KR102617219B1 - Apparatus and method of penetration test utilizing malware - Google Patents

Abstract

A method and device for performing a penetration test using malicious code are provided. The device for performing a penetration test using malicious code includes a memory that stores one or more instructions, and one or more processors that execute the one or more instructions stored in the memory, and the one or more processors execute the one or more instructions to detect malicious code. Identify the attack tactics, techniques, and processes embedded in the code, and identify the binary code and C2 server connection function related to the attack tactics, techniques, or procedures that adversely affect the system from the malicious code. The binary code related to the mock hacking is removed, and the binary code related to the attack tactics, techniques or procedures necessary for mock hacking and the binary code related to the C2 server access function for mock hacking are added to the malicious code to create a mock malicious code, and the mock malicious code is created. You can install the code on the target system of the penetration test and perform the penetration test remotely.

Description

Penetration testing method and device using malicious code {APPARATUS AND METHOD OF PENETRATION TEST UTILIZING MALWARE}

The present invention relates to a penetration testing method and device using malicious code.

Due to the development of Information & Communication Technology (ICT), various cybersecurity threats are increasing. Therefore, serious financial losses or human casualties may occur due to security problems in information systems.

In the past, penetration tests that perform mock hacking to find security vulnerabilities have been proposed, but a more practical method of performing penetration tests is needed.

Registered Patent Publication No. 10-1639869, 2016.07.14.

The problem to be solved by the present invention is to provide a penetration testing method and device using malicious code.

The problems to be solved by the present invention are not limited to the problems mentioned above, and other problems not mentioned can be clearly understood by those skilled in the art from the description below.

An apparatus for performing a penetration test using malicious code according to one aspect of the present invention for solving the above-described problem includes a memory that stores one or more instructions, and one or more processors that execute the one or more instructions stored in the memory, The one or more processors execute the one or more instructions to identify attack tactics, techniques, and processes embedded in the malicious code, and execute the attack tactics and techniques that adversely affect the system from the malicious code. , or remove the binary code related to the procedure and the binary code related to the C2 server connection function, and within the malicious code, the binary code related to the attack tactics, techniques or procedures necessary for mock hacking and the binary code related to the C2 server connection function for mock hacking. is added to create mock malicious code, install the mock malicious code on the target system of the penetration test, and perform the penetration test remotely.

A method performed by a penetration testing apparatus according to one aspect of the present invention to solve the above-described problem, comprising the step of identifying attack tactics, techniques, and processes mounted in malicious code. , removing binary code related to attack tactics, techniques, or procedures that adversely affect the system and binary code related to the C2 server connection function from the malicious code, including attack tactics, techniques, or procedures necessary for mock hacking within the malicious code. Generating simulated malicious code by adding binary code related to the C2 server connection function for mock hacking and installing the simulated malicious code on the target system of the penetration test and remotely performing the penetration test. do.

Other specific details of the invention are included in the detailed description and drawings.

The present invention enables more practical attacks by utilizing malicious code, while ensuring safety by removing dangerous parts.

The effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

Figure 1 is a diagram briefly showing a device for performing a penetration test using malicious code according to an embodiment of the present invention.
Figure 2 is a diagram briefly showing a device for generating simulated malicious code and a device for performing a penetration test according to an embodiment of the present invention.
3 to 5 are diagrams showing a penetration testing method using malicious code performed in a penetration testing apparatus, according to an embodiment of the present invention.
Figure 6 is a diagram briefly illustrating the process of removing binary code that adversely affects the system from malicious code and adding binary code necessary for mock hacking to the malicious code, according to an embodiment of the present invention.

The advantages and features of the present invention and methods for achieving them will become clear by referring to the embodiments described in detail below along with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various different forms. The present embodiments are merely provided to ensure that the disclosure of the present invention is complete and to provide a general understanding of the technical field to which the present invention pertains. It is provided to fully inform the skilled person of the scope of the present invention, and the present invention is only defined by the scope of the claims.

