博碩士論文 101522066 詳細資訊




以作者查詢圖書館館藏 以作者查詢臺灣博碩士 以作者查詢全國書目 勘誤回報 、線上人數:11 、訪客IP:3.80.218.53
姓名 江瑞敏(Ruei-Min Jiang)  查詢紙本館藏   畢業系所 資訊工程學系
論文名稱 自動更新的黑暗面: 新型軟體自動更新弱點解決方案
(The Dark Side of Auto-Upgrade: Solution of New Auto-Upgrade Weaknesses)
相關論文
★ USB WORM KILLER: Cure USB Flash Worms Through a USB Flash Worm★ Discoverer- Rootkit即時偵測系統
★ 一項Android手機上詐騙簡訊的偵測與防禦機制★ SRA系統防禦ARP欺騙劫持路由器
★ 針對遠端緩衝區溢位攻擊之自動化即時反擊系統★ 即時血清系統: 具攻性防壁之自動化蠕蟲治癒系統
★ DNSPD: Entrap Botnets Through DNS Cache Poisoning Detection★ TransSQL: A Translation and Validation-based Solution for SQL-Injection Attacks
★ A Spam Mail-based Solution for Botnet Detection and Network Bandwidth Protection★ Shark: Phishing Information Recycling from Spam Mails
★ FFRTD: Beat Fast-Flux by Response Time Differences★ Antivirus Software Shield against Antivirus Terminators
★ MAC-YURI : My ACcount, YoUr ResponsIbility★ KKBB: Kernel Keylogger Bye-Bye
★ CIDP Treatment: An Innovative Mobile Botnet Covert Channel based on Caller IDs with P8 Treatment★ PrivacyGuard:A Kernel-based Solution to Enhance the User Privacy When Using Private Browsing
檔案 [Endnote RIS 格式]    [Bibtex 格式]    [相關文章]   [文章引用]   [完整記錄]   [館藏目錄]   至系統瀏覽論文 (2020-6-30以後開放)
摘要(中) 現今越來越多的軟體使用自動更新機制 (Auto-Upgrade Mechanism) 來將軟體更新到最新的版本。雖然自動更新機制為使用者提供一個方便,簡單的方式來更新軟體,但是其安全性的問題鮮少有人在討論。
在這篇論文中,我們將揭漏自動更新機制背後下存在的一些安全性問題,並根據這些問題提出三種攻擊方法。若攻擊者使用此類的攻擊方法,便可以誘使受害者安裝攻擊者提供的惡意軟體 (Malware),達到擴散惡意軟體的效果亦或者將受害者電腦變成殭屍網路的一員。
最後,在這篇論文中,我們亦提出了一個防禦機制不僅能有效的防禦此類型的攻擊方法,而且相較於使用HTTPS通訊協定,其對於效能上的衝擊相對而言少了許多
摘要(英) In recent decades, more and more applications use auto-upgrade mechanism to update their own program. Despite the fact that Auto-Upgrade mechanism make upgrade application simple and convenient for the end user, but few people concern about the security vulnerabilities when implementing such mechanism.
However, recently more and more cases shows up and suggest that the Auto-Upgrade mechanism is not as secure as we think. In this paper we shows that not only Auto-Upgrade mechanism has some critical security weaknesses, but the attacker can also use these security weaknesses to compromise the end users′ system. This kind of attack allows an attacker to install malicious software into victims system without the end user’s awareness.
Instead of using HTTPS to prevent this kind of attack, in this paper, we also recommended a defense mechanism approach which not only secure the Auto-Upgrade mechanism, but with much lower performance impact compare to HTTPS.
