WO2017018651A1

WO2017018651A1 - Device and method for preventing pharming attack by using dns modulation

Info

Publication number: WO2017018651A1
Application number: PCT/KR2016/005680
Authority: WO
Inventors: 박형배
Original assignee: 주식회사 수산아이앤티
Priority date: 2015-07-29
Filing date: 2016-05-30
Publication date: 2017-02-02
Also published as: KR101728760B1; KR20170014271A

Abstract

The present invention relates to a pharming attack prevention device and method for installing both a VPN client and a VPN server in a terminal, monitoring a packet transmitted between the VPN client and the VPN server, changing an address of a destination of a DNS request packet to a preset safe address of a DNS server when the packet is the DNS request packet, and transmitting the changed DNS request packet.

Description

Apparatus and method for preventing pharming attack through DNS tampering

The following description relates to a technique for preventing a pharming attack, and relates to a method and system for preventing a pharming attack by changing a destination address of a DNS request packet.

A pharming attack is one in which a hacker hacks a router (AP) and changes the address of a DNS (Domain Name System) server to the address of their fake DNS server, thereby stealing the user's information when the user connects to the fake DNS server. For example, a hacker hacks a coffee shop's router and changes the address of the DNS server specified by the router to its address.

A user's portable terminal (smartphone) receives and sets an IP address from an AP mainly using a dynamic host configuration protocol (DHCP). At this time, the portable terminal also receives and sets the DNS server address from the AP. However, if the AP is hacked, the wrong DNS server address is set.

The hacker makes sure that the DNS operation for other sites except the one set by the user is performed normally. For the specific site, the hacker provides the address of the fake site to the mobile terminal. When the user accesses the address of the fake site, It can take over user's information.

For example, www.kbstar.com returns the fake IP address to the portable terminal instead of the actual IP address. When the user accesses the fake IP address, the user obtains the user's main financial information and then uses the user at the actual Kookmin Bank site. Attacks can be used to steal deposits.

In other words, a pharming attack is an Internet fraud technique that attempts to steal a user's domain from a legally owned user or trick a DNS name to mislead people into a real site. In the middle of the hijacking and users know that the site is always used without any doubt revealing personal ID, password, account number.

Such a pharming attack is more vulnerable in a portable terminal (smartphone) that receives and sets the address of a DNS server through a router (AP) through DHCP. Therefore, there is a need for a pharming attack prevention method suitable for such a portable terminal.

The present invention was derived to solve the problems of the prior art as described above, and an object thereof is to provide an apparatus and method for preventing pharming attacks through DNS modulation.

Specifically, the present invention installs both a VPN client and a VPN server in the terminal, monitors the packets transmitted between the VPN client and the VPN server, and in the case of the DNS request packet, the destination address of the DNS request packet of the secure DNS server. An object of the present invention is to provide an apparatus and method for preventing pharming attack by changing to an address and transmitting a changed DNS request packet.

In order to achieve the above object, a pharming attack prevention method according to an embodiment of the present invention, installing both a VPN (virtual private network) client and VPN server in the terminal; Setting all packets transmitted from the terminal to be transmitted through the VPN client and the VPN server; Monitoring packets transmitted and received between the VPN client and the VPN server; If the packet transmitted from the VPN client to the VPN server is a Domain Name System query packet, changing a destination address of the DNS request packet to a predetermined secure DNS server address; And forwarding the modified DNS request packet to the VPN server.

In this case, the step of changing the destination address of the DNS request packet to the address of a predetermined secure DNS server may be managed by storing the destination address of the DNS request packet as an existing destination address.

On the other hand, the pharming attack prevention method, if the packet transmitted from the VPN server to the VPN client is a DNS Name Packet (Domain Name System response packet), changing the source address of the DNS response packet to the corresponding existing destination address; ; And forwarding the modified DNS response packet to the VPN client.

In this case, the setting of all packets transmitted from the terminal to be transmitted through the VPN client and the VPN server may include outputting a screen for asking a user whether to execute the protected mode and executing the protected mode from the user. If it is selected, all packets transmitted from the terminal can be set to be transmitted through the VPN client and the VPN server.

