줌의 보안 취약점 분석과 보안 업데이트 결과 비교 = Comparing Zoom's Security Analysis and Security Update Results

다국어 초록 (Multilingual Abstract)

As corona began to spread around the world, it had such a big impact on many people's lives that the word “Untact Culture” was born. Among them, non-face-to-face meetings naturally became a daily routine as educational institutions and many domestic and foreign companies used video conferencing service platforms.
Among many video conferencing service platforms, Zoom, the company with the largest number of downloads, caused many security issues and caused many concerns about Zoom's security.
In this paper, Zoom's security problems and vulnerabilities were classified into five categories, and Zoom's latest update to solve those problems and the 90-day security planning project were compared and analyzed. And the problem was solved and classified as unresolved. Three of the five parts have been resolved but are still described as how they should be resolved and improved in the future for the two remaining parts.

참고문헌 (Reference)

1 유혜정, "프라이버시를 제공하는 저작권 보호 프로토콜" (사)디지털산업정보학회 4 (4): 57-66, 2008

2 양정모, "클라우드 컴퓨팅의 신뢰성 향상 방안에 관한 연구" (사)디지털산업정보학회 8 (8): 107-113, 2012

3 지윤성, "줌(Zoom) 화상회의, 보안상 안전하지 않다 지윤성 팩트체커"

4 최은정, "줌 회원정보 수만건 다크웹서유출 주의"

5 애드 테크 101, "줌 보안 이슈:위험성,문제점,대안"

6 이상영, "이식성을 위한 메타데이터 기반의 CDSS 구축" (사)디지털산업정보학회 8 (8): 221-229, 2012

7 "언텍트(Untact, 비대면)" 한국진흥재단 2020

8 이정애, "수업 도중 음란물·욕설 ‘줌폭격’ 이뤄질라…뉴욕시 화상회의 플랫폼 ‘줌’ 퇴출"

9 "네이버 개인정보보호, 화상회의 앱 ‘줌(ZOOM)’의프라이버시 논란과 보안 이슈"

10 양환석, "공격정보 수집을 이용한 클라우드 서비스의 안전성 향상에 관한 연구" (사)디지털산업정보학회 9 (9): 73-79, 2013

11 정혜인, "개인정보관리체계계(PIMS)를 이용한 클라우드컴퓨팅 개인정보 보안 개선 방안 연구" (사)디지털산업정보학회 12 (12): 133-155, 2016

12 최아름, "‘줌’ 보안취약점 확인…정부차원 대책 마련 시급"

13 AEP코리아네트 블로그, "Zoom에서 지원하는E2EE(End-to-End Encryption)"

14 Zoom Official Blog, "Zoom’s Use of Facebook’s SDK in iOS Client"

15 Sarah Young, "Zoombombing Your Toddler : User Experience and the Communucation of Zoom’s Ptivacy Crisis" 35 : 147-153, 2020

16 이정태, "Zoom(줌) 개인정보 보호 및 보안 문제 20가지"

17 Zoom Official Blog, "Zoom Rolling Out End-to-End Encryption Offering"

18 Zoom Official Blog, "Webinar Recap – Ask Me Anything with Eric Yuan & Zoom Leadership:Oct. 21, 2020"

19 Erastus Karanja, "The role of the chief information security officer in the management of IT security" 25 (25): 300-329, 2017

20 Michael Chertoff, "The Impact of the Dark Web" (6) : 2015

21 Burkhardt, Marcus, "THE EVOLUTION OF FACEBOOK'S GRAPH API" 2020

22 Mehmet Balasaygun, "System and method for end-to-end encryption and security indication at an endpoint"

23 Zoom Official Blog, "Secure Your Zoom Account with Two-Factor Authentication"

24 THECITIZENLAB, "Move Fast and Roll Your Own Crypto ‘A Quick Look at the Confidentiality of Zoom Meetings’"

25 Thierry Le Pennec, "Inter-Network and inter-protocol video ocnference privacy method, apparatus, and computer program product"

26 Weaver, Jesse, "Facebook linked data via the graph API" 4 : 1245-1250, 2013

27 Deshpande, Ashwini M., "FPGA implementation of AES encryption and decryption" 1-6, 2009

28 Howard M. Zeidler, "END-TO-END ENCRYPTION SYSTEM AND METHOD OF OPERATION"

29 Blum, Josh, "E2E Encryption for Zoom Meetings"

30 Kristin Finklea, "Dark Web"

31 Kandukuri, Balachandra Reddy, "Cloud security issues" 517-520, 2009

32 Kalaiprasath, "CLOUD SECURITY AND COMPLIANCE - A SEMANTIC APPROACH IN END TO END SECURITY" 8 (8): 987-994, 2017

33 Zoom Official Blog, "CEO 보고서: 90일 완료 후Zoom의 계획"

34 Zoom Official Blog, "90-Day Security Plan Progress Report: June 3, 2020"

35 Zoom Official Blog, "90-Day Security Plan Progres Report: April 29, 2020"