Journal of the Korea Convergence Society (한국융합학회논문지)

Korea Convergence Society (한국융합학회)
권호 표지
DOI QR코드

DOI QR Code

Attack Scenarios and Countermeasures using CoAP in IoT Environment

IoT기기에서 SSDP 증폭 공격을 이용한 공격기법 및 대응 방안

  • Oh, Ju-Hye (Division of Information Communication, Baek-Seok University) ;
  • Lee, Keun-Ho (Division of Information Communication, Baek-Seok University)
  • 오주혜 (백석대학교 정보통신학부) ;
  • 이근호 (백석대학교 정보통신학부)
  • Received : 2016.06.21
  • Accepted : 2016.08.12
  • Published : 2016.08.31
Download PDF
⟨ Previous Next ⟩

Abstract

DDoS attack has been continuously utilized that caused the excessively large amount of traffic that network bandwidth or server was unable to deal with paralyzing the service. Most of the people regard NTP as the biggest cause of DDoS. However, according to recently executed DDoS attack, there have been many SSDP attack in the use of amplified technique. According to characteristics of SSDP, there is no connection for making a forgery of source IP address and amplified resources feasible. Therefore, it is frequently used for attack. Especially, as it is mostly used as a protocol for causing DDoS attack on IoT devices that constitute smart home including a wireless router, media server, webcam, smart TV, and network printer. Hereupon, it is anticipated for servers of attacks to gradually increase. This might cause a serious threat to major information of human lives, major government bodies, and company system as well as on IoT devices. This study is intended to identify DDoS attack techniques in the use of weakness of SSDP protocol occurring in IoT devices and attacking scenario and counter-measures on them.

DDoS 공격은 네트워크나 서버 대역이 감당할 수 없는 수많은 양의 트래픽을 일으켜 서버를 마비시키는 공격수단으로 최근까지 지속적으로 이용되고 있다. 대부분 DDoS의 가장 큰 원인은 NTP라고 생각하지만, 최근 일어난 DDoS 공격들을 본다면 증폭기법을 이용한 SSDP 공격을 많이 사용하였음을 알 수 있다. SSDP의 특성상 소스 IP주소 위조와 증폭 요소를 가능하게 해주는 연결이 없는 상태 때문에 공격에 많이 활용되고 특히 웹캠, 공유기, 미디어, 스마트TV, 프린터 등 스마트 홈을 구성하는 IoT기기들에서 DDoS공격을 유발하는 도구로 주로 사용되는 프로토콜이기 때문에 점차 공격을 위한 서버들이 증가될 것으로 예상한다. 이는 단순한 IoT기기의 위협만이 아닌 사람의 생명이나 주요 정부기관 및 기업 시스템의 중요정보에 큰 위험을 가져올 수 있다. 본 논문에서는 IoT기기에서 발생하는 SSDP 프로토콜의 취약점을 이용한 DDoS공격기법을 알아보고 공격시나리오 및 대응 방법을 제안한다.

Keywords

References

  1. "디도스 공격 진원지, 러시아.동유럽 아냐," 보안뉴스, 2016
  2. Hun-Go, “Home network vulnerability analysis and certification analysis,” Journal of The Korea Institute of Information Security & Cryptology, Vol. 16, No. 6, pp. 42-47, 2006.
  3. Hong-Taek Yoo, "A study on the service infrastructure associated with the construction of the Internet of Things(IoT) common platform," Journal of Korean Institute of Culture Product Art & Design, Vol. 43, pp. 165-178, 2015. https://doi.org/10.18555/kicpd.2015.43.165
  4. Kyong-Ho Han, Seong-Ho Lee, “A study on the Security Threats of IoT Devices Exposed in Search Engine,” The Transactions of the Korean Institute of Electrical Engineers, Vol. 65, No. 1, pp. 128-134, 2016. https://doi.org/10.5370/KIEE.2016.65.1.128
  5. Hyun-sang Choi, Hyun-do Park, Hee-jo Lee, “A Study on Amplification DRDoS Attacks and Defenses,” The Korea Institute of Information, Electronics, and Communication Technology, Vol. 8, No. 5, pp. 429-437, 2015. https://doi.org/10.17661/jkiiect.2015.8.5.429
  6. Jun-Hee Won, Geun-Mok Hong, "DRDoS Attacking Scenario and Countermeasure for Using Weakness of SSDP Protocol in IoT Device," 2016 Academic conference, Vol. 23, No. 1, pp. 280-282, 2016.
  7. Jeong-Hwan Seol, Ki-Young Lee, “Implementation of Middleware Security System for Home Networking,” Journal of the Korea Information and Communication Academic, Vol. 12, No. 5, pp. 863-869, 2008.
  8. Hong-il Kim, "UPnP security vulnerability and the form of DDoS attack's analysis and defense," Journal of the Korea Entertainment Industry Association Vol. 3, No. 2, pp. 44-49. 2009. https://doi.org/10.21184/jkeia.2009.06.3.2.44
  9. Dong-Hee Sin, Jeong-Jae Yeol, Seong-Hyeon, Gang, “Trends and Prospects Internet of Things,” Journal of Internet Information, Vol. 14, No. 2, pp. 32-46, 2013.
  10. Dong-Hee Kim, Seok-Ung Yoon, Yong-pil Lee, "Security Services for the IoT," The Journal of The Korean Institute of Communication Sciences Vol. 30, No. 8, pp. 53-59, 2013.
  11. Seong-Ryeol Kim, “A Study on the Intrusion Detection of DDoS Attack Packets,” J. Ind. Sci., Cheongju Univ, Vol. 22, No. 1, pp. 223-229, 2004.
  12. Yong-Hee Jeon, “Botnet Analysis and Technical Overview,” Journal of The Korea Institute of Information Security & Cryptology, Vol. 18, No. 3, pp. 101-108, 2008.
  13. Jung-woo Seo, Sang-jin Lee, “A study on the detection of DDoS attack using the IP Spoofing,” Journal of The Korea Institute of Information Security & Cryptology, Vol. 25, No. 1, pp. 147-153, 2015. https://doi.org/10.13089/JKIISC.2015.25.1.147
  14. Sung-hyuck Hong, “Analysis of DDoS Attack and Countermeasure: Survey,” Journal of Digital Convergence, Vol. 12, No. 1, pp. 423-429, 2014.
  15. Im-Geol Oh, Jong-Il Lee, “A Study for Vulnerability of Security of the UPnP Home-Networking,” The Journal of Korea Society of Industrial Information System, Vol. 12, No. 2, pp. 30-36, 2007.