It is a technique used to compromise the security of network switches that connect network segments or network devices. These switches map individual MAC addresses on the network to the physical ports on the switch through the means of a CAM table. Unlike a hub, which broadcasts the data across the network, the switch sends data only to the intended recipient. Thus, a switched network is more secure when compared to hub Network. But, it can still be compromised by the fact that switches have limited memory to store MAC address tables and turn into hubs when flooded with MAC address beyond their storage. The technique used to compromise a switched network based on limited storage is called MAC flooding.
Typical MAC flooding involves flooding a switch with numerous requests with different fake source MAC address. No problem occurs until the MAC address table is full. Once the MAC address table is full, any further requests may force the switch to enter "failopen mode"Aswitch in failopen modeacts like a hub and broadcasts data to all machines on the network.
Internet Worm Maker Thing(IWMT) is a tool specifically designed for generating a worm. These generated Internet worms try to spread over networks that are basically preset invasion proxy attacks that target the host technically, poison it, and make a base and plans to launch the attack in future. The worms work independently. An internet worm sends copies of itself via vulnerable computers on the Internet.
TeraBit virus maker is a virus that is mostly detected by all antivirus software when scanned. This virus mostly doesn't harm the PC, but it can disable the antivirus that is installed on the system for a short time.
2. JPS Virus maker and DELmE's Batch Virus Maker
JPS Virus maker is a tool to create viruses. It also has a feature to convert a virus into a worm and can be used to disable the normal hardware of the system.
Macro Viruses
Microsoft Word or similar applications can be infected through a computer virus called macro virus, which automatically performs a sequence of actions when the application is triggered or something else. Most macro viruses are written using the macro language Visual Basic for Applications(VBA) and they infect templates or convert infected documents into template files, while maintaining their appearance of ordinary document files. Macro viruses are somwhat less harmful than other types. They are usually spread via an email. Pure data files do not allow the spread of viruses, but sometimes the line between a data file and an executable file is easily overlooked by the average user due to the extensive macro languages in some programs. In most cases, just to make things easy for users, the line between a data file and a program starts to blur only in cases where the default macros are set to run automatically every time the data file is loaded. Virus writers can exploit common programs with macro capability such as Microcode. In addition, the latest exploited macrocode exists in the full version of the Acrobat program that reads and writes PDF files.
The three-way handshake process goes as follows :
to launch a TCP connection, the source(192.168.0.2:8080) sends a SYN packet to the destination(192.168.0.8:21).
the destination, on receiving the SYN packet, i.e, sent by the source, responds by sending a SYN/ACK packet back to the source.
This ACK packet confirms the arrival of the first SYN packet to the source.
In conclusion, the source sends an ACK packet for the ACK/SYN packet sent by the destination.
This triggers an "OPEN" connection allowing communication between the source and the destination, until either of them issues a "FIN" packet or a "RST" packet to close the connection.
HTTP Tunneling allows you to use the Internet despite having firewall restrictions such as blocking specific firewall ports to restrict specific protocol communication. HTTP tunneling helps you to overcome this firewall restriction by sending specific protocol communication through HTTP protocol.
The attacker may use this technique for the following reasons:
It assures the attacker that no one will monitor him or her while browsing.
It helps the attacker to bypass firewall restrictions.
It ensures secure browsing.
The attacker can hide his or her IP address from being trapped.
It assures that it is highly impossible for others to identify attacker online.
To hide the source IP address so that an attacker can hack without any legal corollary.
To mask the actual source of the attack by impersonating a fake source address of the proxy.
To remotely access intranets and other website resources that are normally off limits.
To interrupt all the requests sent by an attacker and transmit them to a third destination, hence victims will only be able to identify the proxy server address.
Attackers chain multiple proxy server to avoid detection.
[Proxy chaining tools]
Proxy workbench : Proxy workbench is a proxy server that displays the data passing through it in real time, allows you to drill into particular TCP/IP connections, view their history, save the data to a file, and view the socket connection diagram. The socket connection diagram is an animated graphical history of all of the events that took place on the socket connection. It is able to handle HTTPS(secure sockets)and POP3 natively.
