• Journal of Internet Computing and Services
• /
• v.15 no.3
• /
• pp.79-90
• /
• 2014

User authentication based on ID and PW has been widely used. As the Internet has become a growing part of people' lives, input times of ID/PW have been increased for a variety of services. People have already learned enough to perform the authentication procedure and have entered ID/PW while ones are unconscious. This is referred to as the adaptive unconscious, a set of mental processes incoming information and producing judgements and behaviors without our conscious awareness and within a second. Most people have joined up for various websites with a small number of IDs/PWs, because they relied on their memory for managing IDs/PWs. Human memory decays with the passing of time and knowledges in human memory tend to interfere with each other. For that reason, there is the potential for people to enter an invalid ID/PW. Therefore, these characteristics above mentioned regarding of user authentication with ID/PW can lead to human vulnerabilities: people use a few PWs for various websites, manage IDs/PWs depending on their memory, and enter ID/PW unconsciously. Based on the vulnerability of human factors, a variety of information leakage attacks such as phishing and pharming attacks have been increasing exponentially. In the past, information leakage attacks exploited vulnerabilities of hardware, operating system, software and so on. However, most of current attacks tend to exploit the vulnerabilities of the human factors. These attacks based on the vulnerability of the human factor are called social-engineering attacks. Recently, malicious social-engineering technique such as phishing and pharming attacks is one of the biggest security problems. Phishing is an attack of attempting to obtain valuable information such as ID/PW and pharming is an attack intended to steal personal data by redirecting a website's traffic to a fraudulent copy of a legitimate website. Screens of fraudulent copies used for both phishing and pharming attacks are almost identical to those of legitimate websites, and even the pharming can include the deceptive URL address. Therefore, without the supports of prevention and detection techniques such as vaccines and reputation system, it is difficult for users to determine intuitively whether the site is the phishing and pharming sites or legitimate site. The previous researches in terms of phishing and pharming attacks have mainly studied on technical solutions. In this paper, we focus on human behaviour when users are confronted by phishing and pharming attacks without knowing them. We conducted an attack experiment in order to find out how many IDs/PWs are leaked from pharming and phishing attack. We firstly configured the experimental settings in the same condition of phishing and pharming attacks and build a phishing site for the experiment. We then recruited 64 voluntary participants and asked them to log in our experimental site. For each participant, we conducted a questionnaire survey with regard to the experiment. Through the attack experiment and survey, we observed whether their password are leaked out when logging in the experimental phishing site, and how many different passwords are leaked among the total number of passwords of each participant. Consequently, we found out that most participants unconsciously logged in the site and the ID/PW management dependent on human memory caused the leakage of multiple passwords. The user should actively utilize repudiation systems and the service provider with online site should support prevention techniques that the user can intuitively determined whether the site is phishing.

• Korean Security Journal
• /
• no.25
• /
• pp.109-130
• /
• 2010

As many countries in the world including the Republic of Korea have used all their national resources in the accelerating economic information warfare, illegal leakage of industrial technologies and information has increased rapidly. The costs required for damage prevention from 2007 to 2008 are estimated at approximately KRW 180 trillion which is expected to increase gradually in future. Because the tricks of leaking key technologies are also getting increasingly systematized, sophisticated and bigger, e.g., simple theft at the individual level or the conspiracy of all the staff taking part in the research activities, we should pay special attention to technology security in addition to technology development. While there are several factors affecting such the brain drain, they usually include personal, social, political and cultural factors, for instance, very heavy educational expenditure of children compared to relatively low pay, the speedy labor market circulation for experienced personnel, or political restrictions on researches. In this context, as part of efforts made to prevent the outflow of core personnel, individual companies and research institutes should establish systematically appropriate core personnel management systems for their own organizational or business goals and principles which are intented to ensure to give better treatment and benefit to core personnel and to exercise closer supervision over them. Furthermore, the conventional personnel management system should be radically and flexibly improved in the manner of encouraging the core personnel returning to the organization to combine their external experiences with practices, instead of penalizing them. At the same time, it is necessary to train and educate core personnel through mutual collaboration and in-house training facilities as well as external academic programs operated jointly at the level of the industry. Finally, as the issues concerning the outflow of core personnel are not just problems of relevant companies and other advanced countries have devoted their best efforts to secure their own key technologies at the national level, it is urgent for the industry and the competent authorities to cooperate closely.

