• Title/Summary/Keyword: Hijacking

Search Result 75, Processing Time 0.028 seconds

Design and Implementation of a Real Time Access Log for TCP/IP Protocol Weakness Attack Detection (TCP/IP 프로토콜 취약성 공격 탐지를 위한 실시간 접근 로그 설계 및 구현)

  • 국경완;이상훈
    • Proceedings of the Korean Information Science Society Conference
    • /
    • 2001.10a
    • /
    • pp.733-735
    • /
    • 2001
  • 네트워크가 보편화되면서 사이버 공간을 이용한 테러가 전 세계적으로 발생하고 있다. TCP/IP 프로토콜은 현재 가장 많이 사용되고 있는 네트워크 기술중의 하나로 인터넷뿐만 아니라, 많은 소규모의 사설 컴퓨터네트워크에서도 많이 사용되고 있다. 그러나 TCP 자체가 가지고 있는 보안 취약점 때문에 SYN 공격, TCP Sequence Number 공격, IP Spoofing, TCP Connection hijacking, Sniffing 과 같은 다양한 해킹 기법이 등장하고 있다. 본 논문에서는 TCP/IP 프로토콜 취약점을 이용하여 공격할 경우 이를 탐지하거나 차단하지 못하는 경우에 대비하여 실시간 접근 로그 파일을 생성하여 시스템 관리자가 의사결정을 할 수 있는 것과 동시에 시스템 스스로 대처할 수 있는 시스템을 구현하여 타당성을 검증하고 그에 따른 기대효과를 제시 한다.

  • PDF

Improved BGP TCP proposals for BGP SYN Attack defeating (BGP SYN Attack 차단을 위한 개선된 BGP TCP 제안)

  • Park, Myoung-Jong;Lee, Hee-Jo
    • Proceedings of the Korea Information Processing Society Conference
    • /
    • 2012.11a
    • /
    • pp.873-876
    • /
    • 2012
  • RFC 4271 에 규정되어 있는 BGP 는 대규모네트워크 망에서 효과적인 라우팅 정보전달을 위해 사용되어지는 프로토콜이다. 이러한 BGP 는 TCP Port 179 번을 사용함에 따라 TCP/IP 가 가지고 있는 보안위협에 노출되어 있다. BGP 보안 위협은 AS-PATH 공격, IP Hijacking 공격, BGP Neighbor 공격으로 라우터 자체의 보안설정으로 대부분 방어가 가능하나 BGP SYN Attack 에 대해서는 취약하다. BGP SYN Attack 은 호스트나 서버가 아닌 BGP 를 사용하는 라우터를 직접 공격하여 라우터의 TCP 나 BGP 관련 리소스를 고갈시켜 정상적인 기존 BGP 세션을 단절시키거나 새로운 BGP 세션 연결을 방해하여 결국 BGP 라우팅 정보를 교란하여 네트워크를 마비시킬 수 있다. 본 논문에서는 이러한 BGP SYN Attack 에 차단하기 위하여 이웃라우터간 안정적인 BGP 연결을 위해 설정한 BGP Neighbor Password 를 Key 로 활용한 개선된 BGP TCP 구조를 제안한다.

Hijacking Area Studies: Ethnographic Approaches to Southeast Asian Airlines

  • Ferguson, Jane M.
    • SUVANNABHUMI
    • /
    • v.12 no.2
    • /
    • pp.225-244
    • /
    • 2020
  • Area Studies, by definition, conjure ideas of emplaced knowledge; in-depth interdisciplinary understanding of language, history, culture and politics of a nation or region. Where detractors might see this approach as overly empirical, therefore precluding theoretical sophistication, others argue that "places" are either artificially constructed, or that processes of globalisation have obliterated the cultural zone. But what if we turn an ethnographic eye to those very processes and technologies themselves? Can Area Studies take to the air, and if so, what are the attendant challenges and benefits? Based on insights from ethnography amongst airline customer service workers, ground and cabin crews in Thailand and Myanmar, this research examines the airline cabin as a field for ethnographic study, and as an emplaced site for political and cultural processes. With participant observation-based knowledge of Southeast Asian cabin crews, this paper examines the 1990 hijack of Thai Airways TG 305 from an emplaced cultural perspective.

