檢測基於惡意使用圖像標籤的 MIME類型混淆攻擊;Detecting MIME Type Confusion Attacks Based on Malicious Use of Image Tags

NCU Institutional Repository > 資訊電機學院 > 資訊工程研究所 > 博碩士論文 > Item 987654321/92511

jsp.display-item.identifier=請使用永久網址來引用或連結此文件: http://ir.lib.ncu.edu.tw/handle/987654321/92511

题名:	檢測基於惡意使用圖像標籤的 MIME類型混淆攻擊;Detecting MIME Type Confusion Attacks Based on Malicious Use of Image Tags
作者:	葉峻羲;YEH, CHUN-HSI
贡献者:	資訊工程學系
关键词:	MIME 類型混淆攻擊;圖片標籤;MIME;img;html
日期:	2023-07-17
上传时间:	2023-10-04 16:03:33 (UTC+8)
出版者:	國立中央大學
摘要:	圖片是現今大多數的網站上不可或缺的一項元素，對於文字無法說明的部分，圖片是一種能夠輔助說明的媒介，在任何能夠讓使用者交流的網站，大多都允許使用者發布圖片，這就具有被駭客利在在網路攻擊上的可能性。因其廣泛性與重要性，許多網站都不會去禁止 img tag 的使用，使得基於圖片的多用途網際網路郵件擴展類型混淆攻擊(Multipurpose Internet Mail Extensions(MIME) Type Confusion attack)變得相當重要。多用途網際網路郵件擴展類型混淆攻擊是駭客利用瀏覽器會使用 MIME-Type sniffing 檢測正確的檔案類型這一特徵，而發展出來的攻擊。早期的瀏覽器開始導入 MIME-Type sniffing 功能的原因，是用來防止伺服器給出錯誤的檔案格式，而讓瀏覽器使用錯誤的處理方式解釋接收到的資源。而這卻被駭客利用偽裝檔案類型的方式，讓瀏覽器在未經使用者同意的情況下導致跨網站腳本攻擊 (Coss-Site Scripting(XSS) attack)。或者使用者的個人訊息透過惡意的網絡信標(Web Beacon)，導致使用者的隱私遭到洩漏。本論文提出一種方法，針對任何應當是圖片類型的資源，在瀏覽器向伺服器請求資源之前，就正確的辨認和解釋會從伺服器傳遞的檔案類型，並透過實作成瀏覽器插件的形式，以即時動態分析的方式，預先阻擋任何可疑的請求，以阻斷 MIME Type Confusion attack 的攻擊途徑。;Images are an indispensable element on most websites today. For parts that cannot be explained by text, pictures are a medium that can assist in explanation. Most of the websites that allow users to communicate, allow users to post pictures. This has the possibility of being exploited by hackers in attacks. Because of its extensiveness and importance, many websites will not prohibit the use of img tag, making image-based Multipurpose Internet Mail Extensions (MIME) Type Confusion attack (Multipurpose Internet Mail Extensions (MIME) Type Confusion attack) very important. The MIME type confusion attack is an attack developed by hackers to take advantage of the fact that browsers use MIME sniffing to detect the correct file type. The reason why early browsers started importing MIME-Type sniffing was to prevent the server from giving the wrong file format and let the browser interpret the received resource in the wrong way. However, hackers use the method of disguising the file type to allow the browser to cause a cross-site scripting attack (Coss-Site Scripting (XSS) attack) without the consent of the user. Forgery (CSRF) attack). Or the user′s personal information is transmitted through a malicious web beacon (Web Beacon), causing the user′s privacy to be leaked. This paper proposes a method to correctly identify and explain the file type that will be transmitted from the server before the browser requests the resource from the server for any resource that should be an image type, and implement it in the form of a browser plug-in. By means of real-time dynamic analysis, any suspicious request is blocked in advance to block the attack path of MIME Type Confusion attack.
显示于类别:	[資訊工程研究所] 博碩士論文

文件中的档案:

档案	描述	大小	格式	浏览次数
index.html		0Kb	HTML	37	检视/开启

在NCUIR中所有的数据项都受到原著作权保护.

社群 sharing

数据加载中.....