개 요 홈페이지 해킹 현황 및 사례 홈페이지 개발시 보안 취약점 및 대책
주요 애플리케이션 보안 대책 결 론 참고자료 [부록1] 개발 언어별 로그인 인증 프로세스 예제 [부록2] 대규모 홈페이지 변조 예방을 위한 권고(안) [부록3] 개인정보의 기술적 관리적 보호조치 기준(안) [부록4] 웹 보안관련 주요 사이트 리스트
7000 6,478 6000 5000 4000 3000 2000 1000 0 1,034 709 756 280 339 337 38 127 172 262 423 335 2004.1. 2004.2. 2004.3. 2004.4. 2004.5. 2004.6. 2004.7. 2004.8. 2004.9. 2004.10. 2004.11. 2004.12. 2005.1. 출처:www.krcert.or.kr
설계 21% 구현 15% 테스트 12%
건수 45 40 43 36 40 35 30 25 21 22 27 20 16 15 10 5 0 5 6 2 2 0 1월 2월 3월 4월 5월 6월 7월 8월 9월 10월 11월 12월 월
file.h sh.conf libsh.sh system shsb libsh.so shp shsniff srd0 hosts.h 2 212.110 2 195.26 2 194.143 2 62.220 3 2002 4 2002 3 6667 4 6667 3 61690 4 61690 log.h mirkforce synscan syslog proc.h 3 burim 3 mirkforce 3 synscan 3 ttyload 3 shsniff 3 ttymon 3 shsb 3 shp 3 hide 4 ttyload
1. 개인사용자 인증 및 로그인 홈페이지 일반사용자 4. 탈취한 Cookie 값을 사용하여 개인 사용자 관리자 페이지로 접근 2. XSS에 의해 사용자 페이지가 redirect 되면서 cookie값이 해커 서버로 전동됨 공격자 3. Cookie 값을 해커 서버로부터 받아옴 공격자 서버
< > ( ) # & < > ( ) # &
Prod[uctOnly] Server: Apache Min[imal] OS Full Prod + Min + OS + () Server: Apache/1.3.0 Server: Apache/1.3.0 (Unix) Server: Apache/1.3.0 (Unix) PHP/3.0 MyMod/1.2
columns_priv db host tables_priv user MySQL DB User select, insert, update, reference DB user DB Host columns_priv
MSSQL2000 MSSQL7.0 MSSQL 6.5 SQL Server 2000 3a : http://www.microsoft.com/korea/sql/downloads/2000/sp3.asp SQL Server 7.0 4 : http://www.microsoft.com/korea/sql/downloads/sp4.asp SQL Server 6.5 Service pack 5a : http://support.microsoft.com/default.aspx?scid=kb;en-us;q197177
SYS CHANGE_ON_INSTALL SYSTEM MANAGER SCOTT TIGER AURORA$JIS$UTILITY$ jserv OSE$HTTP$ADMIN AURORA$ORB$UNAUTHENTICATED
UTL_SMTP UTL_TCP. TCP. PUBLIC (GRANT).. UTL_HTTP UTL_FILE DBMS_RANDOM HTTP. HTML, TXT LEVEL..
http://otn.oracle.com/deploy/security/pdf/2003alert54.pdf http://www.nextgenss.com/advisories/ora-dblink.txt http://www.securityfocus.com/archive/1/319914 Oracle9i Release 2 Oracle9i Release 1
Oracle8i (8.1.x - ) Oracle8 (8.0.x - ) Oracle7 Release 7.3.x
Oracle 9i Release 2 (9.2.x) Oracle 9i Release 1 (9.0.x) Oracle 8i (8.1.x)
o PHP o - : Ⅰ - : Ⅰ, Ⅱ, Ⅲ, Ⅳ
Redhat http://www.redhat.com/security/updates/ FreeBSD http://www.freebsd.org/security/ NetBSD http://www.netbsd.org/security/ OpenBSD http://openbsd.org/security.html ftp://ftp.openbsd.org/pub/openbsd/patches/ HP Tru64 http://h30097.www3.hp.com/unix/security-download.html IBM AIX http://techsupport.services.ibm.com Solaris http://sunsolve.sun.com/pub-cgi/show.pl?target=home SGI IRIX http://www.sgi.com/support/security/ Microsoft http://www.microsoft.com/korea/security/ http://www.microsoft.com/security/ Caldera http://www.caldera.com/support/security/ Debian http://www.debian.org/security/ Mandrake http://www.mandrakesecure.net Slackware http://www.slackware.com/security/ Suse http://www.suse.com/us/security/ Turbo http://www.turbolinux.com/security/ Securityfocus http://www.securityfocus.com securiteam.com http://www.securiteam.com Linuxsecurity http://www.linuxsecurity.com ICAT http://icat.nist.gov ISS http://xforce.iss.net PackerStorm http://packetstormsecurity.nl CERTCC-KR http://www.krcert.or.kr Securitymap http://www.securitymap.net http://home.ahnlab.com http://www.hauri.co.kr symantec security response http://securityresponse.symantec.com Trend http://www.trendmicro.com/vinfo Mcafee http://www.mcafee.com
asp alliance http://www.aspalliance.com/ www.cgisecurity.com http://www.cgisecurity.com/lib/ Exploiting Common Vulnerabilities in PHP http://www.securereality.com.au/studyinscarlet.txt Application Java Security http://java.sun.com/security/ Java Security Frequently Asked Questions http://www.cs.princeton.edu/sip/faq/java-faq.php3 Open Web Application Security Project http://www.owasp.org/ www.asp.net http://www.asp.net/ ApacheWeek Security http://www.apacheweek.com/security/ Apache Tutorials http://httpd.apache.org/docs/misc/tutorials.html Apache SSL http://www.apache-ssl.org/ Securing Your Web Pages with Apache http://apache-server.com/tutorials/lpauth1.html The Apache Korea Group http://www.apache-kr.org/ Apache-server.com http://apache-server.com/ IIS 5.0 Resource Guide - Chapter 9 Security IIS 5.0 Baseline Security Checklist* IIS 5.0 Security Secure Internet Information Services 5 Checklist NSA Guide to the Secure Configuration and Administration of Microsoft IIS 5.0 eeye Advisories and Alerts http://www.microsoft.com/technet/treeview/default.asp?url= /technet/prodtechnol/iis/iis5/reskit/iis50rg/iischp9.asp http://www.microsoft.com/technet/archive/security/chklist /iis5cl.mspx http://www.microsoft.com/windows2000/en/server/iis /default.asp?url=/windows2000/en/server/iis/htm/core/iiabt sc.htm http://www.microsoft.com/technet/prodtechnol /windows2000serv/technologies/iis/tips/iis5chk.mspx http://nsa1.www.conxion.com/win2k/guides/w2k-14.pdf http://www.eeye.com/html/research/advisories/index.html