Response to SSL communication abuse cases by DNS service providers (DNS 서비스 제공자의 보안접속 악용 사례와 대응)

  • Go, Namhyeon
    • Proceedings of the Korean Society of Computer Information Conference
    • /
    • 2022.01a
    • /
    • pp.107-108
    • /
    • 2022
  • 오늘날 도메인 네임 시스템(DNS) 서비스는 단순히 IP 주소를 .com, .net 등의 도메인으로 변환해주는 기능을 넘어 컨텐츠 가속(CDN) 서비스, 고가용성(HA) 서비스, 분산 서비스 거부공격(DDoS) 방어 서비스, 통신 구간 암호화 서비스로서 그 용도를 넓혀가고 있다. 이용자들은 이러한 업체가 외부 기관에 정보를 넘기지 않고, 모든 통신 구간은 서비스 업체도 그 내용을 들여다보지 못할 정도로 철저히 암호화한다는 도덕적인 영업과 운영을 할 것으로 기대하지만, 실제 사례를 살펴보면 그렇지 못하다는 점이 드러난다. 본 논문에서는 2021년 기준으로 최소 7년간 이어져온 것으로 추정되는 유명 DNS 서비스 업체의 보안접속 악용 사례를 중심으로 이러한 악용이 어떻게 이루어지고 이것에 대응하기 위해 사용할 수 있는 표준화 기술은 이 문제에 효용성이 있는지를 DNS 업체와 동일한 실제 환경 구성을 통해 검증하였다.

  • PDF

A Secure AIS Protocol Suggestion with Analyses of the Standard AIS Protocol (표준 AIS 프로토콜 분석을 통한 보안 AIS 프로토콜 제안)

  • Lee, Jung-Su;Heo, Ouk;Kim, Jae-Hwan;Chung, Sung-Wook
    • The Journal of Korea Institute of Information, Electronics, and Communication Technology
    • /
    • v.9 no.1
    • /
    • pp.49-57
    • /
    • 2016
  • Recently, marine accidents such as the sinking accident Mongol freighter ship and the sinking accident of Sewol ferry in Jindo continuously happen. In order to decrease the number of these marine accidents, Korean ships are obliged to follow the AIS(Automatic Identification System) system. The AIS protocol includes all information for sailing ships. However, the standard AIS protocol does not provide any security function, In addition, it is possible to hijack the standard AIS protocol in case of using a satellite communication device called FUNcuve Dongle Pro+. Therefore, this paper analyzes weak points of the security in the standard AIS protocol. Furthermore, this paper ensures reliability by marking the MAC Address of sender and receiver for secure communication and suggests the protocol that can securely send data, using the VPN Tunnelling method. Therefore, the suggested AIS protocol provides the secure communication to the AIS protocol and protect the messages in the AIS protocol, which can serve safe voyages by decreasing the marine accidents.

A Study on Jurisdiction under the International Aviation Terrorism Conventions (국제항공테러협약의 관할권 연구)