Proxifier : Proxifier allows network applications that do not support working through proxy server to operate through a SOCKS or HTTPS proxy and chains. It allows you to surf websites that are restricted or blocked by your government, organization, etc. by bypassing the firewalls rules.
Proxy switcher : Proxy switcher allows you to surf anonymously on the Internet without disclosing your IP address. It also helps you yo access various sites that have been blocked in the organization. It avoids all sorts of limitations imposed by sites.
SocksChain : SocksChain is a program that allows you to work with any Internet service through a chin of SOCKS or HTTP proxies to hide the ral IP address. It can function as a usual SOCKS-server that transmits queries through a chain of proxies. It can be used with client programs that do not support the SOCKS protocol, but work with on TCP-connection, such as TELNET, HTTP, IRC, etc. It hides your IP from being displayed in the server's log or mail headers.
TOR(The Onion Routing) : TOR is software and an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis. You can use TOR to prevent websites from tracking you on the Internet. You can also connect to news sites and instant messaging services when these sites are blocked by your network administrator. TOR makes it difficult to trace your Internet activity as it conceals a user's location or usage.
1. Nessus(http://tenable.com)
Data gathering, Host identification, Port scan, Plug-in selection, reporting of data.
2. GFI LanGuard(http://www.gfi.com)
Selectively creates custom vulnerability checks, Identifies security vulnerabilities and takes remedial action, Creates different types of scans and vulnerability tests, Helps ensurce third party security applications offer optimum protection, Performs network devices vulnerability checks.
3. SAINT(http://www.saintcorporation.com)
Detects and fixes possible weaknesses in your network's security, Anticipates and prevents common system vulnerabilities, Demonstrates compliance with current government and industry regulations such as PCI DSS, NERC, FISMA, SOX, GLBA, HIPAA, and COPPA, Performs compliance audits with policies defined by FDCC, USGCB, and DISA.
1. ID Serve(http://www.grc.com)
ID Serve is used to identify the make, model, and version of any website's server softwarel it is also used to identify non-HTTP(non-web) Internet servers such as FTP, SMTP, POP, etc.
2. Netcraft(http://toolbar.netcraft.com)
Netcraft reports a site's operation system, web server, and netblock owner together with, if available, a graphical view of the time since last reboot for each of the computers serving the Web site.
3. Netcat(http://netcat.sourceforge.net)
Netcat is a networking utility that reads and writes data across network connections, with the help of the TCP/IP protocol/ It is designed to be a reliable "back-end" tool that can be used directly or easily driven by other programs and scripts. It provides access to the following key features:
Outbound and inbound connections, TCP or UDP, or any ports.
Featured tunneling mode, which also allows special tunneling such as UDP to TCP, with the possibility of specifying all network parameters(source port/interface, listening port/interface), and the remote host allowed to connect to the tunnel.
Built-in port-scanning capabilities, with randomizer.
Advanced usage options, such as buffered send-mode(one line every N seconds) and hexdump(to stderr or to a specified file) of transmitted and received data.
1. Xmas scan
Xmas scan is a port scan technique with ACK, RST, SYN, URG, PSH and FIN flage set to send a TCP frame to a remote device. If the target port is closed, then you will receive a remote system reply with a RST. You can use this port scan technique to scan large networks and find which host is ip and what services it is offering. It is a technique to describe all TCP flag sets. When all flags are set, some systems hang; so the flags most often set are the nonsense pattern URG-PSH-FIN. This scan only works when system are compliant with TCP/IP(RFC793).
command ex). nmap -sX -v 192.168.0.2
Advantage : ① It avoids the IDS and TCP three-way handshake.
② It works on the UNIX platform only.
2. FIN scan
FIN scan is a type of port scan. the client sends a FIN packet to the target port, and if the service is not running or if the port is closed it replies to you with the probe packet with an RST.
command ex). nmap -sF -v 192.168.0.2
3. NULL scan
NULL scan send TCP packets with all flags turned off. It is assumed that closed ports will return a TCP RST. Packets received by open ports are discarded as invalid.
