초록

용어보기논문에서 용어와 풀이말을 자동 추출한 결과로, 시범 서비스 중입니다. AI-Helper

Abstract ▼ AI-Helper

In this paper, we propose a new malware propagation technique which can spread malicious codes by hooking the function send(), and its countermeasure. The send() is one function of a shared library (DLL) used in network communication. The proposed technique propagates malicious codes by modifying th...

In this paper, we propose a new malware propagation technique which can spread malicious codes by hooking the function send(), and its countermeasure. The send() is one function of a shared library (DLL) used in network communication. The proposed technique propagates malicious codes by modifying the second argument of the send() and inserting the malicious codes whenever the send() is called to transfer executable files or document files. The propagation technique does not require any sort of direct user intervention as well as change the functionality of the files to be sent. In addition, the attacker does not have to calculate the CRC of packets, consider cryptographic protocols, and access directly to the target systems. We have performed some experiments on MS Windows NT/XP and verified that some malicious codes are propagated through all kinds of network applications including web browsers and messengers. As the possible countermeasures against the new mal ware propagation technique, we address the following four methods: the detection of the send function hooking, data integrity verification between network protocol layers, an application-level encryption, and secure binary packing methods.

주제어