The terminology used herein is for describing embodiments and is not intended to limit the invention. As used herein, singular forms also include plural forms, unless specifically stated otherwise in the context. As used in the specification, “comprises” and/or “comprising” does not exclude the presence or addition of one or more other elements in addition to the mentioned elements. Like reference numerals refer to like elements throughout the specification, and “and/or” includes each and every combination of one or more of the referenced elements. Although “first”, “second”, etc. are used to describe various components, these components are of course not limited by these terms. These terms are merely used to distinguish one component from another. Therefore, it goes without saying that the first component mentioned below may also be a second component within the technical spirit of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used with meanings commonly understood by those skilled in the art to which the present invention pertains. Additionally, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless clearly specifically defined.

In describing the present invention, detailed descriptions of related known technologies will be omitted if they are obvious to those skilled in the art and are judged to unnecessarily obscure the gist of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the attached drawings.

Figure 1 is a diagram briefly showing a device for performing a penetration test using malicious code according to an embodiment of the present invention.

Referring to FIG. 1 , the penetration test performing device 100 may generate simulated malicious code and install the generated simulated malicious code in the target system 200 of the penetration test to perform the penetration test.

The penetration test performing device 100 may be physically and/or logically separated from the penetration test target system 200. Accordingly, the penetration test performing device 100 can remotely perform a penetration test by installing the generated simulated malicious code in the target system of the penetration test.

The target system 200 of the penetration test is a target system on which a penetration test, that is, a simulated cyber attack to find system vulnerabilities, is executed, and may include a server. In one embodiment, the target system 200 of the penetration test may be a system set to any environment by the user. The target system 200 for penetration testing may be set to a specific environment according to test purpose, environment, goals, etc.

The network 300 may include any wired or wireless communication network capable of transmitting and receiving arbitrary types of data and signals. Specifically, the network 300 may include a wired or wireless communication network capable of transmitting and receiving data and signals between the penetration test performing device 100 and the penetration test target system 200.

Meanwhile, the penetration test performing device 100 may include one or more processors 110, memory 120, and communication unit 130.

Processor 110 may consist of one or more cores. The processor 110 may control the overall operation of the penetration testing apparatus 100. The processor 110 may read one or more instructions stored in the memory 120 and perform a penetration test using malicious code according to an embodiment of the present disclosure.

The memory 120 may store any type of information generated or determined by the processor 110 and any type of information received through the communication unit 130. The memory 120 includes random access memory (RAM), read only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, hard disk, removable disk, and CD-ROM. , or any type of computer-readable recording medium well known in the art to which the present invention pertains. Memory 120 may store one or more instructions executed by processor 110.

The communication unit 130 may include any wired or wireless communication network capable of transmitting and receiving any type of data, information, and signals. The communication unit 130 can communicate with an external device. An external device could be, for example, the target system of a penetration test (a server, etc.).

Referring to FIG. 2, the penetration test performing device 100 and the simulated malicious code generating device 400 may be physically and/or logically separated. Therefore, the penetration test performing device 100 receives the simulated malicious code from the simulated malicious code generating device 400 and installs it in the target system 200 of the penetration test using the received simulated malicious code to perform the penetration test. You can.

The simulated malicious code generating device 400 may include one or more processors 410, memory 420, and communication unit 430.

The processor 410 may consist of one or more cores. The processor 410 may control the overall operation of the simulated malicious code generating device 400. The processor 410 may read one or more instructions stored in the memory 420 and generate simulated malicious code according to an embodiment of the present disclosure.

The memory 420 may store any type of information generated or determined by the processor 410 and any type of information received through the communication unit 430. The memory 420 includes RAM (Random Access Memory), ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), flash memory, hard disk, removable disk, and CD-ROM. , or any type of computer-readable recording medium well known in the art to which the present invention pertains. Memory 420 may store one or more instructions executed by processor 410.

The communication unit 430 may include any wired or wireless communication network capable of transmitting and receiving any type of data, information, and signals. The communication unit 430 may communicate with the penetration test performing device 100.

