블록체인 소프트웨어의 취약점을 이용한 OS 커맨드 인젝션 공격에 대한 연구 = Analysis of Blockchain Software Vulnerability against OS Command Injection Attack

다국어 초록 (Multilingual Abstract)

Blockchain has been developed as a key technology for many cryptocurrency systems such as Bitcoin. These days,blockchain technology attracts many people to adopt it to various fields beyond cryptocurrency systems for their informationsharing and processing. However, with the development and increasing adoption of the blockchain, security incidentsfrequently happen in the blockchain systems due to their implementation flaws. In order to solve this problem, in this paper,we analyze the software vulnerabilities of Bitcoin and Ethereum, which are the most widely used blockchain applications inreal world. For that purpose, we conduct an in-depth analysis of source code of them to detect software vulnerabilities, andexamine an OS command injection attack exploiting the detected ones.

국문 초록 (Abstract)

블록체인 기술은 비트코인과 함께 알려졌으며, 급진적인 암호화폐의 성장과 함께 주요 기술로 인식되었다. 블록체인을 활용하기 위한 노력은 다양한 분야에서 이어지고 있으며 지속해서 발전하고 있다. 하지만 블록체인의 발전과함께 블록체인을 위협하는 보안사고도 증가하고 있다. 이러한 문제를 해결하기 위해 블록체인의 다양한 보안 위협중 블록체인 소프트웨어의 구현상 문제점을 분석하겠다. 본 논문에서는 블록체인 소프트웨어 중 오픈소스로 개발되는 암호화폐를 보안 관점에서 바라보며 소스코드에 존재하는 취약점을 분석하고, 취약점을 이용한 OS 커맨드 인젝션 공격에 대해 알아보겠다.

참고문헌 (Reference)

1 김병국, "오픈 소스의 소프트웨어 보안 문제 및 시큐어 코딩 적용방안" 한국정보과학회 23 (23): 487-491, 2017

2 Barkly, "Wannacry attacks"

3 Skybox Security, "Vulnerability and threat trends analysis of current vulnerabilities, exploits and threats in play"

4 W. Richard Stevens, "UNIX network programming, volume 2, second edition:interprocess communications" Prentice Hall 1999

5 CoinMarketCap, "Top 100 cryptocurre ncies by market capitalization"

6 IBM, "System()"

7 A. Gosain, "Static analysis:a survey of techniques and tools" Springer 2015

8 CWE, "Software weakness"

9 Micro Focus, "Securing your enterprise software : security fortify static code analyzer"

10 RedHat, "Red hat product security risk report: 2015" 2016

11 IBM, "Popen"

12 OWASP, "OS command injection defense cheat sheet"

13 CWE, "OS command injection"

14 Gartner, "Magic quadrant for application security testing"

15 Microsoft, "Interprocess communications"

16 Alfred J. Menezes, "Handbook of applied cryptography" CRC Press 1996

17 NIST, "Digital signature standard(DS S)"

18 Synopsys, "Coverity releases security spotlight report on critical security defects in open source projects"

19 "CWSS"

20 CWE, "CWE/SANS Top 25 Most Dan-g erous Software Errors"

21 Financial Security Institute, "Blockchain application technology development and industry-specific implementation" Financial Security Institute 2017

22 Y. Kim, "BlockChain issue"

23 Bitcoin, "Bitcoin: a peer-to-peer electronic cash system"

24 GitHub, "Bitcoin core project"

25 Bitcoin, "Bitcoin core api"

26 Bitcoin, "Bitcoin configuration file"

27 GNU, "Bash reference manual"

28 M. Niranjanamurthy, "Analysis of blockchain technology : pros, cons and SWOT" 1-15, 2018

29 Xiaoqi Li, "A survey on the security of blockchain systems" 2017

30 R. L. Rivest, "A method for obtaining digital signatures and public-key cryptosystems" 21 (21): 120-126, 1978