• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.42 no.4
• /
• pp.785-790
• /
• 2017

Network scanning tools typically use port scans to steal information from network terminals and identify vulnerabilities. In particular, Shodan and Censys use a network scanning tool to gather a wide range of terminal information, store it in their database and provide it to the users. In order to prevent such information gathering, it is required to know the scanning methods of Shodan and Censys. However, the scanning model used by Shodan and Censys is not known exactly. Therefore, this paper estimates scanning models of Shodan and Censys and analyzes the performance of each models.

• The Journal of the Korea Contents Association
• /
• v.16 no.9
• /
• pp.329-338
• /
• 2016

Internet of Things (IoTs) technology makes every things in physical world being digitalized and communicated with each other. The technology is emerging as a new paradigm and is expected to provide a convenient and effective life. However, for the successful realization of the IoT technologies, IoT security issues are an important prerequisite, and particularly the privacy protection is expected to become more important in view of object communication directively related with human. In this paper we describe for the security and privacy threats in IoT environment and introduce the shodan (a legitimate search engine that finds backdoor routers, switches, webcams, IoT devices connected to the Internet etc.) that can expose the security and privacy problems. Lastly, we compare the privacy threats through real-world case study of network cameras currently in use and finally derive the countermeasures for the threats.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2019.10a
• /
• pp.405-406
• /
• 2019

ICS 해커들의 주요 목적은 재정적 이득, 기업간첩, 테러리스트 활동, 국가간의 사이버전쟁, 잘못된 윤리적 해킹 등의 이유들이 있다. 이에 따른 해킹 경로로는 산업제어 시스템이 공용 인터넷에 노출되는 경우, 기기 초기 설정을 방치, 장기간의 비밀번호 미 변경, 포트스캐닝, 구글 해킹 등이 있다. 이에 따른 대표적인 해킹방식 5 가지가 있는데 첫째, Shodan 을 이용한 일종의 검색해킹, 둘째, ZAP 툴을 이용하여 전수공격을 하는 패스워드 퍼징, 셋째, 목표 사이트의 취약점을 이용하여 인증을 우회하는 공격인 SQL Injection, 넷째, Modbus 툴을 이용한 해당 시설의 전압을 변경하는 네트워크 공격, 다섯째, zbgoodfind 툴을 통한 원격장치공격이 있다.

• Journal of the Korea Society of Computer and Information
• /
• v.24 no.1
• /
• pp.107-113
• /
• 2019

Along with the development of IOT, the number of people using IOT devices has enormously increased and the IOT era has come. Especially, people using the IP cameras among Internet devices have been drastically increasing. It is because the IP cameras are well networked and comparatively cheap compared with CCTVs, and they can also be monitored and controlled in real time through PCs and smart phones for the purposes of general theft prevention and shop surveillance. However, due to the user's serious lack of security awareness and the fact that anyone can easily hack only with simple hacking tools and hacking sites information, security crimes that exploit those have been increasing as well. Therefore, this paper describes how easily the IP cameras can be hacked in the era of IOT, what kind of security incidents occurred, and also suggests possible government measures and new technical solutions to those problems.

• The Transactions of The Korean Institute of Electrical Engineers
• /
• v.65 no.1
• /
• pp.128-134
• /
• 2016