In this case, the step of changing the destination address of the DNS request packet to the address of a predetermined secure DNS server, if the packet transmitted from the VPN client to the VPN server is a DNS request packet, to determine the destination address of the DNS request packet step; Checking whether the destination address of the DNS request packet is a secure address included in a secure DNS server list; And if the destination address of the DNS request packet is not included in the secure DNS server list, changing the destination address of the DNS request packet to one of the addresses included in the secure DNS server list.

In the method for preventing pharming attack through DNS modulation according to another embodiment of the present invention, in the method of operating an app installed on a smartphone, intercepting all packets transmitted from the smartphone to the outside before being transmitted to the outside ; Determining whether the packet is a Domain Name System query packet; And if the packet is a DNS request packet, changing the destination address of the DNS request packet to an address of a predetermined secure DNS server and transmitting the changed address.

In this case, in the step of transmitting the destination address of the DNS request packet to a preset secure DNS server address, the destination address of the DNS request packet may be stored and managed as an existing destination address.

Meanwhile, the pharming attack prevention method may further include changing a source address of the DNS response packet to a corresponding existing destination address when receiving a DNS name response packet.

The present invention installs both a VPN client and a VPN server in the terminal, monitors the packets transmitted between the VPN client and the VPN server, and in the case of the DNS request packet, changes the destination address of the DNS request packet to the address of a predetermined secure DNS server. The present invention relates to a pharming attack prevention device and a method for transmitting a changed DNS request packet. The pharming attack can be prevented by forcing the use of a DNS server that has been confirmed as safe.

1 is a diagram illustrating a configuration of a pharming attack prevention apparatus through DNS modulation according to an embodiment.

2 is a flowchart illustrating a process of installing an application for preventing a pharming attack, according to an exemplary embodiment.

3 is a flowchart illustrating a process of preventing a pharming attack according to an embodiment.

4 is a flowchart illustrating a process of preventing a pharming attack according to another exemplary embodiment.

5 is a flowchart illustrating a process of preventing a pharming attack according to another embodiment.

Other objects and features of the present invention in addition to the above object will be apparent from the description of the embodiments with reference to the accompanying drawings.

Preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

However, the present invention is not limited or limited by the embodiments. Like reference numerals in the drawings denote like elements.

Hereinafter, an apparatus and method for preventing pharming attack through DNS modulation according to an embodiment of the present invention will be described in detail with reference to FIGS. 1 to 5.

Referring to FIG. 1, a portable terminal 100 for preventing a pharming attack includes a control unit 110 and a communication unit 120, and the control unit 110 includes a VPN (virtual private network) client 112 and a VPN server 116. ) And a pharming prevention part 114 may be configured.

The communication unit 120 is a communication interface device including a receiver and a transmitter, and transmits and receives data by wire or wirelessly.

The communication unit 120 may communicate with a Domain Name System (DNS) server to transmit a Domain Name System query packet and receive a Domain Name System response packet.

When performing wireless communication, the communicator 120 may perform a function of transmitting and receiving a radio signal of data input / output through an antenna (not shown). For example, in the case of transmission, after performing channel coding and spreading on the data to be transmitted, RF processing is performed to transmit the data. In the case of reception, the received RF signal is converted into a baseband signal. The baseband signal is de-spreaded and channel decoded to restore data.

The virtual private network (VPN) client 112 forms a kind of network tunnel with the VPN server 116, and transmits all packets to the VPN server 116 to the outside.

The VPN server 116 transmits the packet received through the network tunnel formed with the VPN client 112 through the communication unit 120, and provides the packet received through the communication unit 120 to the VPN client 112.

The anti-pharming unit 114 monitors packets transmitted and received between the VPN client 112 and the VPN server 116, and the packets transmitted from the VPN client 112 to the VPN server 116 are DNS request packets (Domain Name System). query packet), the destination address of the DNS request packet is changed to the address of a predetermined secure DNS server, and the changed DNS request packet is forwarded to the VPN server 116.

