• Journal of KIISE:Computer Systems and Theory
• /
• v.29 no.4
• /
• pp.220-231
• /
• 2002

Trojan-horse programs are the programs that disguise normal and useful programs but do malicious thing to the hosts. This paper proposes an anti-Trojan horse mechanism using the information attached to the code by the developers. In this mechanism, each code is accompanied with the information on their possible accesses to resources, and based on this information users determine whether the code is malicious or not. Even in the case a code is accepted by users due to its non-malicious appearance, its runtime behaviors are monitored and halted whenever any attempts to malicious operations are detected. By hiring such runtime monitoring system, this mechanism enables detecting unknown Trojan horses and reduces the decision-making overhead being compared to the previous monitoring-based approaches. We describe the mechanism in a formal way to show the advantages and the limitations of the security this mechanism provides.

• Electronics and Telecommunications Trends
• /
• v.36 no.6
• /
• pp.78-87
• /
• 2021

Information technology (IT) has been applied to various fields, and currently, IT devices and systems are used in very important areas, such as aviation, industry, and national defense. Such devices and systems are subject to various types of malicious attacks, which can be software or hardware based. Compared to software-based attacks, hardware-based attacks are known to be much more difficult to detect. A hardware Trojan horse is a representative example of hardware-based attacks. A hardware Trojan horse attack inserts a circuit into an IC chip. The inserted circuit performs malicious actions, such as causing a system malfunction or leaking important information. This has increased the potential for attack in the current supply chain environment, which is jointly developed by various companies. In this paper, we discuss the future direction of research by introducing attack cases, the characteristics of hardware Trojan horses, and countermeasure trends.

• Journal of Internet Computing and Services
• /
• v.15 no.3
• /
• pp.31-43
• /
• 2014

Large number of Android mobile application has been developed and deployed through the Android open market by increasing android-based smart work device users recently. But, it has been discovered security vulnerabilities on malicious applications that are developed and deployed through the open market or 3rd party market. There are issues to leak user's personal and financial information in mobile devices to external server without the user's knowledge in most of malicious application inserted Trojan Horse forms of malicious code. Therefore, in order to minimize the damage caused by malignant constantly increasing malicious application, it is required a proactive detection mechanism development. In this paper, we analyzed the existing techniques' Pros and Cons to detect a malicious application and proposed discrimination and detection result using malicious application discrimination mechanism based on Jaccard similarity after collecting events occur in real-time execution on android-mobile devices.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2018.07a
• /
• pp.470-473
• /
• 2018

본 논문에서는 스마트폰과 스마트폰이 블루투스로 연결할 때 페어링 진행을 최초 1회만 하는 것에 대한 위험성에 관하여 연구하였다. 본 연구를 통하여 구현한 트로이목마 어플리케이션은 희생자 스마트폰과 페어링이 되어 있을 경우, 실행과 동시에 공격자의 스마트폰과 블루투스로 연결되도록 하였다. 희생자 스마트폰의 어플리케이션은 스마트폰의 카메라를 작동시켜 사진을 촬영하고 스마트폰에 저장된 주소록 데이터를 추출하며, 촬영한 사진과 추출한 주소록 데이터를 공격자의 스마트폰으로 전송한다. 공격자는 희생자의 스마트폰에서 탈취한 정보를 확인할 수 있다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.5 no.8
• /
• pp.1457-1471
• /
• 2011

A method to detect Trojan horses in messaging and Bluetooth in mobile phones by means of monitoring the events produced by the infections is presented in this paper. The structure of the detection approach is split into two modules: the first is the Monitoring module which controls connection requests and sent/received files, and the second is the Graphical User module which shows messages and, under suspicious situations, reports the user about a possible malware. Prototypes have been implemented on different mobile operating systems to test its feasibility on real cellphone malware. Experimental results are shown to be promising since this approach effectively detects various known malware.

• Convergence Security Journal
• /
• v.16 no.5
• /
• pp.11-16
• /
• 2016

In modern society, the development of Information and Communication Technology has given people a lot of opportunities. But on the other side cyber attack also gives enormous damage to people. Recently Korea has become the target of cyber attack. The threat of it is growing. Especially North Korea has committed hostile actions against South Korea. North Korea has recently attacked the computer networks of South Korea's important national facilities. The types of North Korea's cyber attacks include the followings. First, if we see it with the viewpoint of software, it tries to destroy or control the Internet, infects the networks with viruses, worms, Trojan Horse and Distributed Denial of Service. I suggest the following to solve the problem. First, South Korea should unify the organizations to respond to the attacks of North Korea, as North Korea has a unified organization for the cyber attack. Second, they should think about the establishment of "Cyber Terrorism Prevention Act" to systematically respond to the software attacks.

