Malicious screen unlocking device and method

Abstract

The present invention relates to a device and method for unlocking a malicious screen lock, wherein the device comprises: a detection unit for detecting the execution of the malicious screen lock; a fake application search unit for searching for the fake application in a storage device when the execution of the malicious screen lock is detected; an encryption code block detection unit for detecting a decryption code block by performing reverse engineering operations on the fake application; a decryption key generation unit for performing a decryption key generation process by analyzing the decryption code block to determine a candidate decryption seed, inputting the candidate decryption seed into a string generation function to obtain a decryption statement, and manipulating the decryption statement to generate a decryption key; and a malicious screen lock unlocking unit for unlocking the malicious screen lock using the decryption key.

Description

Technology Field

[0001] The present invention relates to screen unlocking technology, and more specifically, to a malicious screen unlocking device and method capable of providing a screen unlocking technique for a screen-locked Android application for anti-forensic countermeasures. Background Technology

[0003] As cases of theft and leakage of personal information stored on mobile devices increase, applications equipped with data hiding, encryption, and locking functions are being developed to protect it. While these security technologies are effective for protecting personal information, they act as anti-forensic techniques in digital forensic investigations, hindering evidence collection. In fact, there have been instances where digital information could not be collected due to anti-forensic applications. Therefore, research analyzing applications that employ anti-forensic techniques and devising countermeasures against them is essential.

[0004] Among these, screen lock applications provide a screen lock function that requires the input of a password unlock key to unlock the screen, and only users who know the specific password unlock key can unlock the device and access data stored on it. Due to this characteristic, they are sometimes exploited by malicious users to conceal criminal activities or obstruct investigations. Technology is required to resolve the difficulties in accessing data on the device caused by the use of such applications. Prior art literature

[0006] Korean Registered Patent No. 10-2311996 (October 6, 2021) The problem to be solved

[0007] One embodiment of the present invention aims to provide a malicious screen unlocking device and method capable of detecting a password unlock code block by performing reverse engineering operations on a disguised application.

[0008] One embodiment of the present invention aims to provide a malicious screen lock unlocking device and method capable of determining a candidate unlock seed by analyzing a password unlock code block and obtaining a password unlock statement by inputting the candidate unlock seed into a string generation function. means of solving the problem

[0010] Among the embodiments, a malicious screen lock unlocking device for unlocking a malicious screen lock by a fake application of a smartphone comprises: a detection unit that detects the execution of the malicious screen lock; a fake application search unit that searches for the fake application in a storage device when the execution of the malicious screen lock is detected; an encryption code block detection unit that detects a decryption code block by performing reverse engineering operations on the fake application; a decryption key generation unit that performs a decryption key generation process by analyzing the decryption code block to determine a candidate decryption seed, inputting the candidate decryption seed into a string generation function to obtain a decryption statement, and manipulating the decryption statement to generate a decryption key; and a malicious screen lock unlocking unit that unlocks the malicious screen lock using the decryption key.

[0011] The detection unit can detect the execution of the malicious screen lock by periodically monitoring the list of currently running processes and detecting the screen lock process that executes the malicious screen lock.

[0012] The above-mentioned disguised application search unit can search for the executable file of the screen lock process that executes the above-mentioned malicious screen lock as the above-mentioned disguised application.

[0013] The above encryption code block detection unit can search for a screen display code that displays the screen of the malicious screen lock and detect a code requesting the input of a password unlock key following the screen display code as the password unlock code block.

[0014] The above decryption key generation unit can determine the candidate decryption seed and the string generation function by analyzing the binary code sequence of the above decryption code block.

[0015] The above decryption key generation unit can generate the above decryption statement by inputting the above candidate decryption seed into the DES (Data Encryption Standard) algorithm.

[0016] The above-mentioned decryption key generation unit can generate the decryption key by selecting a password conversion table based on the binary code sequence of the above-mentioned decryption code block and repeating the selection or conversion of a specific position character of the above-mentioned decryption statement based on the above-mentioned password conversion table.

[0017] The above decryption key generation unit can perform the decryption key generation process independently for each of the encryption code blocks when there are multiple decryption code blocks.

[0018] The above malicious screen lock unlocking unit can terminate the screen locking process and delete the above fake application from the storage device when the unlocking of the above malicious screen lock is successfully performed.