It sets all flags of TCP headers, such as ACK, FIN, RST, SYN, URG and PSH, to NULL or unassigned. When any packets arrive at the server, BSD networking code informs the kernel to drop the incoming packet if a port is open, or returns an RST flag if a port is close. This scan uses flags in the reverse fashion as the Xmas scan, but gives the same output as FIN and Xmas tree scans.
Many network codes of major operating systems can behave differently in terms of responding to the packet. This method does not work for Microsoft operating system.
command ex). nmap -SN -v 192.168.0.2
Advantage : It avoids IDS and TCP three-way handshake.
Disadvantage : It works only for UNIX.
4. IDLE scan
The idle scan is a TCP port scan method that you can use to send a spoofed source address to a computer to find out what services are available and offers complete blind scanning of a remote host. This is accomplished by impersonating another computer. No packet is send from your own IP address; instead, another host is used(often called a "zombie") to scan the remote host and determine the open ports. This is done by expecting the sequence number of the zombie host and if the remote host checks the IP of the scanning party, the IP of the zombie machine will show up.
5. ICMP Echo scanning/List scan
ICMP echo scanning is used to discover live machines by pinging all the machines in the target network. Attackers send ICMP probes to the broadcast or network address which is relayed to all the host addresses in the subnet. The live systems will send ICMP echo reply message to the source of ICMP echo probe.
ICMP echo scanning is not referred to as port scanning since it does not have a port abstraction. ICMP echo scanning is useful to determine which host in a network are active by pinging them all.
command ex). nmap -P 192.168.0.0/24
nmap -sn 192.168.0.2
nmap -sL -v 192.168.2.5
Advantage : ① A list scan can perform a good sanity check.
② The incorrectly defined IP addresses on the command line or in an potion file are detected b the list scan. Te detected errors should be repaired prior to running any "active" scan.
6. UDP scanning
UDP port scanners use the UDP protocol instead of TCP, and can be more difficult than TCP scanning. You can send a packet, but you cannot determine that the host is alive or dead or filtered. However, there is one ICMP that you can use to determine whether ports are open or closed. If you send a UDP packet to a port without an application bound to it, the IP stack will return an ICMP port unreachable packet. If any port returns an ICMP error, then it's closed, while the ports that didn't answer are either open or filtered by the firewall.
This happens because open ports do not have to send an acknowledgement in response to a probe, and closed ports are not even required to send an error packet.
command ex). nmap -sU -v 192.168.0.2
Advantage : The UDP scan is less informal regarding an open port, since there's no overhead of a TCP handshake. However, if ICMP is responding to each unavailable port, the number of total frames can exceed a TCP scan. Microsoft-based operating systems do not usually implement any type of ICMP rate limiting, so this scan operates very efficiently on Windows-based devices.
Disadvantage : The UDP scan provides port information only. If additional version information is needed, the scan must be supplemented with a version detection scan optaion(-sV) or the oprtation system fingerprinting option(-O).
7. Inverse TCP Flag scanning
Attackers send the TCP probe packets by enabling various TCP flag(FIN, URG, PSH) or with no flags. When the port is open, the attacker doesn't get any response from the host, whereas when the port is closed, Attacker receive the RST/ACK from the target host.
The SYN packets that are sent to the sensitive ports of the targeted hosts are detected by using security mechanisms such as firewalls and IDS. Programs such as sys-logger and Courtney are available to log half-open SYN flag scan attempts. At times, the probe packets enabled with TCP flags can pass through filters undetected, depending on the security mechanisms installed.
Probing a target using a half-open SYN flag is known as an inverted technique. It is called this because the closed ports can only send the response back. According to RFC 793, An RST/ACK packet must be sent for connection reset, when the port is closed on host side. Attackers take advantage of this feature to send TCP probe packets to each port of the target host with various TCP flags set.
Common flag ocnfigurations used for probe packet include:
A FIN probe with the FIN TCP flag set.
An XMAS probe with the FIN, URG, and PUSH TCP flags set.
A NULL probe with no TCP flags set.
A SYN/ACK probe
All the closed ports on the targeted host will send an RST/ACK response. Since the TCP protocol(RFC 793) standard is completely ignored in the operation system such as Windows, you cannot see the RST/ACK response when connected to the closed port on the target host. This technique is effective when used with UNIX-based operation system.