When the pharming protection unit 114 changes the destination address of the DNS request packet to a preset secure DNS server address, the pharming prevention unit 114 stores and manages the destination address of the DNS request packet as an existing destination address, and then, the VPN server 116 stores the VPN address. If the packet transmitted to the client 112 is a Domain Name System response packet, the source address of the DNS response packet may be changed to a corresponding existing destination address, and the changed DNS response packet may be forwarded to the VPN client 112. have.

Meanwhile, the pharming prevention unit 114 may change the destination address of the DNS request packet to an address of one predetermined safe DNS server, but checks whether the destination address of the DNS request packet is a safe address included in the secure DNS server list. If the verification result does not include the destination address of the DNS request packet in the secure DNS server list, the destination address of the DNS request packet may be changed to one of the addresses included in the secure DNS server list.

The controller 110 may control the overall operation of the portable terminal 100. The controller 110 may perform the functions of the VPN client 112, the VPN server 116, and the pharming prevention unit 114. The controller 110, the VPN client 112, the VPN server 116, and the pharming prevention unit 114 are illustrated separately to describe the respective functions. Accordingly, the controller 110 may include at least one processor configured to perform functions of the VPN client 112, the VPN server 116, and the anti-pharming unit 114. In addition, the controller 110 may be configured to include at least one processor configured to perform some of the functions of the VPN client 112, the VPN server 116, and the anti-pharming unit 114.

On the other hand, in the present invention, the configuration for the anti-pharming including the VPN client 112, VPN server 116 and the anti-pharming unit 114 is not limited to a portable terminal, it can be applied to a personal computer (PC). .

Hereinafter, a method for preventing pharming attack through DNS modulation according to the present invention configured as described above will be described with reference to the accompanying drawings.

Referring to FIG. 2, when the portable terminal 100 detects that a user is requested to install a pharming attack prevention application (210), the portable terminal 100 installs both the VPN client 112 and the VPN server 116 in the portable terminal 100. (220).

In operation 230, the portable terminal 100 outputs a screen for inquiring to execute the protection mode.

When the portable terminal 100 detects that the user selects to execute the protection mode (240), the portable terminal 100 transmits all packets transmitted from the portable terminal 100 through the VPN client and the VPN server. Set 250.

In operation 260, the portable terminal 100 monitors a packet transmitted and received between the VPN client and the VPN server.

Next, an example of executing the protection mode to prevent pharming will be described with reference to FIGS. 3 and 4.

Referring to FIG. 3, the pharming prevention unit 114 (or pharming prevention device) checks whether a packet transferred from the VPN client 112 to the VPN server 116 is a DNS name packet (DNS). If the request packet (310), the destination address of the DNS request packet is confirmed (320).

In operation 330, the pharming prevention unit 114 stores the destination address as an existing destination address.

The anti-pharming unit 114 changes the destination address to an address of a predetermined secure DNS server (340).

The pharming prevention unit 114 transmits the changed DNS request packet to the VPN server (350).

If the packet transmitted from the VPN server 116 to the VPN client 112 is a domain name system response packet (360), then the anti-pharming unit 114 matches an existing destination corresponding to the source address of the DNS response packet. The changed DNS response packet is transferred to the VPN client 112 by changing to an address (370).

Referring to FIG. 4, the pharming prevention unit 114 (or pharming prevention device) checks whether a packet transmitted from the VPN client 112 to the VPN server 116 is a DNS name packet, and then performs a DNS If the request packet (410), the destination address of the DNS request packet is confirmed (420).

The anti-pharming unit 114 checks whether the destination address is a safe address included in the safe DNS server list (422).

In operation 422, if the destination address is not included in the secure DNS server list, the pharming prevention unit 114 stores the destination address as an existing destination address (430).

The pharming prevention unit 114 changes the destination address to an address of a preset secure DNS server (440).

The pharming prevention unit 114 transmits the changed DNS request packet to the VPN server (450).