• Management Science and Financial Engineering
• /
• v.16 no.2
• /
• pp.81-97
• /
• 2010

Trust is one of the most important aspects of the relationship between retailers and consumers in e-commerce. Users may have concerns about transaction security or personal information leakage when they engage in transactions over the Internet. It can be difficult to attract customers if the retailers or service providers cannot establish trust with their customers. There have been many studies of trust-building mechanisms between customers and e-storefronts. However, little work has been done on identifying the relationships between customer satisfaction, purchase intention, and trust. In addition, trust building occurs in the pre- and post-purchase phases of an e-commerce transaction, as well as gradually over repeated transactions. Thus we distinguish between cue-based trust and experience-based trust. The objective of this study was to explain the impact of trust on customer satisfaction and purchase intention in relation to e-commerce sites from the perspective of a multi-dimensional concept of trust. We surveyed 350 undergraduate students and obtained 331 responses for analysis. The result of our analysis showed that cue-based trust has a positive relationship with trust based on experience. Although the two concepts of trust have positive relationships with satisfaction, the path coefficient of trust based on experience was higher than that of cue-based trust. In addition, the purchase intention mediates the relationship between cue-based trust and experience-based trust.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.5 no.4
• /
• pp.668-675
• /
• 2001

Recently, the performance of the commercial PCS(Personal Communication Service) system has been improved to the uppermost limit and ultimately the next generation mobile communication is to be realized by IMT-2000 (International Mobile Communication-2000) to provide multimedia services. Therefore, the new type receiving system is researched actively and one of the most important part in a receiver is direct conversion method. The direct conversion method is suitable for low power consumption, small size, MMIC, and low price, which is to be adopted to the next generation mobile communication systems. In this case, however, several problems occur due to DC-offset. The DC-offset suppresses amplification of the required signal because of the leakage signal of frequency synthesizer in the system. In this thesis, the removing method of DC-offset was considered. There are four removing techniques of DC-offset, which are AC-coupling, large capacitor, DC-feedback loop, and DC-free coding. Among these, the AC-coupling method is the most simplest method and the DC-feedback loop method has the best performance. Then, the performance of the AC-coupling method and DC-feedback loop method are evaluated by HP's ADS simulation tool. As a result, the AC-coupling method cannot be used to the digital communication systems due to data loss. On the other hand, it was confirmed that the DC-feedback loop method is suitable for the direct conversion receiver.

• Convergence Security Journal
• /
• v.16 no.5
• /
• pp.33-40
• /
• 2016

Credit card is means of payment used like cash in terms of function and its users have increased consistently. With development of Internet and electronic commerce a role as payment method of credit card has been growing. But as the risk which results from centralized information and online increases, credit card fraud is also growing. Card theft and loss are decreasing due to countermeasure of card companies and financial supervisory authorities, while card forge and identity theft are increasing. Recently because of frequent personal information leakage and deregulation of financial security following easy-to-use payment enforcement, customer's anxiety about card fraud is growing. And the increase of card fraud lowers trust on credit system as well as causes social costs. In this paper, the security problems of card operating system are addressed in depth and the measures such as immediate switch to IC card terminals, introduction of new security technology, supervision reinforcement of the authorities are proposed.

