범죄 스크립트 분석을 통한 ‘심스와핑(SIM-Swapping)’ 범죄 대응방안
Countermeasures against ‘SIM-Swapping’ Crime through Criminal Script Analysis
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
본 연구는 국내에서 발생하는 심스와핑 범죄의 모델과 범죄 취약 요소를 분석하고, 대응 정책을 제안하는 것을 목표로 한다. 이를 위해서 본 연구에서는 최근 발생한 심스와핑 범죄 사례를 바탕으로 범죄 스크립트 분석을 수행하였다. 그 결과 심스와핑 범죄가 범죄 준비, 복제 심 제작, 단말기 변경 인증, 일회용 OTP 탈취, 가상자산 탈취, 범행자금 세탁 순으로 이루어진다는 것을 확인하였고, 각 과정에서 이동통신사의 데이터 보안 취약 요소, 비인가된 단말기 변경 승인 요청을 거절할 수 있는 검증 알고리즘의 부재, 다중 요소 인증의 인증요소간 강한 의존성 등 범죄 유발 요소가 존재함을 파악하였다. 이러한 연구 결과를 토대로 심스와핑 범죄 예방을 위하여 외부 보안 감사 제도 도입, 단말기 변경의 이상 탐지/차단 시스템의 도입, 국내 산업 전반에서 사용 중인 다중 요소 인증의 각 요소 독립성 강화 등 기술적, 법적 정책을 제언하였다.
Abstract
This study aims to analyze the model and vulnerability factors of swapping crimes in Korea and propose countermeasures. To this end, this study conducted a crime script analysis based on recent cases of sim-swapping crimes, and found that sim-swapping crimes consist of crime preparation, clone sim production, terminal change authentication, one-time OTP theft, virtual asset theft, and criminal money laundering. In each process, we identified the existence of crime-inducing factors such as data security vulnerabilities of mobile operators, the lack of verification algorithms to reject unauthorized device change approval requests, and the strong dependence between authentication factors in multi-factor authentication, Based on these findings, we recommended technical and legal policies to prevent sim-swapping crimes, such as introducing an external security audit system, introducing a system for detecting and blocking abnormalities in terminal changes, and strengthening the independence of each element of multi-factor authentication used throughout the domestic industry.
참고문헌 (18)
- Countering SIM-Swapping, "European Union Agency for Cybersecurity(ENISA)", ENISA, ~ (2021)
- Yin, R. K., "Case study research: Design and methods" (2009), Sage
- Andrews, N., "Can I get your digits: Illegal acquisition of wireless phone numbers for SIM-Swap attacks and wireless provider liability", Northwestern Journal of Technology and Intellectual Property, 16(2) (2018)
- Cornish, D. B., "The procedural analysis of offending and its relevance for situational prevention", Crime Prevention Studies, 3(1) (1994)
- Dehghanniri, H., "Crime scripting: A systematic review", European Journal of Criminology, 18(4) (2021)
- Kim, M., "A study of the emerging trends in SIM swapping crime and effective countermeasures", 2022 IEEE, 2022, ~
- Lee, K., "An empirical study of wireless carrier authentication for SIM swaps", proceedings of the Sixteenth Symposium on Usable Privacy and Security (2020)
- Tambunan, D. A., "Cyber policing in preventing SIM swap attacks, a new threat to digital economy transactions", Management Technology and Security International Journal (2019)
- "(2022년 11월말 기준) 무선통신서비스 가입현황" (2023)[URL]
- "이동전화 단말기 식별번호(IMEI)제도개선 계획발표" (2011)[URL]
- "Large-scale SIM swap fraud" (2019)[URL]
- "SIM swapping – A mobile phone scam" (2023)[URL]
- Federal Bureau of Investigation(FBI), "Criminals increasing SIM swap schemes to steal millions of dollars from US public", Public Service Announcement (Alert Number I-020822-PSA), ~ (2022)
- "Massachusetts man pleads guilty in SIM swapping case" (2021)[URL]
- SIM swap statistics data report, "National Fraud Intelligence Bureau (NFIB)", ~, pp.FOI2019 (2020), 01084 & FOI2020[DOI]
- "Sim-swapping: UK police arrest eight over attacks on celebrities" (2021)[URL]
- "Police arrest 55 members of 'Black Panthers' SIM swap gang" (2022)[URL]
- "Former phone company employee char ged for role in SIM swap scam that targeted at least 19 customers, Including New Orleans resident" (2021)[URL]