad, and commercialization by investing in the future to continue to grow. The main reason for the introduction of the cloud and reduced operating costs, and to see the most problems is the leakage of personal information. In this paper, we propose a method to improve the security and vulnerability analysis of security technologies and cloud.

• Electronics and Telecommunications Trends
• /
• v.23 no.4
• /
• pp.89-101
• /
• 2008

홈네트워크는 기술의 통합적인 제공에 따라 높은 신뢰성이 필요하지만, 안전성이 확보되지 않는 홈네트워크는 사용자로부터 외면을 받을 수 밖에 없다. 또한 유무선 네트워크 및 프로토콜들 각각에 대한 보안이 고려되어 있다 하더라도 이들의 혼재로 인한 새로운 취약점이 생길 수 있고, 홈네트워크 서비스를 운용하는 과정에서 새로운 취약점이 드러나고 있다. 본 고에서는 안전한 홈네트워크 구축을 위해 최근 국내/외에서 다양한 표준이 제정, 논의되고 있으며, 홈네트워크 보안에 관한 국내/외 표준화 동향을 소개한다. 또한 홈네트워크 구축시 고려되어야 할 홈네트워크의 보안취약성 및 관련 보안기술 개발동향을 설명한다.

• The KIPS Transactions:PartC
• /
• v.10C no.1
• /
• pp.1-10
• /
• 2003

In this paper, we propose a secure communication framework for interaction and information sharing between a server and agents in DS-NVSA(Detection System of Network Vulnerability Scan Attacks) proposed in〔1〕. For the scalability and interoperability with other detection systems, we design the proposed IDMEF and IAP that have been drafted by IDWG. We adapt IDMEF and IAP to the proposed framework and provide SKTLS(Symmetric Key based Transport Layer Security Protocol) for the network environment that cannot afford to support public-key infrastructure. Our framework provides the reusability of heterogeneous intrusion detection systems and enables the scope of intrusion detection to be extended. Also it can be used as a framework for ESM(Enterprise Security Management) system.

• Information and Communications Magazine
• /
• v.22 no.8
• /
• pp.114-128
• /
• 2005

본 연구에서는 최근 무선 네트워크 환경이 급속도로 확산되면서 발생하는 무선 네트워크 현황 및 보안 취약점을 분석하고, 센서 AP(Access Point) 기반의 무선 트래픽 필터링 및 침입탐지/차단 기술 동향을 분석하였다. 유선 네트워크를 대상으로 한 IDS/IPS 시스템에 추가적으로 무선 트래픽에 대한 모니터링 체계를 제공하기 위하여 최근에는 통합형 유무선 네트워크 침입탐지/차단 시스템을 구성하고 있으며, 이를 위해서 필수적인 센서 AP 구성 방안 및 시스템 설계 방안 등에 대한 고찰을 통해 무선 네트워크 환경에서의 침해대응 기술을 고찰해 보고자 한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2005.11a
• /
• pp.40-42
• /
• 2005

최근 XML을 기반으로 한 웹서비스는 인터넷 전자상거래와 인터넷을 기반으로 한 서비스통합 등 다양한 분야에서 활용되고 있으며 웹서비스를 이용한 메시지 및 문서를 안전하게 송수신 하기위해 XKMS기반 하에 XML전자서명, XML암호화 등이 표준화 되어 있다. 그러나 웹서비스를 위한 XML기반 PKI서비스인 XKMS는 PKI와의 연동방안이 제시되어 있지 않으며 PKI와 XKMS간의 상호인증이 보장되어 있지 않고 서비스거부공격과 재연공격 등에 취약점이 있는 등 여러 가지 취약점이 분석되고 있다. 본 논문에서는 CA발행 공인인증서를 활용한 XKMS와 PKI서버간의 상호인증방안을 제시하고 메시지 송수신 시 nonce값을 이용하여 재연공격을 방지할 수 있는 메시지 형식을 정의함으로써 보다 안전하게 XKMS PKI가 연동을 하는데 도움이 되고자 한다.

• Convergence Security Journal
• /
• v.18 no.2
• /
• pp.133-139
• /
• 2018

The 5 Game changer means the concepts of the army's operation against the enemy's asymmetric threats so that minimize damage to the public and leads to victory in war in the shortest time. A study of network architecture of Dronebot operation is a key study to carry out integrated operation with integrated C4I system by organically linking several drones battle groups through ICT. The NBC reconnaissance drones can be used instead of vehicles and humans to detect NBC materials and share situations quickly. However, there is still a lack of research on the swarm flight of the NBC reconnaissance drones and the weaknesses of cyber electronic warfare. In this study, we present weaknesses and countermeasures of CBRNs in swarm flight operations and provide a basis for future research.

• Smart Media Journal
• /
• v.7 no.1
• /
• pp.37-44
• /
• 2018

Utilizing sequence control and numerical computing, embedded devices are used in a variety of automated systems, including those at industrial sites, in accordance with their control program. Since embedded devices are used as a control system in corporate industrial complexes, nuclear power plants and public transport infrastructure nowadays, deliberate attacks on them can cause significant economic and social damages. Most attacks aimed at embedded devices are data-coded, code-modulated, and control-programmed. The control programs for industry-automated embedded devices are designed to represent circuit structures, unlike common programming languages, and most industrial automation control programs are designed with a graphical language, LAD, which is difficult to process static analysis. Because of these characteristics, the vulnerability analysis and security related studies for industry automation control programs have only progressed up to the formal verification, real-time monitoring levels. Furthermore, the static analysis of industrial automation control programs, which can detect vulnerabilities in advance and prepare for attacks, stays poorly researched. Therefore, this study suggests a method to present a discussion on an industry automation control program designed to represent the circuit structure to increase the efficiency of static analysis of embedded industrial automation programs. It also proposes a medium term translation technology exploiting LLVM IR to comprehensively analyze the industrial automation control programs of various manufacturers. By using LLVM IR, it is possible to perform integrated analysis on dynamic analysis. In this study, a prototype program that converts to a logical expression type of medium language was developed with regards to the S company's control program in order to verify our method.