[0019] Among the embodiments, a malicious screen lock unlocking method for unlocking a malicious screen lock by a fake application of a smartphone comprises: a detection step for detecting the execution of said malicious screen lock; a fake application search step for searching said fake application in a storage device when the execution of said malicious screen lock is detected; an encryption code block detection step for detecting an encryption code block by performing reverse engineering operations on said fake application; an encryption key generation step for performing an encryption key generation process in which a candidate encryption seed is determined by analyzing said encryption code block, said candidate encryption seed is input into a string generation function to obtain an encryption statement, and said encryption statement is manipulated to generate an encryption key; and a malicious screen lock unlocking step for unlocking said malicious screen lock using said encryption key.

[0020] The encryption code block detection step includes searching for a screen display code that displays the screen of the malicious screen lock and detecting a code requesting the input of a decryption key following the screen display code as the decryption code block.

[0021] The above decryption key generation step may include a step of determining the candidate decryption seed and the string generation function by analyzing the binary code sequence of the above decryption code block.

[0022] The above decryption key generation step can generate the above decryption statement by inputting the above candidate decryption seed into the DES (Data Encryption Standard) algorithm.

[0023] The above decryption key generation step may generate the decryption key by selecting a password conversion table based on the binary code sequence of the above decryption code block and repeating the selection or conversion of a specific position character of the above decryption statement based on the above password conversion table. Effects of the invention

[0025] The disclosed technology may have the following effects. However, this does not mean that a specific embodiment must include all of the following effects or only the following effects; therefore, the scope of the rights of the disclosed technology should not be understood as being limited by this.

[0026] A malicious screen unlock device and method according to one embodiment of the present invention can detect a password unlock code block by performing reverse engineering operations on a disguised application.

[0027] A malicious screen lock unlocking device and method according to one embodiment of the present invention can determine a candidate unlock seed by analyzing a password unlock code block and obtain a password unlock statement by inputting the candidate unlock seed into a string generation function. Brief explanation of the drawing

[0029] FIG. 1 is a drawing illustrating a malicious screen unlocking system according to the present invention. Figure 2 is a diagram illustrating the system configuration of the malicious screen unlock device of Figure 1. Figure 3 is a diagram illustrating the functional configuration of a malicious screen unlock device. FIG. 4 is a flowchart illustrating the functional configuration of a malicious screen unlock device according to the present invention. Figure 5 is a diagram illustrating an example of the overall operation of SLocker 1. Figure 6 is a diagram illustrating an example of the overall operation of SLocker 2. Figure 7 is a diagram illustrating the screen unlocking algorithms for SLocker 1 and SLocker 2. Specific details for implementing the invention

[0030] The description of the present invention is merely an example for structural or functional explanation, and therefore the scope of the present invention should not be interpreted as being limited by the examples described in the text. That is, since the examples are subject to various modifications and may take various forms, the scope of the present invention should be understood to include equivalents capable of realizing the technical concept. Furthermore, the objectives or effects presented in the present invention do not imply that a specific example must include all of them or only such effects; therefore, the scope of the present invention should not be understood as being limited by them.

[0031] Meanwhile, the meaning of the terms described in this application should be understood as follows.

[0032] Terms such as "first," "second," etc., are intended to distinguish one component from another, and the scope of rights shall not be limited by these terms. For example, the first component may be named the second component, and similarly, the second component may be named the first component.

[0033] When it is stated that one component is "connected" to another component, it should be understood that it may be directly connected to that other component, or that there may be other components in between. Conversely, when it is stated that one component is "directly connected" to another component, it should be understood that there are no other components in between. Meanwhile, other expressions describing the relationships between components, such as "between" and "exactly between," or "adjacent to" and "directly adjacent to," should be interpreted in the same way.

[0034] A singular expression should be understood to include a plural expression unless the context clearly indicates otherwise, and terms such as "include" or "have" are intended to specify the existence of the implemented features, numbers, steps, actions, components, parts, or combinations thereof, and should be understood not to preclude the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0035] In each step, identifiers (e.g., a, b, c, etc.) are used for convenience of explanation and do not describe the order of the steps; the steps may occur differently from the specified order unless a specific order is clearly indicated in the context. That is, the steps may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

[0036] The present invention may be implemented as computer-readable code on a computer-readable recording medium, and the computer-readable recording medium includes all types of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc. Additionally, the computer-readable recording medium may be distributed across networked computer systems, so that computer-readable code can be stored and executed in a distributed manner.

