해킹시연을 통한 스마트기기의 위험성 진단과 대응방안•˜드웨어 해킹 동향.pdfIoT 킹에 대한주제들이등장하기시작함 - The Internet of Fails:
[2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안...
-
Upload
gangseok-lee -
Category
Technology
-
view
1.299 -
download
0
description
Transcript of [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안...
![Page 1: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/1.jpg)
Basic Reversing[+] website hacking & security
Kim seul-gi · CherishCathttp://hack-me.org/
www.CodeEngn.com2013 CodeEngn Conference 08
![Page 2: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/2.jpg)
목 차
• 0x01 소개» CherishCat 소개»Hack-Me.org 사이트 소개
• 0x02 Basic Reversing»기초적인 이야기
• 0x03 재미있게 공부하려면?»How ?
![Page 3: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/3.jpg)
목 차
• 0x04 Reversing 문제풀이» Easy Reverse Engineering
• 0x05 [+] web site 취약점» URL변조 & XSS (+software)
• 0x06 END» Quiz Time» 느낀점? Q&A!» Bye Bye 。
![Page 4: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/4.jpg)
0x01소개
![Page 5: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/5.jpg)
About me
Cherishcat
보안
![Page 6: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/6.jpg)
About me
http://hack-me.org/♥
Register now! : )
![Page 7: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/7.jpg)
About me
Hack-me 는 자신의 해킹실력을 테스트 해 볼 수 있는 사이트입니다 : )
The challenges cover a wide range of subjects: network, cryptography, steganography, forensic, and reverse engineering.
![Page 8: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/8.jpg)
About me
![Page 9: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/9.jpg)
About me
슝슝 올라가요 @.@
![Page 10: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/10.jpg)
0x02Basic Reversing
![Page 11: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/11.jpg)
Basic Reversing
Reverse
+Engineering
= Reverse Engineering
- 시스템의 구조나 기능 분석- 기술적인 원리 분석- 어떻게 작동되는가?
- 악성코드 분석- 안전성 테스트- 개발 효율성 증가
![Page 12: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/12.jpg)
Basic Reversing
CPU동작방식레지스터
AssemblySTACK구조
C언어
PE구조
PackingUnpacking
분석도구사용법
Etc…@_@
리버싱을 공부하기 위한 과정
![Page 13: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/13.jpg)
Basic Reversing
Debugger / Disassembler / File Analyzer / HexEditor
OllyDbg IDA
PEiDWinHex
![Page 14: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/14.jpg)
0x03재미있게 공부하려면?
![Page 15: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/15.jpg)
How to study excitingly
Make EXE by myself
![Page 16: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/16.jpg)
How to study excitingly
http://crackmes.de/users/abex
CrackMe 는 Reverse Engineering 실력 테스트를 위해 만들어진 프로그램 :D
Crack Me = CM
![Page 17: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/17.jpg)
How to study excitingly
http://llove94.blog.me/50110920747
![Page 18: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/18.jpg)
How to study excitingly
Keygenme 는 CrackMe와 비슷하게 Reverse Engineering 테스트를 위해 만들어진 프로그램 :D 다른점은 조금 더 난이도가 있고 [+]로 프로그래밍을 하여
시리얼 도출하는 문제가 많습니다 :D
Keygen Me
![Page 19: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/19.jpg)
How to study excitingly
Keygen source 예시 :)
![Page 20: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/20.jpg)
How to study excitingly
Make EXE by myself
직접 CreckMe를 만들어보자 :D Test 해보자 ! 그리고, 지인들에게 추천추천 :D
![Page 21: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/21.jpg)
0x04hack-me Reversing 문제풀이
![Page 22: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/22.jpg)
Easy Reverse Engineering
![Page 23: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/23.jpg)
Easy Reverse Engineering
![Page 24: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/24.jpg)
Easy Reverse Engineering
![Page 25: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/25.jpg)
Easy Reverse Engineering
![Page 26: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/26.jpg)
Easy Reverse Engineering
![Page 27: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/27.jpg)
Easy Reverse Engineering
![Page 28: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/28.jpg)
