안드로이드 뱅킹 어플리케이션 내 중간언어 분석을 통한 보안 검사 지점 우회 취약점 연구
A Study on the Vulnerability of Using Intermediate Language in Android: Bypassing Security Check Point in Android-Based Banking Applications
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
최근 모바일뱅킹 사용의 일상화와 더불어 은행권에서 모바일뱅킹의 사용 비중이 더욱 커져감에 따라 보안 위협도 증가하고 있다. 이에 국내 금융권에서는 뱅킹 어플리케이션 내에 보안 솔루션들을 도입하고, 상시 실행되는지 여부를 확인하기 위하여 보안 검사 지점들을 설정하여 어플리케이션의 안정성을 보장하고 있다. 본 논문에서는 국내 주요 은행들의 안드로이드 뱅킹 어플리케이션 디컴파일(decompile)시 추출되는 중간언어를 정적 및 동적 분석하여 보안 검사 지점들을 우회하는 모바일 백신 프로그램 미작동의 취약점을 보인다. 또한, 결과를 통해 이를 악용할 수 있는 공격을 알아보고 대응 방안을 제시한다.
Abstract
In recent years, as the proportion of mobile banking has become bigger with daily usage of mobile banking, security threats are also increasing according to the feeling. Accordingly, the domestic banking system introduces security solution programs in the banking application and sets security check points to ensure the stability of the application in order to check whether it is always executed. This study presents a vulnerability of inactivity bypassing mobile vaccine program operation checkpoints using the intermediate language statically and dynamically analysis when decompiling the android banking applications of major banks in Korea. Also, through the results, it identifies possible attacks that can be exploited and suggest countermeasures.
참고문헌 (28)
- "Domestic Internet banking service in Q2", 2016, 2016, pp.4~7
- Hyunho Cho, "E-finance and Financial Security", Financial Security Institute, 4, pp.5~32 (2016)
- Announcement of Survey on Internet Usage Conditions in Korea, , Korea Internet & Security Agency, 6~7 (2015)
- Roman Unuchek, "Mobile malware evolution 2016", pp.10~ (2017), Kaspersky lab
- Jisun Choi, "Protection technology trend for smartphone banking application integrity verification", Journal of Information Security, 23(1), pp.54~60 (2013)
- Jin-Hyuk Jung, "Repackaging Attack on Android Banking Applications and Its Countermeasures", Wireless Personal Communications, 73(4), pp.1421~1437 (2013)
- Wu Zhou, "Detecting repackaged smartphone applications in third-party android marketplaces", CODASPY '12 Proceedings of the second ACM conference on Data and Application Security and Privacy, pp.317~326 (2012)
- Seungyong Yoon, "Analyzing Security Threats of Android-based Mobile Malware", Advanced Science and Technology Letters(SecTech 2016), 139, pp.310~315 (2016)
- Yajin Zhou, "Dissecting Android Malware : Characterization and Evolution", 2012 IEEE Symposium on Security and Privacy, pp.95~109 (2015)
- Sriramulu Bojjagani V. N. Sastry, "STAMBA : Security Testing for Android Mobile Banking Apps", Advances in Signal Processing and Intelligent Recognition Systems, pp.671~683 (2015)
- Jong Hyuk Park, "An enhanced smartphone security model based on information security management system(ISMS)", Electronic Commerce Research, 4(3), pp.321~348 (2014)
- 김순일, "안드로이드 스마트폰 뱅킹 앱 무결성 검증 기능의 취약점 연구", 정보보호학회논문지, 23(4), pp.743~755 (2013), 한국정보보호학회[DOI]
- Nguyen, Thanh, "Exploitation and Detection of a Malicious Mobile Application", Proceedings of the 50th Hawaii International Conference on System Sciences (2017)
- A. Shabtai, "Google Android : A Comprehensive Security Assessment", IEEE Security and Privacy, 8(2), pp.35~44 (2010)
- "Ahnlab"[URL]
- "NSHC"[URL]
- Parvez Faruki, "Evaluation of Android Anti Malware Techniques against Dalvik Bytecode Obfuscation", 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications, pp.414~421 (2014)
- "Dex Education: Practicing Safe Dex" (2012)[URL]
- "DroidJack Uses Side-L oad…It's Super Effective! Backdoored Po kemon GO Android App Found" (2016)[URL]
- 이정웅, "안드로이드 접근성(Accessibility) 기능을 이용한보안키패드의 취약점 공격 및 대응 방안", 정보보호학회논문지, 26(1), pp.177~185 (2016), 한국정보보호학회[DOI]
- Vaibhav Rastogi, "Catch Me If You Can : Evaluating Android Anti-Malware Against Transformation Attacks", IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, 9(1), pp.99~108 (2014)
- H. Cai, "Certified Self-Modifying Code", Proceedings of the 2007 ACM SIGPLAN conference on Programming language design and implementation, 42(6), pp.66~77 (2007)
- Marius Popa, "Techniques of Program Code Obfuscation for Secure Software", Journal of Mobile, Embedded and Distributed Systems, 3(4), pp.205~219 (2011)
- Namheun Son, "A study of user data integrity during acquisition of Android devices", 13th Annual Digital Forensics Research Conference, 10, pp.S3~S11 (2013)