온라인수색 이용 랜섬웨어 조직의 가상자산 압수방안 = Seizure of Ransomware Group’s Virtual Assets Using Network Investigative Technique

다국어 초록 (Multilingual Abstract)

Ransomware extends the scope of attacks from individuals to government agencies and companies, encrypting key data and requiring virtual assets as recovery costs. The amount of damage caused by ransomware has been increasing, reaching 4.742 trillion won over the past five years, but the results of confiscating the paid criminal proceeds are insufficient. Crimes using virtual assets can be traded anonymously and have transnational characteristics, so there is a limit to response with traditional investigative techniques. Therefore, in this study, memory and disk analysis are conducted to determine whether information necessary for the seizure of virtual assets can be checked when searching for PCs online used for virtual asset laundering. An experiment was conducted on four types of virtual asset wallets (MetaMask, BitPay, Exodus, Phantom) to obtain a mnemonic code, wallet private key, virtual asset private key, and wallet password. As a result of the experiment, it was confirmed that wallet restoration information can be obtained from MetaMask, BitPay, Exodus, and Phantom, and virtual assets can be seized. This study can contribute to urging the start of discussions on the introduction and utilization of online search as a way to seize virtual assets used in ransomware crimes.

국문 초록 (Abstract)

랜섬웨어는 개인에서 정부기관과 기업을 대상으로 공격 범위를 확대하여 주요 데이터를 암호화하고 복구비용으로 가상자산을 요구한다. 랜섬웨어로 인한 피해금액은 지난 5년간 4조7,423억 원에 달하는 등 갈수록 증가하고 있으나 범죄수익을 압수하는 성과는 부족한 실정이다. 가상자산 범죄는 익명거래가 가능하고 초국가적 특성을 가져 전통적인 수사기법으로는 대응에 한계가 존재한다. 따라서 본 연구에서는 가상자산 지금 세탁에 사용한 PC를 온라인수색하였을 때 가상자산 압수에 필요한 정보를 확인할 수 있는지에 대해 메모리와 디스크 분석을 진행하였다. 가상자산 지갑 4종(MetaMask, BitPay, Exodus, Phantom)을 대상으로 니모닉 코드, 지갑 비밀키, 가상자산 비밀키, 지갑 비밀번호를 획득하는 실험을 하였다. 실험 결과, MetaMask, BitPay, Exodus, Phantom에서 지갑 복원 정보를 얻을 수 있어 가상자산 압수가 가능한 것으로 확인되었다. 본 연구는 랜섬웨어 범죄에 이용되는 가상자산 압수를 위한 방안으로 온라인수색 도입·활용 논의의 시작을 촉구하는 데에 기여할 수 있을 것이다.

참고문헌 (Reference)

