• Proceedings of the Korean Society of Computer Information Conference
• /
• 2017.07a
• /
• pp.29-32
• /
• 2017

보안 취약점을 악용하여 소프트웨어를 무력화하는 사이버 공격이 증가함에 따라, 조기에 소프트웨어의 취약점을 발견하고 분석하는 보안 테스팅에 대한 중요성이 높아지고 있다. 보안 테스팅의 자동화된 방법 중 하나인 퍼징 기법은 소프트웨어의 입력에 타당하지 않은 무작위 값을 삽입하여 해당 소프트웨어의 예외 즉, 잠재적인 취약점을 발견할 수 있다. 본 논문은 파일 퍼징 과정에서 효율적인 파일 변이 방법을 제안하고 이를 활용한 퍼징 기법을 통해 소프트웨어의 보안성을 높이고자 한다.

• Journal of the Korea Society of Computer and Information
• /
• v.24 no.2
• /
• pp.35-40
• /
• 2019

In this paper, we propose a technique to reconstruct the iris image from the iris code by analyzing the process of generating the iris code and calculating it inversely. Iris recognition is an authentication method for authenticating an individual's identity by using iris information of an eye having unique information of an individual. The iris recognition extracts the features of the iris from the iris image, creates the iris code, and determines whether to authenticate using the corresponding code. The iris recognition method using the iris code is a method proposed by Daugman for the first time and is widely used as a representative method of iris recognition technology currently used commercially. In this paper, we restore the iris image with only the iris code, and test whether the reconstructed image and the original image can be recognized, and analyze restoration vulnerability of Daugman's iris code.

• Journal of Korea Multimedia Society
• /
• v.24 no.3
• /
• pp.440-447
• /
• 2021

Smartphones are currently being produced with similar functions, shapes, and software. The foldable smartphone is a product that dramatically changed the shape of the existing smartphone. Therefore, it affects the functions and software. In this paper, we analyze the potential security vulnerability of current mobile authentication methods by dividing them into two parts, security vulnerabilities of non-foldable smartphones, and security vulnerability that appears with the changed smartphone structure. According to the analysis result, the classic and current mobile user authentication methods appears to be easily affected by the smartphone display structure. Finally, we propose an appropriate authentication method as well as the concept of security measures for smartphones with foldable screen. Our method shows that it is more secure than the conventional authentication methods in foldable display smartphone.

• Journal of Software Assessment and Valuation
• /
• v.8 no.2
• /
• pp.45-51
• /
• 2012

This paper is to identify and assess vulnerabilities of services considering the nature of service layers for analyzing vulnerability of SOA security. It is a model driven approach which provides the way to present security requirements of the business model and identify the vulnerabilities of the services to extract the secure service model. We validate the proposed method with the analytic evaluation because the predictive nature of our methodology poses some specific challenges for its validation.

• Communications of the Korean Institute of Information Scientists and Engineers
• /
• v.30 no.2
• /
• pp.9-21
• /
• 2012

• Journal of the Korea Convergence Society
• /
• v.12 no.1
• /
• pp.11-17
• /
• 2021

If a vulnerability in the software connected to the network to obtain the user's privilege, a remote attacker could gain the privilege to use the computer. In addition, in a user environment in which an operating system for a specific series is used a lot, if a problem occurs in the operating system, considerable damage can occur. In particular, If an error is a security vulnerability, it can be a very big problem. Various studies have been conducted to find and respond to vulnerabilities in such a situation. Among various security technologies, the fuzzing technology is one of the most effective technologies to find errors in software. In this paper, I designed and implemented a fuzzing agent that can detect buffer overflow vulnerabilities that can occur in various applications. Through this fuzzing agent, application developers will be able to realize a more secure computing environment in which they can discover and fix vulnerabilities in their own applications.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.6
• /
• pp.1345-1354
• /
• 2012

The modern society with the wide spread USB memory, witnesses the acceleration in the development of USB products that applied secure technology. Secure USB is protecting the data using the method as device-based access control, encryption of stored files, and etc. In terms of forensic analyst, to access the data is a lot of troubles. In this paper, we studied software-based data en/decryption technology and proposed for analysis mechanism to validation vulnerability that secured on removable storage media. We performed a vulnerability analysis for USB storage device that applied security mechanism. As a result, we found vulnerabilities that extracts a source file without a password.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.4
• /
• pp.709-722
• /
• 2022

The recent "Log4j Security Vulnerability Incident" has occurred, and the information system that uses the open source "Log4J" has been exposed to vulnerabilities. The incident brought great vulnerabilities in the information systems of South Korea's major government agencies or companies and global information systems, causing problems with open source vulnerabilities. Despite the advantages of many advantages, the current development paradigm, which is developed using open source, can easily spread software security vulnerabilities, ensuring open source safety and reliability. You need to check the open source. However, open source vulnerability scan tools have various languages and functions. Therefore, the existing software evaluation criteria are ambiguous and it is difficult to evaluate advantages and weaknesses, so this paper has developed a new evaluation criteria for the vulnerability analysis tools of open source

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.2
• /
• pp.305-318
• /
• 2023

The complexity of software products led many manufacturers to stitch open-source software for composing a product. Using open-source help reduce the development cost, but the difference in the different development life cycles makes it difficult to keep the product up-to-date. For this reason, even the patches for known vulnerabilities are not adopted quickly enough, leaving the entire product under threat. Existing studies propose to use binary differentiation techniques to determine if a product is left vulnerable against a particular vulnerability. Despite their effectiveness in finding real-world vulnerabilities, they often fail to locate the evidence of a vulnerability if it is a small function that usually is inlined at compile time. This work presents our tool FunRank which is designed to identify the short functions. Our experiments using synthesized and real-world software products show that FunRank can identify the short, inlined functions that suggest that the program is left vulnerable to a particular vulnerability.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2016.10a
• /
• pp.741-742
• /
• 2016

Secure Coding is in the development phase, removing a potential security vulnerability that could lead to attacks such as hacking in advance, says the technique to develop secure software from external attacks. In this paper, we'll learn about the needs and expectations of the effectiveness of these security software development. Due to this, the threat to the safe software development project, and there is an effect to improve quality.