Hoorin Park

With the rise of cyber threats, identifying APT groups becomes increasingly crucial for enterprise security experts. This paper introduces a comprehensive framework for profiling APT groups, focusing on Lazarus and APT29. It underscores the critical role of malware hash unit profiling in contemporary cyber security efforts, aiming to fortify organizational defenses against evolving APT threats.

Quality of service (QoS) has evolved to ensure performance across various computing environments, focusing on data bandwidth, response time, throughput, and stability. Traditional QoS schemes primarily target DRAM-based homogeneous memory systems, exposing limitations when applied to diverse memory configurations. Moreover, the emergence of nonvolatile memories (NVMs) has made achieving QoS even more challenging due to their differing characteristics. While QoS schemes have been proposed for DRAM-based memory systems or hybrid memory systems combining DRAM and a single NVM type, there is a lack of research on QoS techniques for memory systems that incorporate multiple types of NVM simultaneously. Ensuring QoS in these heterogeneous memory environments is challenging due to significant differences in memory characteristics. In this paper, we propose a novel technique, dynamic affinity-based resource pairing (DARP), designed to enhance QoS in multicore heterogeneous memory systems. The proposed approach dynamically monitors the memory access patterns of applications and leverages the specific read/write characteristics of NVM devices. Detailed information from monitoring is used to optimally allocate memory data to the most suitable memory devices, ensuring stable memory response times and mitigating bottlenecks. Extensive experiments validate the efficiency and scalability of DARP across various workloads and heterogeneous memory configurations, including memory systems with multiple types of NVM. The results show that our technique significantly outperforms state-of-the-art QoS methods in terms of memory response time consistency and overall QoS in heterogeneous memory environments. DARP achieved a memory response time variability of 74.4% in six different memory configurations compared to the baseline on average, demonstrating its high scalability and effectiveness in enhancing QoS across various heterogeneous memory systems.

A passive keyless entry and start (PKES) system is an electronic lock for an automobile that provides the great convenience of opening the door when the user is in proximity. However, the system suffers from relay attacks. Recent studies revealed that relayed signals result in valid packets that are sufficient to unlock doors. In particular, the adversary causes proximity errors by injecting a certain time delay before relaying to manipulate the phase rotation in the response signal. To this end, we present a novel relay-resilient proximity detection solution, BackProx, which uses pseudo-random frequency hopping with the assistance of a reference backscattering device. Since the relay adversary transmits the relayed signals from the key fob at long distances, the signals should propagate over longer distances, resulting in inevitable significant phase rotation with different frequencies. Inspired by this finding, BackProx uses an additional backscattering device to ensure the proximity of the key fob using the invariant characteristics of radio frequency signals in the physical layer (i.e., phase rotation). Our evaluation demonstrates the effectiveness of BackProx in resisting three types of relay attacks. The results show that it achieved a 98% true positive rate at close range and a 0.3% false positive rate at long range.

Physical layer covert channels exploit the characteristics of radio signals to convey secret messages while remaining inconspicuous within wireless channels. With specifically designed modulation schemes, covert channels effectively disguise secret messages as noise. Since the intentionally embedded noise dissipates when the radio signal is decoded as a bitstream, adversaries can maintain a stealthy breach in communication systems. IoT devices, particularly, often utilize vendor-specific firmware and hardware whose security verification is too complex for everyday users. Hence, these devices can easily be compromised to transmit their data to unauthorized adversaries via the covert channels. To this end, we propose a novel countermeasure system, Ghost-Fi Detector, which detects the covert channels reliably and comprehensively. Our attack models reflect a real-world wireless network technology,Wi-Fi, and cover three aspects of its radio signal characteristics including amplitude, phase, and frequency. Since each model induces distinct manifestations in the received signal, there is no dominant universal detection mechanism that detects all the attack models simultaneously. Instead, Ghost-Fi detector consists of six precisely designed complementary defense mechanisms that perform passive radio-frequency analyses. Evaluation results show that Ghost-Fi Detector achieves an average hit rate of 95% with an almost zero false-positive rate for arbitrary Wi-Fi frames.

Radio-frequency identification (RFID) 시스템은 비용과 에너지 측면의 효율성으로 인해 사물인터넷 네트워크 기술의 핵심 구성 요소로 각광받고 있다. 특히, ultra high frequency (UHF) RFID 시스템에서는 다수의 태그가 수동적인 방법으로 통신하기 때문에 개별 태그를 식별하는 과정이 필수적이다. 하지만, 기존의 태그 식별자는 태그의 연산 자원 및 메모리의 한계로 인해 쉽게 복제되거나 예측될 수 있어 보안상 취약하다는 단점이 있다. 본 논문에서는 위조가 어려운 태그 고유의 물리적 특성 정보를 추출하여 태그 식별에 활용하는 기술을 제안한다. 제안한 기술은 태그의 백스캐터 신호를 분석하여 물리 계층 특징 중 시간 간격 오차와 위상을 추출하는 알고리즘과 이를 지문으로 활용하여 태그를 식별하는 알고리즘으로 구성된다. 본 논문에서는 제안 기술의 성능 평가를 위해 각 태그의 백스캐터 신호를 모델링하고 신호 대 잡음비에 따른 식별 정확도를 분석한다.

The prosperity of IEEE 802.11-based Wi-Fi networks aggravates cross-technology interference to IEEE 802.15.4-enabled ZigBee networks widely deployed to enable various Internet-of-Things applications. To make ZigBee communication reliable and robust even in a dense Wi-Fi environment, taming Wi-Fi interference in ZigBee networks especially from the perspective of physical layer is of paramount importance. In this context, this work takes aim to design a novel Wi-Fi interference-resilient ZigBee decoder called PolarScout, which separates collided ZigBee signal samples out of Wi-Fi interference to bootstrap ZigBee data decoding. Unlike several existing solutions which need clear signal preamble, tremendous signal strength difference between ZigBee and Wi-Fi, and Wi-Fi interference recognition in prior to ZigBee decoding, PolarScout aims at direct ZigBee decoding in a more generic and challenging case where Wi-Fi interference features a wide range of power levels and arises within a ZigBee packet at an arbitrary position. At the heart of PolarScout lies a subtle shell-shaping technique which harnesses a customized sample sequence to smooth the shell of corrupted signal samples. PolarScout then refers to the resulting shell to recover each contaminated ZigBee sample. Experimental results validate the superiority of PolarScout and its resilience to a wide range of Wi-Fi interference types.