Next, according to an embodiment of the present invention, a specific method of penetration testing performed by the processor 110 of the penetration test performing device 100 (or the processor 410 of the simulated malicious code generating device 400) will be described later.

3 to 6 are diagrams showing a penetration testing method using malicious code performed in a penetration testing apparatus, according to an embodiment of the present invention. The steps shown in FIGS. 3 to 6 are exemplary steps. Accordingly, it will be clear to those skilled in the art that some of the steps in FIGS. 3 to 5 may be omitted or additional steps may be present without departing from the scope of the present disclosure. The flowcharts shown in FIGS. 3 to 5 may be performed, for example, by the penetration test performing device 100 (or the simulated malicious code generating device 400).

The processor 110 of the penetration test performing device 100 can identify attack tactics, techniques, and processes mounted within the malicious code (S110).

The processor 110 uses a pre-developed malware analysis system (e.g., sandbox, etc.) to list information on possible attack tactics, techniques, and procedures in a framework (e.g., MITER ATT&CK, etc.). Accordingly, the binary code such as attack tactics, techniques, and procedures embedded in the malicious code and/or the location of each binary code can be identified.

Malicious code can be a general term for all code created for malicious purposes that causes harm to users. Malicious code can be a malicious program and can include attack tactics, techniques, procedures, etc.

Attack tactics may refer to information indicating actions according to the attacker's attack goal. For example, attack tactics include Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, It may include Credential Access, Discovery, Lateral Movement, Collection, Command and Control (C2), Exfiltration, Impact, etc.

Reconnaissance is the stage of gathering and understanding information about the target of an attack, and can mean collecting information to investigate the target network and system and find vulnerabilities.

Resource development is the stage of preparing tools and infrastructure to be used in an attack, and may mean developing or acquiring malicious code or tools necessary for an attack.

Initial access is the first step into infiltrating a system and may mean accessing the system remotely by exploiting vulnerabilities or using social engineering techniques.

Execution can mean executing malicious code or scripts to perform desired actions within the system.

Persistence may mean installing or setting up backdoors or other mechanisms to maintain long-term access to the system.

Escalation of privilege can mean utilizing various techniques to gain higher privileges within a system.

Defense evasion can mean evading security systems by utilizing techniques that evade detection and make analysis difficult.

Obtaining credentials may mean obtaining valid account information within the system or bypassing authentication using a cracked password.

Discovery can be exploring information and resources within a system to plan and expand attacks.

Lateral movement involves moving within a system to access more hosts or resources, which can be an attack that penetrates a system from a remote location.

Collection can mean performing actions within a system to collect or examine stolen information or data.

C2 (Command and Control) can refer to remotely manipulating and controlling a system using a remote server or infrastructure.

Data leakage refers to transmitting or leaking stolen data externally, and there may be a risk of transmitting information to actual hackers.

The impact can be dangerous because it executes the end goal of the attack, taking action to damage systems or data or impede the availability of a service.

Techniques may refer to information indicating techniques for an attacker to achieve attack tactics against a target.

A procedure may refer to information that describes how to specifically execute a technique.

In one embodiment, the processor 110 may use a rule-based algorithm rather than an analysis system to identify attack tactics that have a negative impact on the system and attack tactics that are not dangerous. For example, the processor 110 uses Reconnaissance, Resource Development, Execution, Persistence, Privilege Escalation, and Defense Evasion among the attack tactics of malicious code. , Credential Access, Discovery, etc. can be identified as non-dangerous attack tactics.

The processor 110 may remove binary code related to attack tactics, techniques, or procedures that have a negative impact on the system and binary code related to the C2 server connection function from malicious code (S120).

Attack tactics that adversely affect the system may include early access, lateral movement, data exfiltration, and influence. Accordingly, the processor 110 can remove binary code related to initial access, lateral movement, data leakage, and impact, and binary code related to the C2 server connection function.

Removing binary code may mean deleting the binary code.

