패스워드 매니저의 클라이언트-서버 통신 취약점 분석
Security Vulnerabilities of Client-Server Communications of Password Managers
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
웹사이트 로그인 정보 및 결제 정보들을 편리하게 관리하기 위해 패스워드 매니저를 이용하는 사용자가 증가하고있다. 패스워드 매니저는 사용자의 웹사이트 로그인 정보 및 결제 정보들을 서버상에 암호화하여 저장하고, 사용자는 서버에 접속하여 패스워드 정보들을 수신하여 사용한다. 따라서, 공격자가 패스워드 매니저와 서버와의 통신 메시지를 스니핑하여 메시지 내용을 해독할 수 있거나, 또는 공격자가 사용자의 메모리 정보를 탈취하여 메시지 내용을 해독할 수 있으면, 사용자의 모든 패스워드 정보가 노출되는 심각한 문제가 발생한다. 본 논문에서는 주요 패스워드 매니저들의 클라이언트-서버 통신 및 암호 방법을 분석하고, 클라이언트-서버 통신에 심각한 취약점이 있음을보인다.
Abstract
Many users are using password managers in order to conveniently manage several usernames and passwords needed toaccess the web sites. The password manager encrypts and stores several passwords on the server, and the user accesses theserver to receive the password information. Thus, if an attacker can sniff a message between the password manager and theserver and decrypt the message content, or if an attacker can steal the computer’s memory and decrypt the message content,then all the passwords will be exposed to the attacker. In this paper, we analyze the client-server communications andencryption process of password mangers and show there is a serious vulnerability in memory attack.
참고문헌 (32)
- J. Bonneau, "The quest to r eplace passwords: A framework for co mparative evaluation of web authentic ation schemes", Proc. IEEE Sympos ium on Security and Privacy, pp.553~567 (2012)
- "Global passwor d management market to 2024" (2019)[URL]
- "Password mana gement market - Growth, trends, and forecast (2020-2025)" (2020)[URL]
- P. Gasti, "On t he security of password manager data base formats", Proc. European Sym posium on Research in Computer Sec urity, pp.770~787 (2012)
- S. Kim and H. Kim, "Security analysis of password managers", Review of Korea Institute of Information Security and Cryptology, 28(1), pp.36~42 (2018)
- 정혜라, "패스워드 매니저의 패스워드 저장소 보안 취약점 분석", 정보보호학회논문지, 28(5), pp.1047~1057 (2018), 한국정보보호학회[DOI]
- M. Golla, "On the security of cracking-resist ant password vaults", Proc. ACM S IGSAC Conference on Computer and Communications Security (CCS), pp.1230~1241 (2016)
- D. Silver, "Password manage rs: Attacks and defenses", Proc. U SENIX Security Symposium, pp.449~464 (2014)
- Z. Li, "The emperor’s new password manager: Security analysis of web-based p assword managers", Proc. USENIX Security Symposium, pp.465~479 (2014)
- X. Li, "A survey on server -side approaches to securing web appl ications", ACM Computing Surveys, 46(4), pp.1~29 (2014)
- R. Zhao, "All your browse r-saved passwords could belong to us:A security analysis and a cloud-based new design", Proc. ACM conference on Data and Application Security and Privacy, pp.333~340 (2013)
- M. Vigo, "Even the Last Pass will be gone, deal with it", Black Hat Europe 2015 (2015)
- J. Gray, "Forensically-sound analysis of se curity risks of using local password m anagers", Proc. International Requi rements Engineering Conference Work shops, pp.1~8 (2016)
- H. Zhang, "Analy sis of encryption mechanism in KeePa ss Password Safe 2.30", Proc. IEEE International Conference on Anti-coun terfeiting, Security, and Identification (ASID), pp.43~46 (2016)
- "Best password manager f or stroing, secure passwords" (2019)[URL]
- "The 6 best password mana gers" (2019)[URL]
- "The best password managers for 2020" (2019)[URL]
- "Best password managers 2020" (2019)[URL]
- "LastPass password man ager" (2020)[URL]
- "LastPass Homepage" (2020)[URL]
- "LastPass: Free p assword manager" (2020)[URL]
- "Desktop browser market share in republic of korea - December 2019" (2020)[URL]
- "Technical whitepaper" (2018)[URL]
- "DB browser for SQLite" (2018)[URL]
- "Quick memory editor" (2018)[URL]
- "Proecess dump" (2019)[URL]
- "KeePass pas sword safe" (2018)[URL]
- "Awards/ratings - Keepass" (2015)[URL]
- "KeePass plugin to expose password entries securely over HTTP" (2017)[URL]
- "Extension s to allow Chrome and Firefox" (2018)[URL]
- "Extension to allow Chrome and Firefox" (2019)[URL]
- "HxD – Freeware Hex edit or and disk editor" (2018)[URL]