Advantages : Avoid many IDS and logging systems, highly stealthy.
Disadvantages : ① Needs raw access to network sockets, thus requiring superuser(root) privileges.
② Mostly effective against hosts using a BSD-derived TCP/IP stack(Not effective against microsoft windows hosts in particular)
8. ACK Flag scanning
A stealthy technique is used for identifying open TCP ports. In this technique a TCP packet with ACK flag ON is sent to the remote host and then the header information of the RST packets sent by remote host are analyzed. Using this technique one can exploit the potential vulnerabilities of BSD derived TCP/IP stack. This technique gives good results when used with certain operation systems and platforms.
command ex). nmap -sA -v 192.168.0.2
9. Firewalls
Some firewalls may have rule sets that block IP fragmentation queues in the kernel(like the CONFIG_IP_ALWAYS_DEFRAG option in the Linux kernel), although this is not widely implemented due to the adverse effect on performance. Since several intrusions detection systems employ signature-based methods to indicate scanning attempts based on IP and/or the TCP headers, fragmentation is often able to evade this type of packet filtering and detection. There is a probability of network problems on the target network.
command ex). nmap -sS -T4(time delay) -A -f -v 192.168.0.2
[ICMP Ping]
using -l option
example) hping3 -l 8.8.8.8
[ACK scan on port]
using -A and -p(port) option
example) hping3 -A 8.8.8.8 -p 80
[UDP scan on port]
using -2 option
example) hping3 -2 -p 53
[Collecting initial sequence number]
using -O and -s option
example) hping3 8.8.8.8 -O -p 139 -s
[Firewalls and Time stamps]
using --tcp-timestamp option
example) hping3 -s 8.8.8.8 -p 80 --tcp-timestamp
[SYN scan on port 50~80(range)]
using -8 option and -v option
example) hping3 -8 50-80 -s 8.8.8.8 -v
[FIN, PUSH and URG scan on port 80]
using -F, -P option
example) hping3 -F -P -u 8.8.8.8 -p 80
[scan entire subnet for live host]
using -1, --rand-dest and -I(NIC interface) option
example) hping3 -1 8.8.8.x --rand-dest -I eth0
[Intercept all traffic containing HTTP signature]
using -9, -I option
example) hping3 -9 HTTP -I eth0
[SYN flooding a victim]
using -S, --flood option
example) hping3 -S 8.8.8.1 -a 8.8.8.254 -p 80 --flood *I warn you it is dangerous! Do not try this at real server.
[Netcraft]
URL : http://news.netcraft.com
Netcraft deals with web server, web hosting market-share analysis, and operating system detection. It provides free anti-phishing toolbar(Net craft toolbar) for Firefox as well as Internet Explorer browsers. The netcraft toolbar avoids phishing attacks and protects the Internet users from fraudsters. It checks the risk rate as well as the hosting location of the websites we visit. [Link Extractor]
URL : http://www.webmaster-a.com/link-extractor-internal.php
Link Extractor is a link extraction utility that allows you to choose between external and internal URLs, and will return a plain list of URLs linked to or an html list. You can use this utility to competitor sites.
[What is penetration testing?]
Penetration testing is a method of evaluating security levels of a particular system or network. This helps you determine the flaws related to hardware and software. The early identification helps protect the network. If the vulnerabilities aren't identified early, then they become an easy source for the attacker for the intrusion.
During penetration testing, a pen tester analyzes all the security measures employed by the organization for design weaknesses, technical flaws, and vulnerabilities. There are two types of testing.
There are black box testing and white box testing.
Black box testing simulates an attack from someone who is unfamiliar with the system, and white box testing simulates an attacker that has knowledge about the system.
Once all the tests are conducted, the pen tester prepares a report and includes all the test results and the tests conducted along with the vulnerabilities found and the respective countermeasures that can be applied.
Finally, the pen tester delivers the report to executive, management, and technical audiences.
[Why penetration testing?]
Penetration testing is required because it helps you to:
identify the threats facing an organization's information assets.
Reduce an organization's IT security costs and provide a better Return on Security.
Investment(ROSI) by identifying and resolving vulnerabilities and weaknesses.