[0037] Unless otherwise defined, all terms used herein have the same meaning as generally understood by those skilled in the art to which this invention pertains. Terms defined in commonly used dictionaries should be interpreted as having meanings consistent with the context of the relevant technology and should not be interpreted as having an ideal or overly formal meaning unless explicitly defined in this application.

[0039] FIG. 1 is a drawing illustrating a malicious screen unlocking system according to the present invention.

[0040] Referring to FIG. 1, a malicious screen unlock system (100) may include a user terminal (110), a malicious screen unlock device (130), and a database (150).

[0041] The user terminal (110) may correspond to a computing device capable of receiving a decryption key from the user, encrypting an unencrypted file, and generating an encrypted file as a result. To this end, the user terminal (110) may install and run a dedicated application that provides data encryption. For example, the dedicated application may include an application that provides an encryption function to encrypt media files such as photos or video files.

[0042] The user terminal (110) may be composed of a single or multiple units, and if composed of multiple units, it may include a first user terminal, a second user terminal, ..., the nth (n is a natural number) user terminal. For example, the user terminal (110) may be implemented as a smartphone, laptop, or computer capable of operating in connection with the malicious screen unlock device (130), but is not necessarily limited thereto and may be implemented as various devices including a tablet PC. In addition, the user terminal (110) may be connected to the malicious screen unlock device (130) via a network, but is not necessarily limited thereto, and multiple user terminals (110) may be connected to the malicious screen unlock device (130) simultaneously.

[0043] The malicious screen lock unlock device (130) may be implemented as a server corresponding to a computer or program that performs the malicious screen lock unlock service according to the present invention. For example, the malicious screen lock unlock device (130) may be implemented as a server corresponding to a computer or program that can detect the execution of a malicious screen lock or identify and analyze a disguised application to generate a password unlock key and thereby unlock the screen lock, and each step of the malicious screen lock unlock method according to the present invention may be performed on the server. The malicious screen lock unlock device (130) may be connected to a user terminal (110) via a wired network or a wireless network such as Bluetooth, WiFi, or LTE, and may transmit and receive data with the user terminal (110) through the wired or wireless network.

[0044] Additionally, the malicious screen unlock device (130) may be implemented to operate in connection with an independent external system (not shown in FIG. 1). For example, the malicious screen unlock device (130) may operate in conjunction with a security management system that supports malicious screen lock detection and password unlocking processes.

[0045] The database (150) may correspond to a storage device that stores various information required during the operation of the malicious screen lock unlocking device (130). For example, the database (150) may store identification information of the disguised application used for the malicious screen lock and code blocks required for generating a password unlock key, and may store log data and analysis results generated during the screen lock unlocking process, not necessarily limited to these.

[0046] In FIG. 1, the database (150) is shown as a device independent of the malicious screen unlock device (130), but is not necessarily limited thereto and can be implemented by being included in the malicious screen unlock device (130).

[0048] Figure 2 is a diagram illustrating the system configuration of the malicious screen unlock device of Figure 1.

[0049] Referring to FIG. 2, the malicious screen unlock device (130) may include a processor (210), memory (230), user input / output unit (250), network input / output unit (270), and communication port unit (290).

[0050] The processor (210) can execute a malicious screen unlock service procedure according to an embodiment of the present invention, manage memory (230) that is read or written during this process, and schedule the synchronization time between volatile memory and non-volatile memory in memory (230). The processor (210) can control the overall operation of the malicious screen unlock device (130) and is electrically connected to memory (230), user input / output unit (250), and network input / output unit (270) to control the data flow between them. The processor (210) can be implemented as a CPU (Central Processing Unit) or GPU (Graphics Processing Unit) of the malicious screen unlock device (130).

[0051] The memory (230) may include an auxiliary storage device implemented as non-volatile memory such as an SSD (Solid State Disk) or HDD (Hard Disk Drive) and used to store all data required for the malicious screen unlock device (130), and may include a main memory device implemented as volatile memory such as RAM (Random Access Memory). Additionally, the memory (230) may store a set of instructions that execute the malicious screen unlock method according to the present invention by being executed by an electrically connected processor (210).