關鍵字(中) ★ 自動更新
★ 惡意軟體
★ 殭屍網路
關鍵字(英) ★ Auto-Upgrade
★ malware
論文目次 中文摘要 ii
Abstract iii
I. Introduction: 1
1.1 Methods to Upgrading Applications: 1
1.2 The Dark Side of Auto-Upgrade: 4
1.3 Paper Organization: 6
II. Background Knowledge: 7
2.1 SSL/TLS Protocol: 7
2.2 X509 Certificate Standard: 10
2.3 Windows Authenticode Portable Executable Signature Format: 12
III. Auto-Upgrade Mechanism: 15
3.1 Terminologies of Auto-Upgrade Process: 16
3.2 Auto-Upgrade Models Categorization Factors: 18
3.3 Auto-Upgrade Implementation Models: 23
IV. The Dark Side of Auto-Upgrade: 26
4.1 Security Weaknesses and Vulnerability: 26
4.2 Attacks against Auto-Upgrade: 30
V. Defense Recommendation: 36
5.1 Secure Auto-Upgrade Channel: 37
5.2 Integrity and Identification Verification of Upgrade Manifest: 39
VI. Evaluation: 44
6.1 Environment Setup: 44
6.2 Real World Cases: 45
VII. Conclusion: 46
Reference: 47
參考文獻 [1] Jared Newman. (2012, May 13). The Flame Virus: Your FAQs
Answered [Online]. Available:
http://www.pcworld.com/article/256508/the_flame_virus_your_faqs_answered.html
[2] Alexander Gostev. (2012, May 28). The Flame: Questions and Answers [Online]. Available:
https://securelist.com/blog/incidents/34344/the-flame-questions-and-answers-51/
[3] Lance Whitney. (2012, June 5). Flame Virus Can Hijack PCs by Spoofing Windows Update [Online]. Available:
http://www.cnet.com/news/flame-virus-can-hijack-pcs-by-spoofing-windows-update/
[4] Symantec Security Response. (2012, June 4). W32.Flamer: Microsoft Windows Update Man in the Middle [Online]. Available: http://www.symantec.com/connect/blogs/w32flamer-microsoft-windows-update-man-middle
[5] Lance Whitney. (2012, June, 4). Flame virus spread through rogue Microsoft security certificates [Online]. Available:
http://www.cnet.com/news/flame-virus-spread-through-rogue-microsoft-security-certificates/
[6] Patrick Barker. (2015, June 26). Samsung Deliberately Disabling Windows Update the Way the User Intends it to [Online]. Available:
http://bsodanalysis.blogspot.co.uk/2015/06/samsung-deliberately-disabling-windows.html
[7] Dan Seifert. (2015, June 26). Samsung to stop disabling Windows Update in ‘a few days’ [Online]. Available:
http://www.theverge.com/2015/6/26/8854761/samsung-to-stop-disabling-windows-update-in-a-few-days
[8] Vlad Savov. (2015, June 25). Samsung angers Microsoft by disabling Windows Update on some of its computers [Online]. Available:
http://www.theverge.com/2015/6/25/8844819/samsung-disable-windows-update-exe
[9] Emil Protalinski. (2015, June 26). Samsung will patch its software to stop disabling Windows Update ‘within a few days’ [Online]. Available:
http://venturebeat.com/2015/06/26/samsung-will-patch-its-software-to-stop-disabling-windows-update-within-a-few-days/
[10] The Internet Engineering Task Force, RFC 5246, 2008
[11] William Stallings, “Key Management and Distribution,” in Cryptography and Network Security Principles and Practice, 5th ed. PEARSON, 2010, ch. 14, sec. 5, pp461-463
[12] The Internet Engineering Task Force, RFC 5280, 2008
[13] Windows Authenticode Portable Executable Signature Format, 2nd ed, Microsoft Co., Washington, U.S, 2008
[14] Microsoft PE and COFF Specification, 8th ed, Microsoft Co., Washington, U.S, 2013
[15] The Internet Engineering Task Force, RFC 2315, 1998
[16] Cristian Coarfa [three or more authors: Cristian Coarfs et al.], Performance Analysis of TLS Web Server, ACM Transactions on Computer Systems, vol. 24, p. 36-69, 2006
指導教授 許富皓(Fu-Hau Hsu) 審核日期 2015-7-23
推文 facebook   plurk   twitter   funp   google   live   udn   HD   myshare   reddit   netvibes   friend   youpush   delicious   baidu   
網路書籤 Google bookmarks   del.icio.us   hemidemi   myshare   

若有論文相關問題,請聯絡國立中央大學圖書館推廣服務組 TEL:(03)422-7151轉57407,或E-mail聯絡  - 隱私權政策聲明