  • Kim, Han-Taek
    • The Korean Journal of Air & Space Law and Policy
    • /
    • v.24 no.1
    • /
    • pp.59-89
    • /
    • 2009
  • The objectives of the 1963 Tokyo Convention cover a variety of subjects, with the intention of providing safety in aircraft, protection of life and property on board, and promoting the security of civil aviation. These objectives will be treated as follows: first, the unification of rules on jurisdiction; second, the question of filling the gap in jurisdiction; third, the scheme of maintaining law and order on board aircraft; fourth, the protection of persons acting in accordance with the Convention; fifth, the protection of the interests of disembarked persons; sixth, the question of hijacking of aircraft; and finally some general remarks on the objectives of the Convention. The Tokyo Convention mainly deals with general crimes such as murder, violence, robbery on board aircraft rather than aviation terrorism. The Article 11 of the Convention deals with hijacking in a simple way. As far as aviation terrorism is concerned 1970 Hague Convention and 1971 Montreal Convention cover the hijacking and sabotage respectively. The Problem of national jurisdiction over the offence and the offender was as tangled at the Hague and Montreal Convention, as under the Tokyo Convention. Under the Tokyo Convention the prime base of jurisdiction is the law of the flag (Article 3), but concurrent jurisdiction is also allowed on grounds of: territorial principle, active nationality and passive personality principle, security of the state, breach of flight rules, and exercise of jurisdiction necessary for the performance of obligations under multilateral agreements (Article 4). No Criminal jurisdiction exercised in accordance with national law is excluded [Article 3(2)]. However, Article 4 of the Hague Convention(hereafter Hague Article 4) and Article 5 of the Montreal Convention(hereafter Montreal Article 5), dealing with jurisdiction have moved a step further, inasmuch as the opening part of both paragraphs 1 and 2 of the Hague Article 4 and the Montreal Article 5 impose an obligation on all contracting states to take measures to establish jurisdiction over the offence (i.e., to ensure that their law is such that their courts will have jurisdiction to try offender in all the circumstances covered by Hague Article 4 and Montreal Article 5). The state of registration and the state where the aircraft lands with the hijacker still on board will have the most interest, and would be in the best position to prosecute him; the paragraphs 1(a) and (b) of the Hague Article 4 and paragraphs 1(b) and (c) of the Montreal Article 5 deal with it, respectively. However, paragraph 1(b) of the Hague Article 4 and paragraph 1(c) of the Montreal Article 5 do not specify if the aircraft is still under the control of the hijacker or if the hijacker has been overpowered by the aircraft commander, or if the offence has at all occurred in the airspace of the state of landing. The language of the paragraph would probably cover all these cases. The weaknesses of Hague Article 4 and Montreal Article 5 are however, patent. The Jurisdictions of the state of registration, the state of landing, the state of the lessee and the state where the offender is present, are concurrent. No priorities have been fixed despite a proposal to this effect in the Legal Committee and the Diplomatic Conference, and despite the fact that it was pointed out that the difficulty in accepting the Tokyo Convention has been the question of multiple jurisdiction, for the reason that it would be too difficult to determine the priorities. Disputes over the exercise of jurisdiction can be endemic, more so when Article 8(4) of the Hague Convention and the Montreal Convention give every state mentioned in Hague Article 4(1) and Montreal Article 5(1) the right to seek extradition of the offender. A solution to the problem should not have been given up only because it was difficult. Hague Article 4(3) and Montreal Article 5(3) provide that they do not exclude any criminal jurisdiction exercised in accordance with national law. Thus the provisions of the two Conventions create additional obligations on the state, and do not exclude those already existing under national laws. Although the two Conventions do not require a state to establish jurisdiction over, for example, hijacking or sabotage committed by its own nationals in a foreign aircraft anywhere in the world, they do not preclude any contracting state from doing so. However, it has be noted that any jurisdiction established merely under the national law would not make the offence an extraditable one under Article 8 of the Hague and Montreal Convention. As far as international aviation terrorism is concerned 1988 Montreal Protocol and 1991 Convention on Marking of Plastic Explosives for the Purpose of Detention are added. The former deals with airport terrorism and the latter plastic explosives. Compared to the other International Terrorism Conventions, the International Aviation Terrorism Conventions do not have clauses of the passive personality principle. If the International Aviation Terrorism Conventions need to be revised in the future, those clauses containing the passive personality principle have to be inserted for the suppression of the international aviation terrorism more effectively. Article 3 of the 1973 Convention on the Prevention and Punishment of Crimes Against Internationally Protected Persons, Including Diplomatic Agents, Article 5 of the 1979 International Convention against the Taking of Hostages and Article 6 of the 1988 Convention for the Suppression of Unlawful Acts Against the Safety of Maritime Navigation would be models that the revised International Aviation Terrorism Conventions could follow in the future.

  • PDF

A Study on Intensified scheme to WLAN Secure based on IEEE 802.1x Framework (IEEE 802.1x 프레임워크 기반에서의 무선랜 보안 강화 방안에 관한 연구)

  • Lee Joon;Hong Seong-pyo;Shin Myeong-sook
    • Journal of the Korea Institute of Information and Communication Engineering
    • /
    • v.10 no.1
    • /
    • pp.136-141
    • /
    • 2006
  • The IEEE 802.1x can be using various user authentication mechanisms: One-Time Password, Certificate-Based TLS, Challenge/Response and Keberos through EAP(Extended Authentication Protocol). But, IEEE 802.1x also has vulnerabilities about the DoS, the session hijacking and the Man in the Middle attack due to the absence of AP authentication. In this paper, we propose a WLAN secure system which can offer a safety secure communication and a user authentications by intensified the vulnerability of spoofing and DoS attacks. The suppose system offers a safe secure communication because it offers sending message of integrity service and also it prevents DoS attack at authentication initial phase.

