• Journal of Platform Technology
• /
• v.9 no.3
• /
• pp.3-17
• /
• 2021

Advanced persistent threat (APT) attacks are attacks aimed at a particular entity as a set of latent and persistent computer hacking processes. These APT attacks are usually carried out through various methods, including spam mail and disguised banner advertising. The same name is also used for files, since most of them are distributed via spam mail disguised as invoices, shipment documents, and purchase orders. In addition, such Infostealer attacks were the most frequently discovered malicious code in the first week of February 2021. CDR is a 'Content Disarm & Reconstruction' technology that can prevent the risk of malware infection by removing potential security threats from files and recombining them into safe files. Gartner, a global IT advisory organization, recommends CDR as a solution to attacks in the form of attachments. There is a program using CDR techniques released as open source is called 'Dangerzone'. The program supports the extension of most document files, but does not support the extension of HWP files that are widely used in Korea. In addition, Gmail blocks malicious URLs first, but it does not block malicious URLs in mail systems such as Naver and Daum, so malicious URLs can be easily distributed. Based on this problem, we developed a 'Dangerzone' program that supports the HWP extension to prevent APT attacks, and a Chrome extension that performs URL checking in Naver and Daum mail and blocking banner ads.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2020.11a
• /
• pp.424-427
• /
• 2020

인터넷의 활발한 이용으로 인해 악성코드의 유포 경로가 다양해지고 있다. 그 중, 문서형 악성코드 감염 사례가 증가하고 있다. 문서형 악성코드는 이메일, 온라인에서 다운로드 받는 PDF, DOCX 파일의 취약점을 통해 유포되고 있다. 이로 인해 우리는 쉽게 바이러스에 감염될 수 있다. 그러므로 문서형 악성코드의 예방은 매우 중요하다. 우리는 악성코드로 의심되는 문서 파일을 안전한 PDF 파일로 변환해 주는 오픈 소스 프로그램인 Dangerzone을 활용하여 개인과 기업에서 프로그램을 쉽고 편리하게 사용할 수 있도록 웹, 데스크톱 형태로 확장 개발한다.