Provide an organization with assurance: a thorough and comprehensive assessment of organizational security covering policy, procedure, design, and implementation.
Gain and maintain certification to an industry regulation(BS7799, HIPAA, etc).
Adopt best practices by conforming to legal and industry regulations.
Test and validate the efficiency of security protections and controls.
Change or upgrade existing infrastructure of software, hardware, or network design.
Focus on high-severity vulnerabilities and emphasize application-level security issues to development teams and management.
Provide a comprehensive approach of preparation steps that can be taken to prevent upcoming exploitation.
Evaluate the efficiency of network security devices such as firewalls, routers and web servers.
An attack vector is a path or means by which an attacker gains access to an information system to perform malicious activities. This attack vector enables an attacker to take advantage of the vulnerabilities present in the information system in order to carry out a particular attack.
Although there are some traditional attacks vectors from which attack can be performed, attack vectors come in many forms one cannot predict in which form an attack vector can come.
The following are the possible top attack vectors through which attackers can attack information systems are like picture.
According to KSN data, in 2013 Kaspersky Lab products neutralized 5 188 740 554 cyber-attacks on user computers and mobile devices 104 427 new modifications of malicious programs for mobile devices were detected.
Kaspersky Lab products neutralized 1 700 870 654 attacks launched from online resources located all over the world.
Kaspersky Lab products detected almost 3 billion malware attacks on user computers. A total of 1.8 million malicious and potentially unwanted programs were detected in these attacks.
45% of web attacks neutralized by Kaspersky Lab products were launched from malicious web resources located in the USA and Russia.
Mobile Threats
The mobile world is one the fastest-developing IT security areas. In 2013 security issues around mobiles have reached new heights and attained a new level of maturity in terms of both quality and quantity. If 2011 was the year when mobile malware gained traction, especially in Android-land, and 2012 was the year of mobile malware diversification, then 2013 saw mobile malware come of age. It’s no great surprise that mobile malware is approaching the PC threat landscape in terms of cybercriminal business models and technical methods; however the speed of this development is remarkable.
Obad, probably the most remarkable discovery in the mobile field, is being distributed by multiple methods, including an pre-established botnet. Android-based smartphones infected with Trojan-SMS.AndroidOS.Opfake.a are used as multipliers, sending text messages containing malicious links to every contact on the victim’s device. This has been common practice in the PC threat landscape and is a popular service provided by bot-herders in underground cybercriminal economy.
Mobile botnets actually offer a significant advantage over traditional botnets: smartphones are rarely shut down, making the botnet far more reliable since almost all its assets are always available and ready for new instructions. Common tasks performed by botnets include mass spam mail-outs, DDoS attacks and mass spying on personal information, all of them non-demanding actions in terms of performance and easily achieved on smartphones. The MTK botnet, appearing in early 2013, and Opfake, among many others, are proof that mobile botnets are no longer just a playground for cybercriminals, but have become common practice to serve the main purpose: financial profit.
Significant Events
Mobile Banking Trojans These include mobile phishing, theft of credit card information, from a bank card to the mobile account and finally to a QIWI wallet. In 2013 we also saw mobile Trojans which could check on the victim’s balance to ensure the maximum profit.
Mobile Botnets As stated above, botnet functionalities offer greater flexibility in illegal money-making schemes. This trend has now reached the mobile world and is here to stay. According to our estimates, about 60% of mobile malware includes elements of large or small botnets.
Backdoor.AndroidOS.Obad This malware is probably found to date, including a staggering total of three exploits, a backdoor, SMS Trojan and bot capabilities and further functionalities. It’s a kind of Swiss Army knife, comprising a whole range of different tools.
Using GCM to control botnets Cybercriminals have discovered a way to use Google Cloud Messaging (GCM) to control zombie devices in a botnet. This method is used by a relatively small number of malicious programs, but some of them are widespread. The execution of commands received from GCM is performed by the GCM system and it is impossible to block them directly on an infected device.
APT attacks against Uyghur activists We’ve seen both Windows and Mac OS X malware deployed against . PDF, XLS, DOC and ZIP files were sent in e-mails to perform the attacks in the past. APK files have now been added to the arsenal, spying on the personal information stored on the victim’s device and also transmiting its location.