[0052] The user input / output unit (250) includes an environment for receiving user input and an environment for outputting specific information to the user, and may include an input device including an adapter such as a touch pad, touch screen, virtual keyboard, or pointing device, and an output device including an adapter such as a monitor or touch screen. In one embodiment, the user input / output unit (250) may correspond to a computing device connected via remote access, and in such case, the malicious screen unlock device (130) may be performed as an independent server.

[0053] The network input / output unit (270) provides a communication environment for connecting to a user terminal (110) through a network and may include an adapter for communication such as a LAN (Local Area Network), MAN (Metropolitan Area Network), WAN (Wide Area Network), and VAN (Value Added Network). Additionally, the network input / output unit (270) may be implemented to provide short-range communication functions such as WiFi and Bluetooth, or wireless communication functions of 4G or higher for wireless transmission of data.

[0054] The communication port section (290) can be implemented as a port mapping table that performs data routing during the process of transmitting and receiving data through a network. Here, the communication port section (290) can distinguish communication sessions between the user terminal (110) and the server and prevent data collisions during the process of transmitting and receiving data by assigning a unique source port to each user terminal (110).

[0056] Figure 3 is a diagram illustrating the functional configuration of a malicious screen unlock device.

[0057] Referring to FIG. 3, the malicious screen lock unlock device (130) may include a detection unit (310), a fake application search unit (320), an encryption code block detection unit (330), an encryption unlock key generation unit (340), a malicious screen lock control unit (350), and a control unit (360).

[0058] The malicious screen unlock device (130) does not necessarily have to include all of the above functional configurations simultaneously, and depending on each embodiment, some of the above configurations may be omitted, or some or all of the above configurations may be selectively included. Additionally, the malicious screen unlock device (130) may be implemented as an independent module that selectively includes some of the above configurations, and the malicious screen unlock method according to the present invention may be performed through the interlocking of each module. The operation of each configuration is described in detail below.

[0060] The detection unit (310) can detect the execution of a malicious screen lock. Here, the detection unit (310) can detect processes that potentially perform a malicious screen lock by periodically monitoring a list of processes running on the user terminal (110). For example, the detection unit (310) can detect the execution of a malicious screen lock by analyzing processes running on the user terminal (110) to detect characteristics related to the screen lock (e.g., process name and code pattern, etc.). In one embodiment, the detection unit (310) can identify a malicious screen lock process based on a process name different from a normal screen lock application, abnormal CPU usage, and a hidden application file path, etc.

[0061] In one embodiment, the detection unit (310) can detect the execution of a malicious screen lock by periodically monitoring a list of currently running processes and detecting a screen lock process that executes a malicious screen lock. For example, the detection unit (310) can periodically check the entire list of currently running processes by utilizing an API (Application Programming Interface) provided by the operating system (OS) or kernel-level process management information. Here, the detection unit (310) can do this by analyzing a system event log recorded immediately before the occurrence of the screen lock to identify the process execution trigger. In one embodiment, the detection unit (310) can detect the execution of a malicious screen lock by storing the detected process that executes the malicious screen lock in a database (150) and comparing the list of running processes with a predefined malicious process characteristic database.

[0062] The disguised application search unit (320) can search for a disguised application in a storage device (i.e., a database (150)) when the execution of a malicious screen lock is detected. Here, the disguised application may correspond to an application that appears like a normal application but actually performs malicious acts, for example, it may correspond to an application disguised with the name or icon of a normal app to avoid suspicion during the installation process. The disguised application search unit (320) stores characteristic information of the disguised application (e.g., file hash value, executable file path, encryption key structure, etc.) in the database (150) and can search for characteristic information of the disguised application from the database (150) when the execution of a malicious screen lock is detected. Here, the disguised application search unit (320) can perform a search in the database (150) based on search conditions including the application name, package information, and execution path associated with the malicious process.

[0063] In one embodiment, the disguised application search unit (320) can search for an executable file of a screen lock process that executes a malicious screen lock as a disguised application. Here, the disguised application search unit (320) can collect executable file information of a screen lock process that executes a malicious screen lock. Here, the executable file information may correspond to the process's execution path, file name, digital signature information, and file hash (MD5, SHA256, etc.). The disguised application search unit (320) can determine whether an application is a disguised application by performing a search in the database (150) based on the executable file information and comparing the executable file information with the list of malicious files in the database (150).