Removing the binary code may mean changing each bit included in the binary code to “0” and changing it to a binary code made up of 0s. A binary code consisting of 0 may be a meaningless code, that is, a dummy code. The processor 110 changes the binary code to a dummy code without deleting it, thereby preventing problems related to code execution that may occur due to deletion of the binary code.

In additional embodiments, processor 110 may disable binary code relating to attack tactics, techniques, or procedures that adversely affect the system from malicious code and binary code relating to C2 server access functionality.

Disabling may mean deleting the part of the binary code that is called by the attacker. The processor 110 does not delete the entire binary code, but only deletes the part called by the attacker, thereby preventing problems related to code execution that may occur due to the entire deletion of the binary code.

A C2 server is a command and control server, which can be a server used by attackers, such as malware or hacking groups, to remotely control and deliver commands. The processor 110 removes or disables the binary code related to the C2 server access function, thereby preventing cyberattackers (e.g., hackers, etc.) from adversely affecting the system by utilizing the C2 server access function of malicious code. and ensures stability in the reuse of malicious code.

The processor 110 can generate simulated malicious code by adding binary code regarding attack tactics, techniques, or procedures necessary for mock hacking and binary code regarding the C2 server connection function for mock hacking to the malicious code (S130).

A C2 server for penetration testing can operate according to the commands of an attacker (for example, a white hacker, etc.) performing a penetration test. An attacker can use a C2 server for mock hacking to send remote commands to the target system, download additional malicious code for mock hacking, or leak specific data to the outside world.

The C2 server for mock hacking may be included in the penetration testing device 100 or may exist separately from the penetration testing device 100. If the C2 server for mock hacking exists separately from the penetration testing device 100, it may be controlled by the penetration testing device 100.

The binary code for the C2 server connection function for mock hacking can enable communication between the penetration tester and the simulated malicious code to use mutual authentication between the client and server. For example, the binary code for the C2 server access function for mock hacking can perform mutual authentication using a certificate in communication between the penetration tester and the mock malicious code. Accordingly, the processor 110 can perform mutual authentication using a certificate in communication between the penetration tester and the simulated malicious code using a binary code related to the C2 server connection function for mock hacking.

The processor 110 may add binary code for a function that deletes itself upon completion of the penetration test within the simulated malicious code. Accordingly, the processor 110 can prevent errors, attacks, etc. due to simulated malicious code from occurring in the target system of the penetration test after the penetration test is completed.

The processor 110 may install simulated malicious code on the target system 200 of the penetration test and remotely perform the penetration test (S140).

Referring to FIG. 4, after S130 described above, the processor 110 may generate a simulated malicious code list including one or more simulated malicious codes (S150).

The processor 110 may generate and manage first metadata regarding attack tactics, techniques, or procedures installed in each simulated malicious code and second metadata regarding a method of accessing the C2 server for mock hacking (S160). For example, the processor 110 may store first metadata and second metadata in memory. The processor 110 can accumulate and manage simulated malicious code for penetration testing.

Accordingly, the processor 110 accumulates and manages simulated malicious code for penetration testing, so that when performing a penetration test, the accumulated simulated malicious code can be utilized without creating a new one.

The processor 110 may identify the simulated malicious code corresponding to the target system within the simulated malicious code list using the first metadata or the second metadata (S170). For example, the processor 110 may search for available mock malicious code based on information identified about the target system during a penetration test (eg, operating system, installed security software, etc.).

The processor 110 may install the identified simulated malicious code into the target system 200 of the penetration test and remotely perform the penetration test (S140).

Referring to FIG. 5, after S130 described above, the processor 110 may add binary code for a function that deletes itself upon completion of the penetration test into the simulated malicious code (S180).

Accordingly, the processor 110 can prevent errors, attacks, etc. due to simulated malicious code from occurring in the target system of the penetration data after the penetration test is completed.

In an additional embodiment, the processor 110 may install simulated malicious code on a plurality of penetration test target systems configured in different environments and remotely simultaneously perform the penetration test. The processor 110 can perform penetration tests in various environments in a short time by performing penetration tests on different target systems in parallel.