Vulnerabilities in Android In a nutshell, we have seen exploits targeting Android for three purposes: to circumvent Android’s app integrity check on installation (also known as master key vulnerability, to gain enhanced rights, and to hinder the analysis of an app. The latter two types were also used in Obad.
Attacks on PCs through an Android device While we have seen PC malware that can infect smartphones, we have also come across that does it the other way round. When an infected Android device is connected to a PC in the USB drive emulation mode, its malicious payload is launched.
Statistics
In terms of the mobile operating systems that are being targeted by malware, nothing has significantly changed in 2013. Android is still target number one, attracting a whopping 98.05% of known malware. No other OS gets anywhere close, as seen below. The reasons for this are Android’s leading market position, the prevalence of third party app stores and the fact that Android has a rather open architecture, making it easy to use for both app developers and malware authors alike. We do not expect this trend to change in near future.
<Mobile malware distribution by platform>
To date we have collected 8,260,509 unique malware installation packs. Note that different installation packs may launch applications with the same features. The difference is in the malware interface and, for instance, the content of the text messages they send out.
The total number of mobile malware samples in our collection is 148,778 at the time of writing – 104,421 of them were found in 2013. October alone has seen 19,966 modifications, half the total that Kaspersky Lab found in the whole of 2012. Fortunately, this is this far from the situation we’re experiencing in the PC world, where we process a stream of more than 315,000 malware samples per day in our lab. Still, the trend is highly visible and continuing.
<Number of mobile malware samples in our collection>
Among mobile malware, SMS Trojans are still leading the field:
<Malware distribution by behavior type>
However, SMS Trojans, with a few exceptions, have evolved into bots, so we can easily unite the leaders of both into a single category – Backdoor Malware. So, 62% of malicious applications are elements of mobile botnets.
In response to the HTTP Request, the web server will respond with the requested resource preceded by a number of Headers.
These headers will be used by the web browser to interpret the content carried in the Response content.
===============================================================================
HTTP/1.1 200 OK
Date: Thu, 05 Dec 2013 02:49:06 GMT
Server: Apache/2.0.54 (Unix) mod_ssl/2.0.54 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.4
X-Powered-By: PHP/5.1.4
Content-Length: 339
Connection: close
Content-Type: text/html
===============================================================================
HTTP/1.1 200 OK
Date: Thu, 05 Dec 2013 02:49:06 GMT ①Server: Apache/2.0.54 (Unix) mod_ssl/2.0.54 OpenSSL/0.9.8e-fips-rhel5 PHP/5.1.4 ②X-Powered-By: PHP/5.1.4
Content-Length: 339
Connection: close
Content-Type: text/html
① : Server header. The server header advertises the banner of the Web server. Apache and IIS are common web server. test.com uses a Apache/2.0.54 web server and We can see Web server version, OS version, php version, ssl module version.
② specifies the technology (e.g. ASP.NET, PHP, JBoss) supporting the web application (version details are often in X-Runtime, X-Version, or X-AspNet-Version).
This is what happens when you open your browser and navigate to www.test.com.
An HTTP request to www.test.com is initiated.
What you see here are the Headers, called HTTP Request Headers for this request.
Note that a connection to the test.com port 80 or 443 is initiated before sending HTTP/HTTPS commands to the webserver.
① : Request method. This the type of your request. Get is the request type when you type a website URL in your location bar and hit enter. Other value POST, HEAD and etc.
② : Path. This is the file you're requesting. The home page of a website is always "/".
Other pages can be requested such as : "/user/image/banner.jpg"
You always refer to the root folder to specify the requested file.
③ : Protocol. This is the HTTP protocol version your browser is talking. This basically hints the web server which language will be used in the communication.
④ : Host header. This is the beginning of HTTP Request Headers. HTTP Headers have the following structure : Header name:Header Value
The Host header allows a web server to host multiple websites on the same IP address.
This means that you will have to specify which website you're interested in, in the Host header.
⑤ : Host value. After each Request header you find it's corresponding value. in this case you want to reach the host "www.test.com"
⑥ : Accept header. This header is used by the browser to specify which document type is expected as the result of this request.