• Journal of Digital Convergence
• /
• v.12 no.10
• /
• pp.299-308
• /
• 2014

Today, a number of users using smartphone is very rapidly increasing by development of smartphone performance and providing various services. Also, they are using it for enjoying various services(cloud service, game, banking service, mobile office, etc.). today's mobile security solution is simply to detect malicious code or stay on the level of mobile device management. In particular, the services which use sensitive information, such as certificate, corporation document, personal credit card number, need the technology which are prevented from hacking and leaking it. Recently, interest of these mobile security problems are increasing, as the damage cases been occurred. To solve the problem, there is various security research such as mobile virtualization, ARM trustzone, GlobalPlatform for mobile device. Therefore, in this paper, I suggested efficient method that uses the mobile virtualization techniques of certification, security policy and access control, password/key management, safe storage, etc. and Trustzone of ARM for preventing information leakage and hacking.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.6
• /
• pp.1167-1187
• /
• 2020

We are facing the situation where cyber threats such as hacking, malware, data leakage, and theft, become an important issue in the perspective of personal daily life, business, and national security. Although various efforts are being made to response to the cyber threats in the national and industrial sectors, the problems such as the industry-academia skill-gap, shortage of cybersecurity professionals are still serious. Thus, in order to overcome the skill-gap and shortage problems, we propose a Cybersecurity technical response Job Competency(CtrJC) framework by adopting the concept of cybersecurity personnel's job competency. As a sample use-case study, we implement the CtrJC against to personals who are charged in realtime cybersecurity response, which is an important job at the national and organization level, and verify the our framework's effects. We implement a sample model, which is a CtrJC against to realtime cyber threats (We call it as CtrJC-R), and study the verification and validation of the implemented model.

• Journal of the Korea Convergence Society
• /
• v.8 no.4
• /
• pp.25-36
• /
• 2017

As smartphone users have increased in recent years, various applications have been developed and used especially for Android-based mobile devices. However, malicious applications developed by attackers for malicious purposes are also distributed through 3rd party open markets, and damage such as leakage of personal information or financial information of users in mobile terminals is continuously increasing. Therefore, to prevent this, a method is needed to distinguish malicious apps from normal apps for Android-based mobile terminal users. In this paper, we analyze the existing researches that detect malicious apps by extracting the system call events that occur when the app is executed. Based on this, we propose a technique to identify malicious apps by analyzing the sequence similarity of kernel layer events occurring in the process of running an app on commercial Android mobile devices.

• KIPS Transactions on Computer and Communication Systems
• /
• v.5 no.8
• /
• pp.197-210
• /
• 2016

Lately smartphone uasage is increasing and many Internet of Things (IoT) devices support wireless communications. Accordingly, small base stations which called femtocells are supplied to prevent saturation of existing base stations. However, unlike the original purpose of the femtocell with the advanced hacking technologies, Vulnerability such as gaining the administrator authority was discovered and this can cause serious problems such as the leakage of personal information of femtocell user. Therefore, identify security threats that may occur in the femtocell and it is necessary to ways for systematic vulnerability analysis. In this paper, We analyzed the security threats that can be generated in the femtocell and constructed a checklist for vulnerability analysis using the Threat Modeling method. Then, using the constructed checklist provides a scheme that can improve the safety of the femto cell through the actual analysis and taken the results of the femtocell vulnerabilities analysis.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.15 no.1
• /
• pp.61-68
• /
• 2015

Recently, with increasing use of smartphones, the security threats also have increased rapidly. Especially, the compromised smartphone is very dangerous because it could be exploited in a DDOS attacks such as cyberterrorism as well as in the leakage of personal information. However, most bot detection mechanisms are still unsuitable for smartphone with its lower computing capability and limited battery capacity because they incur additional computational overheads or require pre-defined signatures. In this paper, we present an efficient bot detection mechanism in smartphones. Our mechanism detects effectively bots in outgoing traffic by using a correlation between user events and network traffic. We have implemented its prototype in Android smartphone and measured its performance. The evaluation results show that our mechanism provides low overhead to detect bots in smartphones.