• Review of KIISC
• /
• v.12 no.6
• /
• pp.41-53
• /
• 2002

선진/주변국에서는 C4ISR/PGM(Command, Control, Communication, Computer, Intelligence, Surveillance and Reconnaissance/Precision Guided Missile)체계를 미래전의 핵심으로 인식하여 막대한 예산을 투입, 체계를 구축하고 체계의 극대화를 위해서 상호운영성, 표준화 등에 관심을 경주하고 있다. 그러나 이러한 모든 체계는 네트워크로 연결됨에 따라 미래 전의 신종 위협으로 등장한 컴퓨터 바이러스, 웜(worm), 트로이 목마(Trojan Horse), 논리폭탄(Logic bombs), 트랩도어(Trap doors), 칩핑(chipping), 나노 머신으로 분류되는 초소형로봇, EMP/HPM(Electro Magnetic Pulse/High Powered Microwave)등에 대한 취약점을 지니게 되며 이에 대한 대비책도 강구하고 있다. 본 연구에서는 미래 디지털 전쟁의 핵심인 C4ISR/PGM복합체계를 소개하고, 미래전의 특성 및 C4ISR와 PGM체계의 역할에 대해 소개하며, 특히 비대칭 전력으로 선진/주변국에서 강력하게 추진하고 있는 사이버전 현황 및 발전 추세를 제시하고, 정보전의 한계와 문제점도 제시한다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.20 no.2
• /
• pp.343-350
• /
• 2016

A secure and effective on-chip bus for detecting and preventing malicious attacks by infected IPs is presented in this paper. Most system inter-connects (on-chip bus) are vulnerable to hardware Trojan (Malware) attack because all data and control signals are routed. A proposed secure bus with modifications in arbitration, address decoding, and wrapping for bus master and slaves is designed using the Advanced High-Performance and Advance Peripheral Bus (AHB and APB Bus). It is implemented with the concept that arbiter checks share of masters and manage infected masters and slaves in every transaction. The proposed hardware is designed with the Xilinx 14.7 ISE and verified using the HBE-SoC-IPD test board equipped with Virtex4 XC4VLX80 FPGA device. The design has a total gate count of 39K at an operating frequency of 313MHz using the $0.13{\mu}m$ TSMC process.

• Korean Journal of Social Welfare
• /
• v.66 no.3
• /
• pp.231-251
• /
• 2014

Recently, Korean government documented the plan to cope with the situation related to rich pensioners of Basic old-age pension. The purpose of this paper is to verify that how many rich pensioners are existing and to evaluate government reform plan's validity and effect. Main results are as follows; firstly, if the definition of rich pensioners is on the top 10%, the proportion of them would form 2.9% of total. And then, an amount of expenditure for them is only 2.6% of total. Secondly, in terms of disposable income, debt, and transfer income from child, the household who would be applied by government's plan is not richer than other household who is in the same living standard. And then, if the government's plan enforced, the effect might be very small. Lastly, the plan of government will discriminate against persons who support their parent. As a result, Basic old-age pension will be worsen. This paper should underline that the government's reform is only the 'hidden' retrenchment strategy in order to introduce a standard of the obligation to support own parent in the state without scientific prediction and serious discussion of negative public opinion. That is why, this is the same as the 'Trojan Horse'.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2005.05a
• /
• pp.1123-1126
• /
• 2005

여러 임베디드 시스템 운영체제 중에서 임베디드 리눅스는 다양한 오픈 소스 S/W를 사용할 수 있고, 다양한 임베디드 시스템에 이식할 수 있다는 장점 때문에 널리 사용되고 있다. 하지만, 임베디드 리눅스는 리눅스의 기본 접근제어 메커니즘인 임의적 접근제어(Discretionary Access Control, DAC) 기법을 그대로 사용하고 있어서 사용자의 Identity가 도용 당하거나 Trojan Horse와 같은 프로그램이 설치될 경우, 접근제어가 효력을 상실하게 된다는 결점을 가지고 있다. 더욱 문제가 되는 것은 DAC의 특성상, 프로세스가 필요 이상의 과도한 특권을 가지고 실행되며, 그 결과 잘못된 프로세스가 그 자신과 관계 없는 프로그램이나 운영체제의 커널마저 손상시키는 결과를 낳을 수 있다는 것이다. 이에 따라 보다 강건한 접근제어 메커니즘에 대한 연구의 필요성이 대두되고 있다. 본 논문에서는 임베디드 리눅스 운영체제의 접근제어 메커니즘이 가지고 있는 보안적 결점에 대해서 알아보고, 이 결점을 보완하기 위해 타입 강제(Type Enforcement, TE) 기법을 사용함으로써, 임베디드 시스템에 적합하면서 강력한 접근제어를 제공할 수 있는 안전한 임베디드 리눅스 시스템에 대한 설계 모델을 보여주고자 한다.