[0064] The encryption code block detection unit (330) can detect decryption code blocks by performing reverse engineering operations on the disguised application. Here, the reverse engineering operation may correspond to the process of analyzing an already created system (software and hardware, etc.) to identify its operating principles and internal structure, and the decryption code block may correspond to code used to decrypt encrypted data within the application. The encryption code block detection unit (330) can detect decryption code blocks of screen locking or data hiding applications that block data access by identifying the code portion containing the decryption process of encrypted data by performing reverse engineering operations on the executable file of the disguised application.

[0065] In one embodiment, the encryption code block detection unit (330) can search for a screen display code that displays a screen of a malicious screen lock and detect a code requesting password unlock key input following the screen display code as a password unlock code block. Here, the screen display code may correspond to code that controls the UI (User Interface) of the device to display a specific screen; for example, in a malicious screen lock, pop-up windows such as Dialog, AlertDialog, and SurfaceView may be utilized to obscure or control the UI of the user terminal (110) across the system. When a malicious screen lock is executed, the encryption code block detection unit (330) can search for a screen display code related to the screen display and track UI components and the execution point of the screen lock. Here, the encryption code block detection unit (330) can detect code that processes the user's password unlock key input by tracking event handlers (e.g., clicks and inputs) executed after the screen display. In one embodiment, the encryption code block detection unit (330) can detect the decryption code block and perform decryption key verification to analyze the function called upon successful decryption, thereby extracting key information such as the algorithm used for decryption, the key, and the initialization vector (IV).

[0066] The decryption key generation unit (340) can perform a decryption key generation process by analyzing a decryption code block to determine a candidate decryption seed, inputting the candidate decryption seed into a string generation function to obtain a decryption statement, and manipulating the decryption statement to generate a decryption key. Here, the candidate decryption seed may correspond to an initial value used to generate a decryption key, and may be composed of, for example, numbers, strings, and random numbers. The decryption key generation unit (340) can determine a candidate decryption seed related to the decryption key generation process and perform a decryption key generation process through a string generation function.

[0067] For example, the decryption key generation unit (340) can obtain a decryption statement by converting the input candidate decryption seed into a fixed-length string by providing the candidate decryption seed as input to a string generation function including hash functions such as MD5, SHA-256. In one embodiment, the decryption key generation unit (340) can generate a final decryption key by performing operations on the generated decryption statement according to specific rules. For example, the decryption key generation unit (340) can generate a final decryption key by manipulating the decryption statement according to specific rules such as string length manipulation, character conversion, and digit rearrangement.

[0068] In one embodiment, the decryption key generation unit (340) can determine candidate decryption seeds and string generation functions by analyzing the binary code sequence of the decryption code block. Here, the binary code sequence may correspond to machine code extracted from a software executable file or binary. The decryption key generation unit (340) can extract the binary code sequence for the decryption code block and identify decryption seed generation logic and string generation function calls from the binary code sequence. For example, the decryption key generation unit (340) can determine candidate decryption seeds and string generation functions by searching for decryption key related codes containing encryption / decryption related keywords such as "password," "Unlock," and "Decrypt" from the binary code sequence of the decryption code block.

[0069] In one embodiment, the decryption key generation unit (340) can generate a decryption statement by inputting a candidate decryption seed into the DES (Data Encryption Standard) algorithm. The DES algorithm is a symmetric key-based block encryption algorithm that processes data in 64-bit block units and can perform encryption and decryption using a 56-bit key. The decryption key generation unit (340) can perform the decryption process and generate a decryption statement by providing the candidate decryption seed as a key or plaintext input value for the DES algorithm. For example, the decryption key generation unit (340) can generate a decryption statement by dividing the 64-bit data of the candidate decryption seed into 16 blocks and performing bit operations, substitution, and key scheduling on each block. Here, key scheduling may correspond to the process of generating a sub-key to be used in the encryption and decryption process by modifying the primary key in the encryption algorithm.