IoT devices including smart devices are connected with internet, thus they have security threats everytime. Particularly, IoT devices are composed of low performance MCU and small-capacity memory because they are miniaturized, so they are likely to be exposed to various security threats like DoS attacks. In addition, in case of IoT devices installed for a remote place, it's not easy for users to control continuously them and to install immediately security patch for them. For most of IoT devices connected directly with internet under user's intention, devices exposed to outside by setting IoT gateway, and devices exposed to outside by the DMZ function or Port Forwarding function of router, specific protocol for IoT services was used and the devices show a response when services about related protocol are required from outside. From internet search engine for IoT devices, IP addresses are inspected on the basis of protocol mainly used for IoT devices and then IP addresses showing a response are maintained as database, so that users can utilize related information. Specially, IoT devices using HTTP and HTTPS protocol, which are used at usual web server, are easily searched at usual search engines like Google as well as search engine for the sole IoT devices. Ill-intentioned attackers get the IP addresses of vulnerable devices from search engine and try to attack the devices. The purpose of this study is to find the problems arisen when HTTP, HTTPS, CoAP, SOAP, and RestFUL protocols used for IoT devices are detected by search engine and are maintained as database, and to seek the solution for the problems. In particular, when the user ID and password of IoT devices set by manufacturing factory are still same or the already known vulnerabilities of IoT devices are not patched, the dangerousness of the IoT devices and its related solution were found in this study.

• Journal of architectural history
• /
• v.8 no.4 s.21
• /
• pp.95-112
• /
• 1999

This Study starts from a recognition that the architecture is based on the process demanded by substantial needs as well as pure theoretical logic system. So this study aims at proposing another point of view differentiating process and principle of architecture from pure theoretical logic system in the creative process of the Governor's Palace by analyzing drawings in chronological order. Even though the Governor's Palace had not been built because of discord between authorities of India and Le Corbusier, it is undoubtedly one of the best proposals which contains very concepts and ideas of later Le Corbusier's architectural intentions. In the first design stage, overall conception of the building was carried out in the sketches and drawings till Jan, 1954 and in the second stage, the elaboration of the project was pursued till Mar. 1995. The scheme tends to begin too large and general in character, becoming tighter and more complex under pressure from the client and adjustments required by the design process itself. For example, scale reduction, division and development of internal circulation system and applying his early 'Five Points'. So new solutions are searched by oscillating between compromise modifications and radically different solutions in contracting the first ideas. From all these, it is concluded that the early doctrine (Five Points) are adjusted and extended towards another stage by the use of restricted pilotis, the concept of fenetre en longueur transformed into a sub stricture of facade, sustained concept of le plan libre, les toits jardins extended towards concept of the urban area. And these formal intentions of the Governor's Place has been carried through other contemporary projects like Mill Owner's Association in 1954 and Villa Shodan in 1952.

• The Journal of the Korea Contents Association
• /
• v.21 no.1
• /
• pp.284-291
• /
• 2021

As the current security monitoring system is operated as a passive system only for response after an attacker's attack, it is common to respond to intrusion incidents after an attack occurs. In particular, when new assets are added and actual services are performed, there is a limit to vulnerability testing and pre-defense from the point of view of an actual hacker. In this paper, a new security monitoring model has been proposed that uses multiple hacking-related search engines to add proactive vulnerability response functions of protected assets. In other words, using multiple search engines with general purpose or special purpose, special vulnerabilities of the assets to be protected are checked in advance, and the vulnerabilities of the assets that have appeared as a result of the check are removed in advance. In addition, the function of pre-checking the objective attack vulnerabilities of the protected assets recognized from the point of view of the actual hacker, and the function of discovering and removing a wide range of system-related vulnerabilities located in the IP band in advance were additionally presented.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.5
• /
• pp.721-736
• /
• 2023

The Command and Control Framework was developed for penetration testing and education purposes, but threat actors such as cybercrime groups are abusing it. From a cyber threat hunting perspective, identifying Command and Control Framework servers as well as proactive responding such as blocking the server can contribute to risk management. Therefore, this paper proposes a methodology for tracking the Command and Control Framework in advance. The methodology consists of four steps: collecting a list of Command and Control Framework-related server, emulating staged delivery, extracting botnet configurations, and collecting certificates that feature is going to be extracted. Additionally, experiments are conducted by applying the proposed methodology to Cobalt Strike, a commercial Command and Control Framework. Collected beacons and certificate from the experiments are shared to establish a cyber threat response basis that could be caused from the Command and Control Framework.