⑦ : The user agent reveals the browser version, operating system and language to the remote web server. All web browsers have their own identification user agent. This is how most web site recognize the type of browser in use.
⑧ : Header connection. With HTTP 1.1 you can keep your connection to the remote web server open for a given time using the value "Keep-alive". All the requests to the web server will go through this connection without reinstating a new connection every time(always HTTP 1.0).
-차량정보-
차종 : 뉴코란도C(2014)
옵션 : AWD, 18인치 다이아몬드 컷틸휠, 선루프
출고일 : 2013년 9월 3일
주행거리 : 1300 km
누수 발생일시 : 2013-09-29 , PM 9:10
당시 강수량 : 부산 9.5mm(1시간 기준)
오늘 신차를 출고한지, 한달도 안되서 선루프에서 물이 스며들어오는 누수를 발견하였다.
그 전부터 코란도C 선루프는 누수의 문제가 있었으며, 계약하기전에 회원수가
약 3만3천명인 코란도C 동호회에서 코란도C 차량중 일부에서 선루프 누수가 있다는
게시물을 확인 했었는데, 쌍용자동차측의 A/S가 부실하다는 내용을 포함하고 있었다.
나는 "설마 내가 그러겠어?" 하는 생각에 선루프 옵션을 그대로 넣고 계약을 진행 했었으나
얼마뒤 주변인들의 만류로 최초 계약일인 8월 9일로부터 5일 이후에 계약한 영업소에
연락하여 선루프 옵션을 빼고 계약서를 다시 작성할것을이야기 하였으나, 내 담당인 영업사원은 파노라마 선루프가 아니기 때문에 절대 그럴일이 없다고 말을 했었다.
물론 문제 발생시 책임 지겠다는 말은 하지 않았다.
나는 비가오면, 알게 되겠지라고 생각하고만 있었다.
왜냐하면, 뉴코란도C의 경우에 내가 지금까지 타본 차량중에 가장 뛰어난 성능을 가진
차량이었고, 실내부터 실외까지 모두 마음에 들었기 때문에 굳이 확인하지 않았다.
그리고 부산에는 8,9월 두달동안 강수량이 5mm를 넘기는 비가 많이 않왔기 때문에
선루프에 누수 문제가 있을거라고는 생각도 못했다.
그러나 발생일인 오늘 2013년 9월 29일 저녁 9:10 에서야 선루프 누수 문제가 확인 되었다.
마침 혹시나 누수가 있을까 해서 선루프 내부 커버를 열어둔 상태에서 운전중에
언덕 내리막길을 지나는 순간 물방울들이 내 머리위로 흘러내렸다. 당황해서 선루프를
제대로 안 닫은건가 싶어서, 다시 확인 해봤으나 마찬가지였다.
이것 때문에 언덕을 후진/전진을 10회 반복 하였다.
그러나, 내 실수가 아닌 뉴코란도C 선루프에서 빗물에 새고 있음이 확실했다.
집으로 돌아와 야외 주차장에 차를 새워두고, 손전등으로 확인해보니 한두곳이 아니라
선루프가 틸딩되는 지점인 뒷 부분 전체가 흥건하게 물이 스며들어 있었다.
"아, 씨발 좆됬구나 A/S해도 해결 안된다던대"
수리해서 100% 해결이 된다면 내 입에서 저런 말이 안나왔을 것이다.
위에서 언급했던 코란도C 동호회에서는 "누수"를 키워드로 검색하면 동호회에서 나 말고도 여러 많은 사람들이 피해를 보고있는 상황이고.. 사업소에서 조치 해주는 단차조정은 약 2개월이 지나면 다시 물이 샌다는 것이다. 그리고 쌍용자동차 사업소에서는 배수로가 있기 때문에, 몇방울씩 떨어지는것은 정상이라고 공통적으로 대답을 한다고 한다.
그래, 차 외벽의 썬루프가 100% 다 걸러내지는 못한다고 알고있다. 하지만 강수량이 10mm도 안되는데 실내로 물이 유입 되는것이 정상인가?
