This presentation is briefly describing trends of security

1. Cyber Security
IoT Security
Trend Briefs of Security
th!nkh@ck-hackartist
cafe.thinkhack.org
September 13, 2014
th!nkh@ck-hackartist Trend Briefs of Security

2. Cyber Security
IoT Security
1 Cyber Security
Exploitation
Web Security
Reversing
2 IoT Security
IoT Architecture
IoT Platform
IoT Device
th!nkh@ck-hackartist Trend Briefs of Security

3. Cyber Security
IoT Security
Exploitation
Web Security
Reversing
Buer Over
ow
Buer Over
ow €?
T¨¬ üÐ $X| t©Xì XÄ T¨¬ õt DÌ óÐ pt0|
½…X” õ©
Buer Over
owX …X
Stack Over
ow
Heap Over
ow
Buer Over
ow ¥ TÜ
#include stdio.h
int main(int argc, char **argv)
f
char buf[8];
gets(buf);
printf(%snn, buf);
return 0;
g
th!nkh@ck-hackartist Trend Briefs of Security

4. Cyber Security
IoT Security
Exploitation
Web Security
Reversing
Shellcode
Shellcode € 4Çx?
ShellD )Xì …9´| ä‰Ü¤” TÜ
Shellcode ‘ )•
´H¬ TÜ ‘1
0Ä´ ÀX
XTÜ ‘1
Shellcode X : BSD setuid/execve
nx31nxc0nx50nx50nxb0nx17nxcdnx80
nx31nxc0nx50nx68//shnx68/binnx89nxe3nx50 nx54nx53nx50nxb0nx3bnxcdnx80
th!nkh@ck-hackartist Trend Briefs of Security

5. Cyber Security
IoT Security
Exploitation
Web Security
Reversing
Protection of Buer Over
ow
Buer Over
ow Q0•
H |t

6. ì¬ ¬©
Stack Protection
LibSafe
StackGuard
ProPolice
DEP
Pointer Protection
PointGuard
Executable space protection
PaX
BuerShield
Address Space Layout Randomization
Depp Packet Inspection
th!nkh@ck-hackartist Trend Briefs of Security

7. Cyber Security
IoT Security
Exploitation
Web Security
Reversing
Bypassing BoF Protection
Brute Force
Canary Ð t ¬©
ROP õ©
ASLR, DEP/NX, ASCII-Armor protectionÐ t ¬©
RTL, Chaining RTL, GOT 0•t ˆL
th!nkh@ck-hackartist Trend Briefs of Security

8. Cyber Security
IoT Security
Exploitation
Web Security
Reversing
SQL Injection
SQL Injection t€?
ù

9. |ø0X „XX SQL TÜ| ½…Xì õ©D ‰
SQL InjectionX …X
Form Injection
Blind Injection
Cookie Injection
Union Injection
SQL Injection ‰Ü SQL ü¬X
Áü¬ : SELECT * FROM members WHERE uid='admin' and upw='xxx';
õ©ü¬ : SELECT * FROM members WHERE uid=or '1'='1' and upw= or
'1'='1';
th!nkh@ck-hackartist Trend Briefs of Security

10. Cyber Security
IoT Security
Exploitation
Web Security
Reversing
XSS
XSS €?
Cross Site Scripting }´ CSS|àÄ €tÀÌ, Cascading Style Sheet @
Ù´ XSS ü ˆ¼. ùÐ HTMLÜø| „X ½…Xì T| ‰X”
õ©. |” ¬©X Cookie| ÈèX” ƒD ©h
XSS õ©X
Re
ective XSS
Stored XSS
XSS õ©X
scriptalert(document.cookie);/script
th!nkh@ck-hackartist Trend Briefs of Security

11. Cyber Security
IoT Security
Exploitation
Web Security
Reversing
CSRF
CSRF €?
Cross Site Request Forgery X }´tp, HTTP Request| ÀpX” õ©
CSRF õ©
a href=http://localhost/admin/chpw.php?pw=1234Go to localhost/a
Q)•
GET TŒÜôä” POST TŒÜ| ¬©
” ô À½ÜД 2( € ‰
th!nkh@ck-hackartist Trend Briefs of Security

12. Cyber Security
IoT Security
Exploitation
Web Security
Reversing
Dynamic Analysis
Dynamic Analysis €?
ø¨D ä‰Xì T¨¬Ð ) ÁÜÐ „D ‰X” ƒ
¥
Packing D à$XÀ JDÄ (
Ù‘X” üD äÜ ¨È0Á ` ˆL
Dynamic AnalysisÐ ü ¬©X” 4
Virtualization, Sandbox 4
Ollydbg, imunity debugger, windbg ñ
th!nkh@ck-hackartist Trend Briefs of Security

13. Cyber Security
IoT Security
Exploitation
Web Security
Reversing
Static Analysis
Static Analysis €?
ø¨D ä‰XÀ Jà „X” )•
¥
Sandbox DӮL
Anti-DebuggingÐ x¬À JL
ô

14. | ¥
Static AnalysisÐ ü ¬©X” 4
IDA, objdump
th!nkh@ck-hackartist Trend Briefs of Security

15. Cyber Security
IoT Security
IoT Architecture
IoT Platform
IoT Device
IoT Architecture
œ˜ : http://www.magic.ubc.ca/wiki/uploads/Projects/IoTportal2.png
th!nkh@ck-hackartist Trend Briefs of Security

16. Cyber Security
IoT Security
IoT Architecture
IoT Platform
IoT Device
IoT Platform Security
¬© x x
IoT ¬©äÐ t x
¬© Ä ´ ¥ t¤Ð ü´
MAC,DAC, Non-DAC, RBAC ñ” Ä ˆL. CapBACt ˜TÀÌ,
ìˆ ììÀ tˆ ˆ´ t°t|h.
Privacy
IoT” User-Friendly X½ ¬©X ô| Ît xœh
Ept0Ð |t„Ü| ô8` ˆ” )• D”
ììÀ 0•t Hà ˆÀÌ, 1¥ÁX 8 ˆL.
DDoS
High-rate DoS õ©@ 0ø xœ´ ˆL
Low-rate DoS õ©Ä à$Xì| h
Load-Balancing à$t|h
th!nkh@ck-hackartist Trend Briefs of Security

17. Cyber Security
IoT Security
IoT Architecture
IoT Platform
IoT Device
IoT Device Security
Device Authentication
Device to Device xD à$t| h
| Serial 0X xD ü ¬©Xà ˆÀÌ, Ä ˆL
Certi

18. cate 0X xD õt| h
SAML, SOAP ñD ü t©Xà ˆÀÌ, Ä ˆL
Device Certi

19. cate x X D”h
Device Access Control
DeviceÐ Access ControlD ‰X0 t” ½ÉT ´| h
MAC, DAC, RBAC ñX 0tX ü´” IoT X½Ð Ä Ý@
CapBACt tˆ à ˆÀÌ, IoT X½D Dˆ XÀ »Xà ˆL
ABE0X ü´ 0•Ð äÈ ðl D”h
th!nkh@ck-hackartist Trend Briefs of Security