Easy Reverse Engineering
![Page 29: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/29.jpg)
Easy Reverse Engineering
![Page 30: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/30.jpg)
Easy Reverse Engineering
XOR(exclusive or)
![Page 31: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/31.jpg)
Easy Reverse Engineering
![Page 32: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/32.jpg)
Easy Reverse Engineering
![Page 33: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/33.jpg)
Easy Reverse Engineering
![Page 34: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/34.jpg)
Easy Reverse Engineering
![Page 35: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/35.jpg)
0x05web site 취약점 (+software)
![Page 36: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/36.jpg)
Web site URL Hacking
![Page 37: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/37.jpg)
Web site URL Hacking
![Page 38: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/38.jpg)
Web site URL Hacking
![Page 39: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/39.jpg)
Web site URL Hacking
![Page 40: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/40.jpg)
Web site URL Hacking
![Page 41: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/41.jpg)
Web site URL Hacking
![Page 42: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/42.jpg)
Web site URL Hacking
![Page 43: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/43.jpg)
Web site URL Hacking
내 비밀이들키다니
![Page 44: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/44.jpg)
Web site URL Hacking
휴대폰 번호와메일 등 개인정
보를 입력
신상정보 및개인의 민감한상담내용 포함
정보를 이용한2차 범죄 가능
![Page 45: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/45.jpg)
Web site URL Hacking
전국 40개 사이트 무작위 실험
취약
28%
7개 사이트 취약
![Page 46: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/46.jpg)
Web site URL Hacking
28%
보안에 취약한 구식 웹 게시판을 이용
주소창 암호화 X알기 쉬운 형식 NO
새로운 버젼 웹 게시판 사용
![Page 47: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/47.jpg)
Web site XSS Hacking
![Page 48: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/48.jpg)
Web site XSS Hacking
![Page 49: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/49.jpg)
Web site XSS Hacking
![Page 50: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/50.jpg)
Web site XSS Hacking
![Page 51: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/51.jpg)
Web site XSS Hacking
걸ㅋ림ㅋ?
![Page 52: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/52.jpg)
Web site XSS Hacking
![Page 53: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/53.jpg)
Web site XSS Hacking
![Page 54: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/54.jpg)
Web site XSS Hacking
취약하니까 태그입력을 막아놓음
문제가 해결되는 건 아님
복사해서 갖다 붙이면 가능하기 때문
![Page 55: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/55.jpg)
Web site XSS Hacking
많은 웹사이트에서 노출될 것으로 예상
필터링 & 붙여넣기 NO100%는 아니더라도 99.9%
![Page 56: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/56.jpg)
Software : Anti-Virus
자가보호란?무결성이 유지되어야 하는안티바이러스가 자신이 사용하는 파일,레지스트리,프로세스,서비스,커널객체(이벤트,뮤텍스,네임드 파이프,메일 슬롯,공유
메모리) 등을 외부에서 접근하는 것을 관리 또는 차단하는 것을 의미합니다
![Page 57: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/57.jpg)
Software : Anti-Virus
커널객체보호
프로세스보호
![Page 58: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/58.jpg)
Software : Anti-Virus
![Page 59: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/59.jpg)
Software : Anti-Virus
나 사실바이러스임
>ㅅ<
![Page 60: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/60.jpg)
Software : Anti-Virus
![Page 61: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/61.jpg)
. 0x06 .E.N.D
![Page 62: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/62.jpg)
. . .
발표 잘 들으셨나요?
\( ^ ω ^ )/
발표 잘 들으셨나요?
\( ^ ω ^ )/
![Page 63: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/63.jpg)
![Page 64: [2013 CodeEngn Conference 08] CherishCat - 각종 취약점과 대응방안 & 해킹, 보안 문제풀이](https://reader034.fdocuments.net/reader034/viewer/2022050921/553891a24a795979798b476a/html5/thumbnails/64.jpg)
감사합니다. www.CodeEngn.com2013 CodeEngn Conference 08