• 1 지무현 ; 김태영 ; 김호, "테러수단으로서 가상자산 디지털포렌식 분야의 법적·제도적 개선방향 연구" 한국치안행정학회 18 (18): 221-240, 2021
• 2 정근범 ; 정주섭, "테러단체의 국제범죄 개입 현상에 관한 연구: 사례 연구를 중심으로" 한국경찰연구학회 21 (21): 163-186, 2022
• 3 이원상, "클라우드 컴퓨팅 환경에서의 디지털 증거 확보를 위한 소고" 대검찰청 (38) : 174-217, 2013
• 4 오기두, "정보통신망 모니터링에 의한 범죄통제의 적합성" 한국형사법무정책연구원 27 (27): 1-33, 2016
• 5 신상미, "온라인수색의 법률적 문제점과 허용가능성" 경찰대학 20 (20): 173-200, 2020
• 6 이원상, "온라인수색의 도입 필요성과 한계 - 아동·청소년 대상 디지털 성범죄를 대상으로" 한국비교형사법학회 24 (24): 183-212, 2022
• 7 김연희, "온라인 수색 도입을 위한 문제점과 방안에 관한 소고" 부설법학연구소 64 : 285-322, 2020
• 8 김학경, "영국 수사권한법에 규정된 온라인수색 법제에 관한 소고" 대검찰청 (74) : 62-103, 2022
• 9 곽지현, "암호화폐 관련 범죄에 대한 형사법적 고찰" 법학연구소 26 (26): 211-242, 2022
• 10 박희영 ; 이상학, "암호통신감청 및 온라인수색에서 부수처분의 허용과 한계" 한국형사법무정책연구원 30 (30): 113-146, 2019
• 11 송영진, "수사기관의 클라우드 데이터 접근에 관한 비판적 고찰 : “데이터 예외주의” 논쟁과 각국의 실행을 중심으로" 한국형사법무정책연구원 30 (30): 149-180, 2019
• 12 박희영, "수사 목적의 암호통신감청(Quellen TKÜ)의 허용과 한계" 한국형사법무정책연구원 29 (29): 25-60, 2018
• 13 이두홍 ; 이상진, "사이버 범죄 피해 가상화폐의 환수ㆍ환부 절차 연구" 한국경찰학회 23 (23): 123-152, 2021
• 14 안정언 ; 이상진, "비트코인 지갑의 아티팩트 분석 연구" 한국디지털포렌식학회 16 (16): 74-85, 2022
• 15 류부곤, "비닉성 온라인 플랫폼을 이용한 범죄에 대한 법적 대응방안" 경찰대학 21 (21): 29-60, 2021
• 16 박희영, "보안취약점 이용 온라인수색과 국가의 기본권 보호의무" 한국비교형사법학회 24 (24): 149-182, 2022
• 17 김학경, "미국의 온라인수색 제도에 관한 연구: 연방형사소송규칙 제41장 개정내용 중심으로" 한국경호경비학회 (72) : 1-28, 2022
• 18 윤지영, "디지털 성범죄 대응을 위한 수사법제 개선 방안 - 온라인 수색과 잠입수사 법제화를 중심으로 -" 한국형사정책학회 32 (32): 41-73, 2020
• 19 윤배경, "가상화폐의 법적 성질과 민·형사상 강제집행" 대한변호사협회 (474) : 6-24, 2018
• 20 Sun Jong Soo, "he Problem of Confiscation, Search and Admissibility of Virtual Curr ency" 21 (21): 307-332, 2020
• 21 Ashok Koujalagi, "The wannacry ransomeware, a meg a cyber attack and their consequences on the modern india" 6 (6): 1-4, 2018
• 22 Lawtimes, "The status of the prosecution's return on criminal proceeds is"
• 23 ElectronicFrontierFoundation, "The playpen cases:frequently asked questions"
• 24 CCTVnews, "The U.S. confiscates 600 million won worth of Bitcoin froma book hacker who distributed Maui ra nsomware"
• 25 Hyun-soo Moon, "Shin Dong hyang of legal science 2" Supreme Prosecutors' Office 2020
• 26 Seulgi Lee, "Response strategies and techniques by attack timeline to reduce ransomware damage" 32 (32): 27-31,
• 27 NEWSIS, "Ransomware is dead for a national call taxi...Police and KISA dispatched experts to launch an investigation"
• 28 News1, "Ransomware crime has doubled, but...The return of criminal proceeds is a 'blind spot'"
• 29 ComputerWorld, "Ransomware aimed at virtual assets in the first half of the year is on the ris e. A 'tourism industry' warning in the second half of the year"
• 30 KISA, "Ransomware Malicious Code Analysis Technical Report" 1-92, 2019
• 31 ZiHan W, "RansomTracer: Exploiting Cyber Deception fo r Ransomware Tracing" 1-8, 2018
• 32 KISA, "RANSOMWARE TRENDS & STATISTICS First Quarter for 2022" 1-31, 2022
• 33 Hun-jae Choi, "Proposal of the standard procedure for virtual currency search & seizure and method of managing seized materials using threshold multisignature" The Graduate School S eoul National University 2020
• 34 L. Van Der Horst, "Process Memory Investigation of the Bitcoin Clients Electrum and Bitcoin Core" 5 : 22385-22398, 2017
• 35 박광선 ; 최동희 ; 신지호, "PC 웹 브라우저 기반 탈중앙화 가상자산 지갑 카이카스의 니모닉 노출 위험" 치안정책연구소 36 (36): 349-380, 2022
• 36 BBCnews, "North Korea: U.S. authorities recover 600 million worth of Bitcoin extorted by North Korean hackers"
• 37 Ki-Woon Moon, "Latest ransomware trends and development directio ns" 32 (32): 33-39, 2022
• 38 CWN, "Kaseya Ransomware Attack Unencrypted Key. Keep it secret for 3 weeks.face criticism"
• 39 Ministry of Science and ICT, "Issued a warning for infringement of malicious programs (rans omware) requesting money and valuables"
• 40 Korean National Police Agency, "Issued a warning for infringement of malicious programs (r ansomware) requesting money and valuables"