If the packet transmitted from the VPN server 116 to the VPN client 112 is a domain name system response packet (460), then the anti-pharming unit 114 matches an existing destination corresponding to the source address of the DNS response packet. The changed DNS response packet is transferred to the VPN client 112 by changing to an address (470).

Referring to FIG. 5, a smartphone (portable terminal) intercepts all packets transmitted to the outside before being transmitted to the outside (510).

In operation 520, the smartphone checks whether the intercepted packet is a Domain Name System query packet.

If the intercepted packet is the DNS request packet in step 520, the smartphone changes the destination address of the DNS request packet to the address of the preset secure DNS server and transmits the address to the preset secure DNS server (530).

In this case, the smart phone may store and manage the destination address of the DNS request packet as an existing destination address.

Thereafter, when the smartphone receives the Domain Name System response packet (550), the smartphone changes the source address of the DNS response packet to the corresponding existing destination address (560).

The method for preventing pharming attack through DNS modulation according to an embodiment of the present invention may be implemented in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In the present invention as described above has been described by the specific embodiments, such as specific components and limited embodiments and drawings, but this is provided to help a more general understanding of the present invention, the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions.

Therefore, the spirit of the present invention should not be limited to the described embodiments, and all of the equivalents and equivalents of the claims, as well as the following claims, will fall within the scope of the present invention. .

Claims

Installing both a virtual private network (VPN) client and a VPN server in the terminal;

Setting all packets transmitted from the terminal to be transmitted through the VPN client and the VPN server;

Monitoring packets transmitted and received between the VPN client and the VPN server;

If the packet transmitted from the VPN client to the VPN server is a Domain Name System query packet, changing a destination address of the DNS request packet to a predetermined secure DNS server address; And

Forwarding the changed DNS request packet to the VPN server

How to prevent pharming attack by using DNS tampering.
The method of claim 1,

Changing the destination address of the DNS request packet to the address of a preset secure DNS server,

Storing and managing a destination address of the DNS request packet as an existing destination address

How to prevent pharming attacks through DNS tampering.
The method of claim 2,

If the packet transmitted from the VPN server to the VPN client is a Domain Name System response packet, changing the source address of the DNS response packet to the corresponding destination address; And

Forwarding the modified DNS response packet to the VPN client

How to prevent pharming attack through DNS tampering further comprising.
The method of claim 1,

Setting all the packets transmitted from the terminal to be transmitted through the VPN client and the VPN server,

Outputting a screen for inquiring whether the user executes the protected mode, and if the user is selected to execute the protected mode, all packets transmitted from the terminal are set to be transmitted through the VPN client and the VPN server;

How to prevent pharming attacks through DNS tampering.
The method of claim 1,

Changing the destination address of the DNS request packet to the address of a preset secure DNS server,

If the packet transmitted from the VPN client to the VPN server is a DNS request packet, checking a destination address of the DNS request packet;

Checking whether the destination address of the DNS request packet is a secure address included in a secure DNS server list; And

If the destination address of the DNS request packet is not included in the secure DNS server list, changing the destination address of the DNS request packet to one of the addresses included in the secure DNS server list.

How to prevent pharming attack by using DNS tampering.
In the operation method of the app installed on the smartphone,

Intercepting all packets transmitted from the smartphone to the outside before being sent out;

Determining whether the packet is a Domain Name System query packet; And

If the packet is a DNS request packet, changing the destination address of the DNS request packet to an address of a predetermined secure DNS server and transmitting the same;

How to prevent pharming attack by using DNS tampering.
The method of claim 6,

Transmitting the destination address of the DNS request packet to the address of a predetermined secure DNS server, and transmitting,

Storing and managing a destination address of the DNS request packet as an existing destination address

How to prevent pharming attacks through DNS tampering.
The method of claim 7, wherein

Upon receiving a Domain Name System response packet, changing a source address of the DNS response packet to a corresponding existing destination address;

How to prevent pharming attack through DNS tampering further comprising.
A computer-readable recording medium in which a program for executing the method of claim 1 is recorded.