공용 무선공유기 비밀번호 선정 방식의 위험성 분석

다국어 초록 (Multilingual Abstract)

In wireless network environments with wireless access points, many vulnerabilities and attack methods are reported due to easy access, and real damage cases have been reported. The purpose of this study figures out the risk of the password selection for public wireless access points. For the purpose, we surveyed the previous researches on attacks of the wireless network system, protocols, and password-based authentication, and the problem of the user password selection also. We conducted a case study to figure out the risk for wireless access points, and proposed a guessing method with fewer than 20 attempts through the analysis of the current passwords. It is shown that the password of most public wireless access points in the other region can be easily guessed. In addition, we emphasized the risk of the way of choosing passwords by presenting an additional security threat scenario when the passwords are exposed.

참고문헌 (Reference)

1 김경훈, "국내 웹 사이트 패스워드 미터 분석" 한국정보보호학회 26 (26): 757-767, 2016

2 T. Karygiannis, "Wireless network security : 802. 11, bluetooth and handheld devices. 2002" National Institute of Standards and Technology 2009

3 A. Das, "The Tangled Web of Password Reuse" 14 : 23-26, 2014

4 S. W. Na, "Study on efficient expansion strategy of Wi-Fi" 30 (30): 3-12, 2013

5 H. C. Jung, "Study on Security Reinforcement Method by Wireless Security Status Survey and Analysis" 13 (13): 2006

6 I. P. Mavridis, "Real-life paradigms of wireless network security attacks" 112-116, 2011

7 G. R. Begh, "Quantification of the effect of security on performance in wireless LANs" 57-62, 2009

8 E. Tews, "Practical attacks against WEP and WPA" 79-86, 2009

9 M. Weir, "Password cracking using probabilistic contextfree grammars" 391-405, 2009

10 S. Gaw, "Password Management Strategies for Online Accounts" Usenix, ACM 44-55, 2006

11 R. Veras, "On the Semantic Patterns of Passwords and their Security Impact" 2014

12 S. Komanduri, "Of Passwords and People : Measuring the Effect of Password-Composition Policies" 2595-2604, 2011

13 Mediadot Corp, "Mediadot Corp."

14 "Mediadot Corp."

15 "Leaked Password Lists, Skullsecurity"

16 "John the ripper password cracker"

17 B. Ur, "I added ‘!’ at the End to Make It Secure" : Observing Password Creation in the Lab" 123-140, 2015

18 "Hashcat"

19 K. Scarfone, "Guide to Enterprise Password Management" NIST Special Publication 800-118, 2009

20 KISA, "Guide for selecting and using passwords"

21 P. G. Kelley, "Guess again(and again and again) : Measuring password strength by simulating passwordcracking algorithms" 523-537, 2012

22 "Financial Supervisory Service"

23 A. Narayanan, "Fast dictionary attacks on passwords using time-space tradeoff" 364-372, 2005

24 "Dropbox TechBlog, zxcvbn: realistic password strength estimation"

25 J. H. Baek, "Domestic wireless LAN(WiFi)security management and policy guidelines" 21 (21): 44-50, 2011

26 K. M. Lee, "DoS attack scenario through wireless router firmware vulnerability" 75-77, 2015

27 H. J. Yoon, "Development of Mobile Apps for Checking Web Security Configurations of Wireless Access Points" 24 (24): 101-102, 2016

28 W. H. Jeong, "Detecting and responding to security attacks on wireless routers" 33 (33): 87-93, 2016

29 C. H. Son, "Analysis and Countermeasures of Security Vulnerabilities in Wireless Routers" 1193-1194, 2015

30 C. Castelluccia, "Adaptive Password-Strength Meters from Markov Models" 2012

31 J. Ma, "A study of probabilistic password models" 689-704, 2014

32 D. Yin, "A research into the latent danger of WLAN" 1085-1090, 2011

33 D. J. Ryu, "A Study on the vulnerability and analysis in the Wireless IoT Environments" 1093-1094, 2016

34 D. Florencio, "A Large-Scale Study of Web Password Habits" 657-666, 2007