[0070] In one embodiment, the decryption key generation unit (340) can generate a decryption key by selecting a password conversion table based on the binary code sequence of the decryption code block and repeating the selection or conversion of a character at a specific position of the decryption statement based on the password conversion table. The decryption key generation unit (340) can analyze the decryption code block given as input, select a password conversion table, and set criteria for converting the binary code sequence. For example, the decryption key generation unit (340) can analyze the structure of the code block and the data included in the binary code sequence and determine a specific password conversion table (e.g., the DES algorithm). Additionally, the decryption key generation unit (340) can select a character at a specific position of the decryption statement through the password conversion table and convert the selected character into another character using the password conversion table.

[0071] For example, the password decryption key generation unit (340) can convert a specific character into another character by performing a mathematical operation (e.g., XOR, Shift, etc.) on the character through a password conversion table. In one embodiment, the password decryption key generation unit (340) can generate a password decryption key by repeating the process until all characters of the password decryption code block or characters of a specified range are processed.

[0072] In one embodiment, the decryption key generation unit (340) can perform a decryption key generation process independently for each encryption code block when there are multiple decryption code blocks. Here, when there are multiple decryption code blocks, such as multiple screen lock unlocking related data and encryption structures divided into multiple sections, the decryption key generation unit (340) can perform a decryption key generation process independently, excluding interdependence between encryption code blocks. For example, the decryption key generation unit (340) can independently generate a decryption key for each encryption code block by setting an initial candidate decryption seed for each encryption code block and performing mathematical operations individually.

[0073] The malicious screen lock release unit (350) can perform the unlocking of the malicious screen lock using a password unlock key. Here, the malicious screen lock release unit (350) can verify whether specific conditions required by the locking process of the fake application are satisfied by inputting the password unlock key into the fake application. If the password unlock key is valid for the fake application, the malicious screen lock release unit (350) can unlock the malicious screen lock by forcibly terminating the process executing the malicious screen lock and delete the fake application that caused the lock state from the database (150).

[0074] In one embodiment, the malicious screen lock release unit (350) may terminate the screen lock process and delete the fake application from the storage device when the unlocking of the malicious screen lock is successfully performed. Here, the malicious screen lock release unit (350) may perform the role of restoring the user terminal (110) to a normal state by completely removing remaining malicious elements after successfully unlocking the malicious screen lock state. For example, the malicious screen lock release unit (350) may detect the presence of other fake applications or malicious code on the user terminal (110) by storing a record of operations related to screen lock unlocking as a log and performing additional security checks. In one embodiment, the malicious screen lock release unit (350) may perform deletion of the fake application, including executable files, related configuration files, and data storage, and restore it to the initial settings for normal system recovery.

[0075] The control unit (360) controls the overall operation of the malicious screen lock unlock device (130) and can manage the control flow or data flow between the detection unit (310), the fake application search unit (320), the encryption code block detection unit (330), the encryption unlock key generation unit (340), and the malicious screen lock control unit (350).

[0077] FIG. 4 is a flowchart illustrating the functional configuration of a malicious screen unlock device from the perspective of an encoder according to the present invention.

[0078] Referring to FIG. 4, the malicious screen lock unlock device (130) can detect the execution of a malicious screen lock based on the detection unit (310) (step S410). When the execution of a malicious screen lock is detected through the fake application search unit (320), the malicious screen lock unlock device (130) can search for a fake application in the storage device (step S430). The malicious screen lock unlock device (130) can detect a decryption code block by performing a reverse engineering operation on the fake application through the encryption code block detection unit (330) (step S450).

[0079] The malicious screen lock unlock device (130) can perform a password unlock key generation process by analyzing a password unlock code block through a password unlock key generation unit (340) to determine a candidate password unlock seed, inputting the candidate password unlock seed into a string generation function to obtain a password unlock statement, and manipulating the password unlock statement to generate a password unlock key (step S470). The malicious screen lock unlock device (130) can perform unlocking of the malicious screen lock using the password unlock key through a malicious screen lock unlock unit (350) (step S490).

[0081] Figure 5 is a diagram illustrating an example of the overall operation of SLocker 1.

[0082] In FIG. 5, SLocker 1 may correspond to a typical ransomware-type application that executes a malicious screen lock. For example, SLocker 1 completely blocks the UI of the user's device and prevents key inputs and touch events, thereby hindering normal device usage.

