모바일 어플리케이션 개인정보 유출탐지 및 보안강화 연구
Mobile Application Privacy Leak Detection and Security Enhancement Research
0
조회
0
다운로드
6
인용
0
참고문헌
키워드
초록
구글 플레이 스토어와 애플 앱 스토어 등 모바일 앱 스토어는 금융, 쇼핑, 엔터테인먼트 등 다양한 카테고리로 영역을 확장하고 있으며, 등록되어 있는 어플리케이션(이하 앱)만 수백만 개에 이른다. 하지만 휴대성과 편리성을 제공하는 모바일 앱의 보안 취약점으로 인해서 최근 모바일 앱을 통한 개인정보 및 데이터 유출이 급격히 증가되고 있는 상황이다. 본 논문에서는 국내 최대 규모의 사용자가 사용하는 상용 모바일 앱을 카테고리별로 분류하고, 사용자가 각 카테고리 별 모바일 앱을 사용하는 경우 유출될 수 있는 개인정보를 분석한다. 분석 결과 해당 앱들을 통해서실시간으로 개인정보가 유출될 수 있음을 증명하고, 모바일 앱 사용자의 개인정보 유출방지와 안전한 사용을 위한보안강화 방안을 제안한다.
Abstract
Mobile applications stores such as Google Play Store and Apple App Store, are widely used to distribute a variety ofapplications including finance, shopping, and entertainment. Recently, however, vulnerabilities of the mobile applications arelikely to violate users’ privacy such as personal information leakage. In this paper, we classify mobile applications that canbe download from mobile stores, and analyze the personal information that could be leaked when users are using the mobileapplications. As a result of analysis, we found that personal information are leaked in some widely used mobile applicationsin practice. On the basis of our experiment results, we propose some mitigations to enhance security of the mobileapplications and prevent leakage of personal information.
참고문헌 (20)
- "Number of available applications in the Google Play Store from December 2009 to June 2018"[URL]
- "Number of available apps in the Apple App Store from 2008 to 2018 (in 1,000s)"[URL]
- Synopsys, "2018 Open Source Security and Risk Analysis Report", Network Security, ~ (2018)
- T. Watanabe, "Understanding the Origins of Mobile App Vulnerabilities: A Large-scale Measurement Study of Free and Paid Apps", Proceedings of IEEE, 2017, 14~24
- Wei Song, "Understanding JavaScript Vulnerabilities in Large Real-World Android Applications", IEEE Transactions on Dependable and Secure Computing, pp.1~1 (2018)
- Timothy A. Chadza, "A Look Into the Information Your Smartphone Leaks", 2017International Symposium on Networks, Computers and Communications (ISNCC), pp.1~6 (2017)
- Jagdish Prasad Achara, "Mobileappscrutinator: A simple yet efficient dynamic analysis approach for detecting privacy leaks across mobile OSs", The 32nd Annual Computer Security Applications Conference (ACSAC) (2016)
- 박상호, "안드로이드 스마트폰 암호 사용 앱 보안 분석 및 대응", 정보보호학회논문지, 23(6), pp.1049~1055 (2013), 한국정보보호학회[DOI]
- Ko Seung Won, "Implementation example of mobile application analysis and verification solution", Korea Institute of Information Security and Cryptology, 23(2), pp.21~28 (2013)
- S. Gaw, "Password Management Strategies for Online Accounts", ACM SOUPS 2006: Proc. 2nd Symp. on Usable Privacy and Security, pp.44~55 (2016)
- "RFC 8446, The Transport Layer Security(TLS) Protocol Version 1.3" (2018)[URL]
- K. Bhargavan, "Verified models and reference implementations for the tls 1.3standard candidate", IEEE Symposium on Security and Privacy (S&P) (2017)
- C. Meyer, "Lessons Learned From Previous SSL", TLS Attacks-A Brief Chronology Of Attacks And Weaknesses, 2013
- "SSL Pulse Protocol Support" (2018)[URL]
- M. Kranch, "Upgrading HTTPS in midair: HSTS and key pinning in practice", NDSS ’15: The 2015 Network and Distributed System Security Symposium (2015)
- "C++14 implementation of the TLS-1.3standard GitHub"[URL]
- H. Shewale, "Analysis of androidvulnerabilities and modern exploitation techniques", ICTACT Journal on Communication Technology, 5(1) (2014)
- Reddy, S. Vinjosh, "Wireless hacking-a WiFi hack by cracking WEP", 2010 2nd International Conference on, 1, pp.189~193 (2010)
- "Android Secrurity Bullentins -Android Open Source Project" (2018)[URL]