English  |  正體中文  |  简体中文  |  Items with full text/Total items : 66984/66984 (100%)
Visitors : 22628791      Online Users : 420
RC Version 7.0 © Powered By DSPACE, MIT. Enhanced by NTU Library IR team.
Scope Tips:
  • please add "double quotation mark" for query phrases to get precise results
  • please goto advance search for comprehansive author search
  • Adv. Search
    HomeLoginUploadHelpAboutAdminister Goto mobile version


    Please use this identifier to cite or link to this item: http://ir.lib.ncu.edu.tw/handle/987654321/68760


    Title: 自動更新的黑暗面: 新型軟體自動更新弱點解決方案;The Dark Side of Auto-Upgrade: Solution of New Auto-Upgrade Weaknesses
    Authors: 江瑞敏;Jiang,Ruei-Min
    Contributors: 資訊工程學系
    Keywords: 自動更新;惡意軟體;殭屍網路;Auto-Upgrade;malware
    Date: 2015-07-23
    Issue Date: 2015-09-23 14:24:41 (UTC+8)
    Publisher: 國立中央大學
    Abstract: 現今越來越多的軟體使用自動更新機制 (Auto-Upgrade Mechanism) 來將軟體更新到最新的版本。雖然自動更新機制為使用者提供一個方便,簡單的方式來更新軟體,但是其安全性的問題鮮少有人在討論。
    在這篇論文中,我們將揭漏自動更新機制背後下存在的一些安全性問題,並根據這些問題提出三種攻擊方法。若攻擊者使用此類的攻擊方法,便可以誘使受害者安裝攻擊者提供的惡意軟體 (Malware),達到擴散惡意軟體的效果亦或者將受害者電腦變成殭屍網路的一員。
    最後,在這篇論文中,我們亦提出了一個防禦機制不僅能有效的防禦此類型的攻擊方法,而且相較於使用HTTPS通訊協定,其對於效能上的衝擊相對而言少了許多
    ;In recent decades, more and more applications use auto-upgrade mechanism to update their own program. Despite the fact that Auto-Upgrade mechanism make upgrade application simple and convenient for the end user, but few people concern about the security vulnerabilities when implementing such mechanism.
    However, recently more and more cases shows up and suggest that the Auto-Upgrade mechanism is not as secure as we think. In this paper we shows that not only Auto-Upgrade mechanism has some critical security weaknesses, but the attacker can also use these security weaknesses to compromise the end users′ system. This kind of attack allows an attacker to install malicious software into victims system without the end user’s awareness.
    Instead of using HTTPS to prevent this kind of attack, in this paper, we also recommended a defense mechanism approach which not only secure the Auto-Upgrade mechanism, but with much lower performance impact compare to HTTPS.
    Appears in Collections:[資訊工程研究所] 博碩士論文

    Files in This Item:

    File Description SizeFormat
    index.html0KbHTML215View/Open


    All items in NCUIR are protected by copyright, with all rights reserved.

    社群 sharing

    ::: Copyright National Central University. | 國立中央大學圖書館版權所有 | 收藏本站 | 設為首頁 | 最佳瀏覽畫面: 1024*768 | 建站日期:8-24-2009 :::
    DSpace Software Copyright © 2002-2004  MIT &  Hewlett-Packard  /   Enhanced by   NTU Library IR team Copyright ©   - Feedback  - 隱私權政策聲明