[0083] In one embodiment, SLocker 1 may be installed disguised as a fake application called 'Free Followers'. Here, when the installed 'Free Followers' is clicked, a screen lock process is executed along with a warning message. The lock screen contains content that induces payment of a certain amount to unlock the screen, and the screen lock containing the warning message can only be unlocked by entering the correct password unlock key into the input field within the lock screen. When the string 'Abdullah@', which corresponds to the password unlock key coded within the fake application of SLocker 1, is entered, the screen lock of the user terminal (110) can be unlocked, and additionally, data stored on the user terminal (110) can be accessed.

[0085] Figure 6 is a diagram illustrating an example of the overall operation of SLocker 2.

[0086] In FIG. 6, SLocker 2 may correspond to an advanced malicious screen lock application that extends the functions of SLocker 1 of FIG. 5. SLocker 2 may include a multi-step screen unlocking process, and the lock may be unlocked only when a password unlock key is entered at each step.

[0087] In one embodiment, SLocker 2 may be installed by disguising itself as a fake application called an 'Automatic Connector'. Here, when the installed 'Automatic Connector' is clicked, a window for setting service usage permissions is displayed, and if the user agrees to use the service, the application is executed and a screen locking process may be performed along with a warning message. The lock screen may include content that induces the user to pay a certain amount to unlock the screen along with a serial number, and the screen lock containing the warning message disappears only when the correct password unlock key is entered into the input field on the lock screen.

[0088] SLocker 2 can generate a password unlock key to unlock the lock screen in a total of three stages based on a serial number. Here, Stage 1 corresponds to the first lock screen. Then, entering the password unlock key generated using the serial number from Stage 1 changes the screen to Stage 2, and entering a password unlock key generated based on the serial number displayed on the Stage 2 screen changes the screen to Stage 3. Finally, entering a password unlock key generated based on the serial number displayed on the last Stage 3 screen allows the final screen lock to be unlocked. During the process of generating password unlock keys in Stages 2 and 3, there is a process of matching numbers to characters, and the characters matched for each number are as shown in Table 1 below.

[0089] [Table 1]

[0090]

[0092] Figure 7 is a diagram illustrating the screen unlocking algorithms for SLocker 1 and SLocker 2.

[0093] Referring to Fig. 7, first, it is checked whether the screen lock application is SLocker 1. If the screen lock application corresponds to SLocker 1, the screen lock can be unlocked by entering the fixed password 'Abdullah@' on the lock screen.

[0094] Next, a process is performed to check whether the screen lock application corresponds to SLocker 2. Here, if the screen lock application is not SLocker 2 but another application, the screen lock unlocking algorithm can be terminated, and if the screen lock application corresponds to SLocker 2, a three-step password unlocking key generation process is required.

[0095] The password unlock key generation process is as follows. First, the first-stage serial number is encrypted by the DES algorithm using the fixed password key "敎主". After removing [a-fA-F] from the encryption result and extracting the first 5 characters, a password unlock key capable of unlocking the first-stage screen lock can be generated, and entering the generated password unlock key on the lock screen will switch to the second-stage screen.

[0096] Next, after unlocking the first-stage screen lock, the result obtained by subjecting the serial number displayed on the second-stage screen to the following two conversion processes is encrypted by the DES algorithm using the fixed password key "mop". The method used for the first conversion process is that when there are numbers from 0 to 9, the numbers are changed to the corresponding matching characters. After converting the numbers in the serial number to characters, the second conversion process of reversing the converted string is performed. After repeating the two conversion processes twice, the resulting generated string is encrypted with the DES algorithm. The encrypted result is hashed by the MD5 hash function, [a-fA-F] is removed, and the first 5 characters are extracted, thereby generating a password unlock key capable of unlocking the second-stage screen lock. Entering this key on the lock screen will switch to the third-stage screen.

[0097] The third-stage process is all identical to the encryption process of the second-stage process, except that the fixed password key is changed to "Android半島". After encryption, only the final 8-character string is extracted, and thus a password unlock key capable of unlocking the final screen lock is generated.