Figure 6 is a diagram briefly illustrating the process of removing binary code that adversely affects the system from malicious code and adding binary code necessary for mock hacking to the malicious code, according to an embodiment of the present invention.

Referring to FIG. 6, the processor 110 deletes the binary code 611 related to the C2 server connection function and the binary code related to the attack tactic or procedure that adversely affects the system from the malicious code 610, thereby Malicious code 620 from which the codes have been deleted can be obtained.

The processor 110 can generate the malicious code 630 for penetration testing by adding the binary code 631 for simulation hacking to the malicious code 620 from which the corresponding binary codes have been deleted.

As described above with reference to FIGS. 1 to 6, the penetration testing apparatus 100 according to an embodiment of the present invention enables a more practical attack by utilizing malicious code while ensuring safety by removing dangerous parts. can do.

The steps of the method or algorithm described in connection with embodiments of the present invention may be implemented directly in hardware, implemented as a software module executed by hardware, or a combination thereof. The software module may be RAM (Random Access Memory), ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), Flash Memory, hard disk, removable disk, CD-ROM, or It may reside on any type of computer-readable recording medium well known in the art to which the present invention pertains.

Above, embodiments of the present invention have been described with reference to the attached drawings, but those skilled in the art will understand that the present invention can be implemented in other specific forms without changing its technical idea or essential features. You will be able to understand it. Therefore, the embodiments described above should be understood in all respects as illustrative and not restrictive.

Claims (10)

A memory that stores one or more instructions; and
Comprising one or more processors executing the one or more instructions stored in the memory,
The one or more processors execute the one or more instructions
Identify attack tactics, techniques, and processes embedded within malicious code,
Remove binary code related to attack tactics, techniques, or procedures that adversely affect the system and binary code related to the C2 server connection function from the malicious code,
A mock malicious code is created by adding a binary code regarding the attack tactics, techniques or procedures required for mock hacking and a binary code for a C2 server access function for mock hacking into the malicious code,
Generate a mock malicious code list containing one or more mock malicious codes,
Create and manage first metadata about the attack tactics, techniques, or procedures installed in each mock malicious code and second metadata about the method of accessing the C2 server for mock hacking,
Identifying a mock malicious code corresponding to a target system of a penetration test in the mock malicious code list using the first metadata or the second metadata,
Characterized by installing the simulated malicious code on the target system and remotely performing a penetration test,
A device for performing penetration testing using malicious code. delete delete According to paragraph 1,
The binary code for the C2 server connection function for mock hacking allows communication between the penetration tester and the mock malicious code to use mutual authentication between the client and the server.
A device for performing penetration testing using malicious code. According to paragraph 1,
The one or more processors:
Adding binary code for a function that deletes itself at the end of the penetration test within the mock malicious code,
A device for performing penetration testing using malicious code. A method performed by a penetration test performing device,
Identifying attack tactics, techniques, and processes embedded within malicious code;
Removing binary code related to attack tactics, techniques, or procedures that adversely affect the system and binary code related to a C2 server connection function from the malicious code;
Generating simulated malicious code by adding binary code related to attack tactics, techniques or procedures required for mock hacking and binary code related to C2 server access function for mock hacking into the malicious code;
generating a mock malicious code list including one or more simulated malicious codes;
Creating and managing first metadata about attack tactics, techniques, or procedures installed in each simulated malicious code and second metadata about a method of accessing a C2 server for mock hacking;
Identifying a simulated malicious code corresponding to a target system of a penetration test in the simulated malicious code list using the first metadata or the second metadata; and
Characterized in that it includes the step of installing the simulated malicious code on the target system and remotely performing a penetration test,
How to perform a penetration test using malware. delete delete According to clause 6,
The binary code for the C2 server connection function for mock hacking allows communication between the penetration tester and the mock malicious code to use mutual authentication between the client and the server.
How to perform a penetration test using malware. According to clause 6,
The step of generating the mock malicious code is,
Including adding binary code for a function that deletes itself at the end of the penetration test into the mock malicious code,
How to perform a penetration test using malware.