Title Page
Abstract
Contents
Ⅰ. Introduction 12
Ⅱ. On the Analysis of Recent Malware Attacks and its Social Ramification 14
1. Introduction 14
2. Background 16
1) Cryptocurrency 16
2) Cryptojacking 18
3) Clipboard Hijacking 19
4) Ransomware as a Service (RaaS) 20
3. Malware classification : APT vs non-APT 21
4. Non-APT Malware 26
1) HackBoss Malware 26
2) Crackonosh Malware 27
3) Magniber Malware 28
4) Phorpiex and Twizt Malware 28
5) Mykings Malware 29
6) Dridex Malware 30
7) Summary 31
5. APT Malware 33
1) The Case of Attack on KLAYSwap Service 33
2) Blackcat Malware 34
3) BlackMatter Malware 34
4) Phoenix Cryptolocker Malware 35
5) Darkside Malware 36
6) Cuba Malware 37
7) Conti Malware 38
8) Lockbit Malware 39
9) Revil(Sodinokibi) Malware 39
10) Netwalker Malware 40
11) Clop Malware 41
12) LockerGoga Malware 42
13) Ryuk Malware 43
14) Summary 43
6. Discussion and Related Policy 46
1) Summary of Analysis 46
2) Related Policy 47
7. Summary 50
Ⅲ. A Study on Vulnerability Analysis and Memory Forensics of ESP32 51
1. Introduction 51
2. Related work 54
3. Simulation of OTA attack scenario 56
1) Cracking Wireless Access Point 58
2) OTA update packet sniffing 59
3) TCP SYN Flooding attack during OTA update 61
4. ESP32 Memory Analysis 63
1) ESP32 Memory Structure 63
2) Memory Dump Analysis 65
5. Summary 70
Ⅳ. Conclusion 71
References 73
논문 개요 78
Table 1. Malware classification 23
Table 2. Summary of non-APT malware trend analysis 32
Table 3. Summary of APT malware trend analysis. 'Unknown' refers to cases where information is not provided. 45
FIGURE 1. Major Crypto Assets By Percentage of Total Cryptocurrency Market Capitalization 17
FIGURE 2. Application UI Examples 27
FIGURE 3. The website of Darkside Ransomware 37
FIGURE 4. Dark web page of Cuba Ransomware 38
FIGURE 5. The attack scenario on OTA process of the ESP32 drone. 57
FIGURE 6. Using airplay-ng to infiltrate WiFi network 58
FIGURE 7. Crack the victim's WiFi password with aircrack-ng and rockyou.txt 59
FIGURE 8. Discovered TCP 3-way handshake connection and ESP32 drone information during OTA update 60
FIGURE 9. The OTA update process fails when a TCP SYN packet is sent to the ESP32 drone. 61
FIGURE 10. Partition table of ESP32 64
FIGURE 11. WiFi data is stored in otadata partition (offset OxDOOO) 66
FIGURE 12. Comparing the esp32_dump.bin file (left) with the sniffed packet data (right) 67
FIGURE 13. The comparison was conducted between the following files: esp32_dump.bin, esp32_dumpl.bin, and synflooding.bin (in the... 68