• 41 Legislation.gov.uk, "Investigatory Powers Act 2016"
• 42 Bloomberg, "Hackers Breached Colonial Pipeline Using Compromised Password"
• 43 Cyber Crime Magazine, "Global Ransomware Damage Costs Predicted To Exceed $265 Billion By 2031"
• 44 Hee-young Park, "German legal trends on online search as a legitimate hacking act by the state" 1 : 55-57, 2019
• 45 MIST, "Gathering capabilities to respond to malware (ransomware) that demand money and g oods, secure digital transformation and support the New Deal"
• 46 Korean National Police Agency, "Four people, including money laundering chief of internation al criminal organizations that distributed CLOP ransomware around the world, were booked"
• 47 The Washington Post, "FBI held back ransomware decryption key from businesses to run oper ation targeting hackers"
• 48 Eui-Gi Shin, "Establishment of Online Search System for Security Case Investigation" 1 (1): 7-36, 2021
• 49 The United States DEPARTMENT of JUSTICE, "Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside"
• 50 NEWSWORKER, "Delivery agency platform 'Super Hero' surrendered to hackers... "Ransomwa re" that E-Land also suffered"
• 51 Tin T, "Cryptocurrencies and Blockchain Technology" Springer 447-457, 2020
• 52 Seong-jin Yeon, "Cryp tocurrency-related Crime and Criminal Justice" Korean Institute of Criminology 1-401, 2017
• 53 uGuard, "Colonial Pipeline – Timeline Of Events"
• 54 Kevin L, "Behind closed door: measurement and analysi s of CryptoLocker ransoms in Bitcoin" 1 (1): 1-13, 2016
• 55 Dae-keun Kim, "Analysis of New Financial Fra uds and Research on Criminological Measures-Cyber-financial Fraud Using Technology" Korean Institute of Criminology 1-535, 2016
• 56 Stephan Zollner, "An Automated Live Forensic and Postmortem Analysis Tool for Bitc oin on Windows Systems" 7 : 158250-158263, 2019
• 57 Xie X, "AWAP: Adaptive weighted attribute pro pagation enhanced community detection model for bitcoin de-anonymization" 1 (1): 1-15, 2021
• 58 Jang-hun Kim, "A study on the methods of securing crytocurrency using digital forens ics" The Graduate School Dongkuk University 2018
• 59 Yi-Hyeon Jung, "A study on the legislation of online search" The Graduate School Su ngkyunkwan University 2021
• 60 Yong-pil Kim, "A study on the concept and investigation procedure of cryptocurrency" The Graduate School Seoul National University 2020
• 61 Eun-sook Kim, "A study on securing the effective seizure of cryptocurrency crime" The Graduate School Dongkuk University 2018
• 62 Hyun-wook Chun, "A Study on the Introduction of Investigation Online Se arch System to Secure Digital Evidence" Korean Institute of Criminology 1-160, 2012
• 63 Ha-young Kim, "A Study on the Introduction of Equipment Interference in the Anonymous Communication" The Graduate School Sungkyunkwan University 2022
• 64 Seung-soo Han, "A Study on the Institutional Improvement for Darkweb Cybercrime I nvestigation" The Graduate School Dongkuk University 2020
• 65 Yan W, "A Bitcoin Transaction Network Analytic Method for Future Blockchain Forensic Investigation" 8 (8): 1230-1241, 2020
• 66 Hankyoreh, "4.5 billion Ethereum stolen by hacking, recovered from overseas exchanges"
• 67 Korean National Police Agency, "2022 Cybercrime Trend" 1-37, 2022
• 68 Korean National Police Agency, "2022 Cybercrime Trend" 1-37, 2022
• 69 CONCERT, "2021 Ransomware Special Report" 1-102, 2021
• 70 CYBEREDGE GROUP, "2020 Cyberthreat Defense Report" 15-, 2020
• 71 FBI Affidavit, "(Case3-21-mj-70945-LB) Affidavit in support of an applicattion for a seizure warrant"
• 72 UNITED STATES DISTRICT, "(Case 3:21-mj-70945-LB) WARRNT TO SEIZE PROPERTY SUBJECT TO FORFEITURE"
• 73 UNITED STATES DISTRICT, "(Case 3:21-mj-70945-LB) AFFIDAVIT IN SUPPORT OFAN APPLICATION FOR A SEIZURE WARRANT"