[0099] While the present invention has been described with reference to the preferred embodiments thereof, those skilled in the art will understand that various modifications and changes can be made to the present invention without departing from the spirit and scope of the present invention defined in the claims below. Description of Reference Numerals

[0101] 100: Malicious screen lock unlocking system 110: User terminal 130: Malicious screen unlock device 150: Database 210: Processor 230: Memory 250: User I / O Section 270: Network I / O Section 290: Communication port section 310: Detection unit 320: Camouflage application search unit 330: Encryption code block detection unit 340: Decryption key generation unit 350: Malicious screen unlock unit 360: Control unit

Claims

Claim 1 A malicious screen lock unlocking device for unlocking a malicious screen lock by a fake application of a smartphone, wherein the malicious screen lock unlocking device comprises: a detection unit for detecting the execution of the malicious screen lock; a fake application search unit for searching the fake application in a storage device when the execution of the malicious screen lock is detected; an encryption code block detection unit for detecting a decryption code block by performing reverse engineering operations on the fake application; a decryption key generation unit for performing a decryption key generation process that analyzes the decryption code block to determine a candidate decryption seed, inputs the candidate decryption seed into a string generation function to obtain a decryption statement, and manipulates the decryption statement to generate a decryption key; and a malicious screen lock unlocking unit for unlocking the malicious screen lock using the decryption key. Claim 2 A malicious screen lock unlocking device according to claim 1, wherein the detection unit detects the execution of the malicious screen lock by periodically monitoring a list of currently running processes and detecting a screen lock process that executes the malicious screen lock. Claim 3 A malicious screen lock unlocking device according to claim 1, wherein the above-mentioned fake application search unit searches for the executable file of a screen lock process that executes the malicious screen lock as the fake application. Claim 4 A malicious screen lock unlocking device according to claim 1, wherein the encryption code block detection unit searches for a screen display code that displays the screen of the malicious screen lock and detects a code requesting the input of a password unlock key following the screen display code as the password unlock code block. Claim 5 A malicious screen lock unlocking device according to claim 1, wherein the password unlock key generation unit analyzes the binary code sequence of the password unlock code block to determine the candidate password unlock seed and the string generation function. Claim 6 In claim 5, the malicious screen lock unlocking device is characterized in that the password unlock key generation unit inputs the candidate password unlock seed into the DES (Data Encryption Standard) algorithm to generate the password unlock statement. Claim 7 A malicious screen lock unlocking device according to claim 6, wherein the password unlock key generation unit selects a password conversion table based on a binary code sequence of the password unlock code block, and generates the password unlock key by repeating the selection or conversion of a specific position character of the password unlock statement based on the password conversion table. Claim 8 A malicious screen lock unlocking device according to claim 1, wherein the password unlock key generation unit performs the password unlock key generation process independently for each of the encryption code blocks when there are multiple password unlock code blocks. Claim 9 A malicious screen lock unlocking device according to claim 1, wherein the malicious screen lock unlocking unit terminates the screen locking process and deletes the disguised application from the storage device when the unlocking of the malicious screen lock is successfully performed. Claim 10 A malicious screen lock unlocking method for unlocking a malicious screen lock by a fake application on a smartphone, wherein the malicious screen lock unlocking method comprises: a detection step for detecting the execution of the malicious screen lock; a fake application search step for searching the fake application in a storage device when the execution of the malicious screen lock is detected; an encryption code block detection step for detecting a decryption code block by performing reverse engineering operations on the fake application; a decryption key generation step for performing a decryption key generation process in which a candidate decryption seed is determined by analyzing the decryption code block, the candidate decryption seed is input into a string generation function to obtain a decryption statement, and the decryption statement is manipulated to generate a decryption key; and a malicious screen lock unlocking step for unlocking the malicious screen lock using the decryption key. Claim 11 A method for unlocking a malicious screen lock according to claim 10, wherein the encryption code block detection step comprises the step of searching for a screen display code that displays the screen of the malicious screen lock and detecting a code requesting the input of a password unlock key following the screen display code as the password unlock code block. Claim 12 A malicious screen unlocking method according to claim 10, wherein the password unlocking key generation step includes the step of analyzing the binary code sequence of the password unlocking code block to determine the candidate password unlocking seed and the string generation function. Claim 13 A malicious screen unlocking method according to claim 12, wherein the decryption key generation step comprises inputting the candidate decryption seed into the DES (Data Encryption Standard) algorithm to generate the decryption statement. Claim 14 A malicious screen unlocking method according to claim 13, wherein the password unlocking key generation step comprises selecting a password conversion table based on a binary code sequence of the password unlocking code block and repeating the selection or conversion of a specific position character of the password unlocking statement based on the password conversion table to generate the password unlocking key.

Images