블록체인 소프트웨어의 취약점을 이용한 OS 커맨드 인젝션 공격에 대한 연구
Analysis of Blockchain Software Vulnerability against OS Command Injection Attack
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
블록체인 기술은 비트코인과 함께 알려졌으며, 급진적인 암호화폐의 성장과 함께 주요 기술로 인식되었다. 블록체인을 활용하기 위한 노력은 다양한 분야에서 이어지고 있으며 지속해서 발전하고 있다. 하지만 블록체인의 발전과함께 블록체인을 위협하는 보안사고도 증가하고 있다. 이러한 문제를 해결하기 위해 블록체인의 다양한 보안 위협중 블록체인 소프트웨어의 구현상 문제점을 분석하겠다. 본 논문에서는 블록체인 소프트웨어 중 오픈소스로 개발되는 암호화폐를 보안 관점에서 바라보며 소스코드에 존재하는 취약점을 분석하고, 취약점을 이용한 OS 커맨드 인젝션 공격에 대해 알아보겠다.
Abstract
Blockchain has been developed as a key technology for many cryptocurrency systems such as Bitcoin. These days,blockchain technology attracts many people to adopt it to various fields beyond cryptocurrency systems for their informationsharing and processing. However, with the development and increasing adoption of the blockchain, security incidentsfrequently happen in the blockchain systems due to their implementation flaws. In order to solve this problem, in this paper,we analyze the software vulnerabilities of Bitcoin and Ethereum, which are the most widely used blockchain applications inreal world. For that purpose, we conduct an in-depth analysis of source code of them to detect software vulnerabilities, andexamine an OS command injection attack exploiting the detected ones.
참고문헌 (30)
- "Bitcoin: a peer-to-peer electronic cash system" (2018)[URL]
- RedHat, "Red hat product security risk report: 2015", RedHat (2016)
- "Coverity releases security spotlight report on critical security defects in open source projects" (2018)[URL]
- "Top 100 cryptocurre ncies by market capitalization" (2018)[URL]
- Skybox Security, "Vulnerability and threat trends analysis of current vulnerabilities, exploits and threats in play", 10242018, Skybox Security, ~ (2018)
- Alfred J. Menezes, "Handbook of applied cryptography" (1996), CRC Press
- Xiaoqi Li, "A survey on the security of blockchain systems", Future Generation Computer Systems (2017)
- M. Niranjanamurthy, "Analysis of blockchain technology : pros, cons and SWOT", Cluster Computing, pp.1~15 (2018)
- Blockchain application technology development and industry-specific implementation, "Financial Security Institute", Financial Security Institute, ~, pp.Security Research Department-2017-002 (2017)
- "Software weakness" (2018)[URL]
- "CWSS" (2018)[URL]
- "CWE/SANS Top 25 Most Dan-g erous Software Errors" (2018)[URL]
- 김병국, "오픈 소스의 소프트웨어 보안 문제 및 시큐어 코딩 적용방안", 정보과학회 컴퓨팅의 실제 논문지, 23(8), pp.487~491 (2017), 한국정보과학회[DOI]
- A. Gosain, "Static analysis:a survey of techniques and tools" (2015), Springer
- Gartner, "Magic quadrant for application security testing", G00327353, Gartner, ~ (2018)
- Y. Kim, "BlockChain issue", Hanwha Investment and Securities, ~ (2018)
- Micro Focus, "Securing your enterprise software : security fortify static code analyzer", 361-000070-003, Micro Focus, ~ (2018)
- "OS command injection" (2018)[URL]
- "System()" (2018)[URL]
- "Popen" (2018)[URL]
- "Wannacry attacks" (2018)[URL]
- "Bash reference manual" (2018)[URL]
- "Bitcoin core project" (2018)[URL]
- "Bitcoin configuration file" (2018)[URL]
- "Bitcoin core api" (2018)[URL]
- "OS command injection defense cheat sheet" (2018)[URL]
- "Interprocess communications" (2018)[URL]
- W. Richard Stevens, "UNIX network programming, volume 2, second edition:interprocess communications" (1999), Prentice Hall
- NIST, "Digital signature standard(DS S)", FIPS PUB 186-4, ~ (2013)
- R. L. Rivest, "A method for obtaining digital signatures and public-key cryptosystems", Communications of the ACM, 21(2), pp.120~126 (1978)