Enhancing Security in Mobile IPv6

  • Modares, Hero;Moravejosharieh, Amirhossein;Salleh, Rosli Bin;Lloret, Jaime
    • ETRI Journal
    • /
    • v.36 no.1
    • /
    • pp.51-61
    • /
    • 2014
  • In the Mobile IPv6 (MIPv6) protocol, a mobile node (MN) is a mobile device with a permanent home address (HoA) on its home link. The MN will acquire a care-of address (CoA) when it roams into a foreign link. It then sends a binding update (BU) message to the home agent (HA) and the correspondent node (CN) to inform them of its current CoA so that future data packets destined for its HoA will be forwarded to the CoA. The BU message, however, is vulnerable to different types of security attacks, such as the man-in-the-middle attack, the session hijacking attack, and the denial-of-service attack. The current security protocols in MIPv6 are not able to effectively protect the BU message against these attacks. The private-key-based BU (PKBU) protocol is proposed in this research to overcome the shortcomings of some existing MIPv6 protocols. PKBU incorporates a method to assert the address ownership of the MN, thus allowing the CN to validate that the MN is not a malicious node. The results obtained show that it addresses the security requirements while being able to check the address ownership of the MN. PKBU also incorporates a method to verify the reachability of the MN.

Invader Detection System Using the Morphological Filtering and Difference Images Based on the Max-Valued Edge Detection Algorithm

  • Lee, Jae-Hyun;Kim, Sung-Shin;Kim, Jung-Min
    • Journal of Advanced Marine Engineering and Technology
    • /
    • v.36 no.5
    • /
    • pp.645-661
    • /
    • 2012
  • Recently, pirates are infesting on the sea and they have been hijacking the several vessels for example Samho Dream and Samho Jewelry of Korea. One of the items to reduce the risk is to adopt the invader detection system. If the pirates break in to the ship, the detection system can monitor the pirates and then call the security alarm. The crew can gain time to hide to the safe room and the report can be automatically sent to the control room to cope with the situation. For the invader detection, an unmanned observation system was proposed using the image detection algorithm that extracts the invader image from the recording image. To detect the motion area, the difference value was calculated between the current image and the prior image of the invader, and the 'AND' operator was used in calculated image and edge line. The image noise was reduced based on the morphology operation and then the image was transformed into morphological information. Finally, a neural network model was applied to recognize the invader. In the experimental results, it was confirmed that the proposed approach can improve the performance of the recognition in the invader monitoring system.

Threats of MANPADS and Its Counter-Measures

  • Choi, Jin-Tai
    • International Journal of Contents
    • /
    • v.6 no.3
    • /
    • pp.89-96
    • /
    • 2010
  • The International air transportation industry provides a vital communication link which brings prosperity to many states in our modern age. This invaluable link has been threatened by terrorism. Airlines have been one of the most attractive targets in the eyes of terrorists for several reasons, including particularly the international and symbolic nature of aviation, and the potential of multigovernmental involvement which can inevitably generate wide publicity. Terrorist attacks against civil aviation have been committed since the earliest days of civil aviation history. The first attack against civil aircraft dates back to the early 1930s. Since then, aircraft hijacking and other forms of attack against air transport operations have become one of the most serious challenges to the safety of flying. In recent years, a new form of threats against civil aviation has appeared. Man-portable air defense systems (MANPADS) in the hands of criminals, terrorists, and other non-state actors pose a serious potential threat to passenger air travel, the commercial aviation industry, and military aircraft around the world. The purpose of this study is to provide some countermeasures against such attacks. In order to foster a better understanding of the problem, an introduction of MANPADS and a brief history of attacks using MANPADS are presented. It also examines the level of threats, trends of attacks using MANPADS and the possible countermeasures to be taken by the international community.