기본적으로 차 외벽에 달려있는 썬루프의 유리가 내부로 유입되려는 물의 대부분을
차단해야하고 극히 일부 침투된 빗물을 썬루프 4각 꼭지점에 있는 배수로(드레인 호스)를
통하여 A필러를 타고 물이 빠지게 된다.
서울특별시의 연간 평균 강수량은 1500mm 정도가 되는대..
*2012년 기상청의 기상연보(11-1360000-000016-10) 참고.
한시간의 분량을 계산하면 시간당 최소한 약 30mm 정도가 된다.
그러면, 쌍용 자동차에서 신제품을 이야기할때마다 강조하는 "한국형"이란 말을
적용 하여서 계산을 해본다면 최소한 도로 또는 바닦에 1시간동안 3cm 물이
쌓일 정도의 양으로 물을 분사했을때 썬루프 외벽에서 차단을 해야한다는 것이다.
그것이 한국에서 사용될 차량에 들어가는
썬루프 외벽이 버틸수 있는 최소한의 임계치이다.
그 이상으로 많이 왔다거나 하면, 썬루프 외벽에서 차단을 못하여 실내로 유입되고
드레인 호스를 통해 배수가 될수도 있다고 생각 하는데..
나는 시간당 10mm의 비가 내리는 환경에서
주행중임에도 물이 스며들었다는것이 문제이다.
그럼 여름에 비좀 많이오면 난리가 날것이다!
이쯤되면 내가 내릴수 있는 결론은, 쌍용차에서 출고전 테스트를 할때
시간당 10mm도 안되는 물을 선루프에 분사하여 한국 기준에 맞지도 않는
엉터리 누수 테스트를 했거나..
초기 개발단계에서부터 아예 잘못된 누수 판별기준을 만들었다는 것이다.
둘중에 하나라 생각한다.
후자의 경우에는 쌍용 자동차 개발자체에 문제가 있는것이니 문제가 훨씬 심각하다.
설마 차 만들기로 수십년의 역사를 가진 회사가, 아무리 중간에 노조 파업이 있었다
한들 그렇게 까지 막장으로 테스트 프로세스를 만들지 않았을 것이다.
그리고, 결정적으로 같은 차량임에도 전혀 누수가 없는 차량들도 있으며
쌍용자동차에서 만든 구형 모델들중 썬루프가 있는 차량들도 누수가 없는것도 많다!
그렇다면 동희산업과 같은 썬루프 제조사에서 실수로 결함이 있는 썬루프를
납품하여, 문제가 생겼거나.. 썬루프 장착 과정에서 쌍용 자동차 조립라인의
실수가 있었다고 생각한다. 그리고 결정적으로
출고전 최종 테스트단계에서 찾아내지 못했다는 것이다.
이는 엉터리로 누수 테스트를 진행 하였을 가능성이 높다.
이런 상황을 생각 해봤을때 나는 100% 쌍용차에서 뉴코란도C를 만드는 과정중
실수가 있었다고 생각한다. 이에 대해서는 전면적으로 수리를 해줘야 한다고 생각한다.
사람도 실수를 반복하면, 누군가 지적하고 그 사람을 고문관 취급하기 마련인데
하물며 고객이 돈 주고 산 차량에 문제점이 수리를 하여도 계속 발견 되는데도
"원래 그렇다" 고 발빰하는 식의 A/S는 쌍용차의 고질적인 A/S문제를 더욱 단점으로 만들고 논란화 시키는 것이나 다름없다. 아니면 좀 팔린다고 벌써부터 교만하거나.
쌍용에서는 당장 이 선루프 누수 문제를 적극 해결 해주길 바란다.
안되면, 당신들이 고객을 우롱하지 않았다는것을 증명하기 위하여
테스트 근거 자료라도 공개하서 진짜 문제가 없음을 증명해야 한다.
아래는 문제의 선루프 사진들이다.
일부 네이버의 코란도C 동호회인 럽코란도C에서 인용하였다.
동호회에서는 이것보다 훨씬 많은 썬루프 누수 사진들을 볼 수 있다.
<카드가 들어갈 정도의 선루프 단차>
<비오는날 물이 스며드는 썬루프 1>
<비오는날 물이 스며드는 썬루프 2>
<수리요청결과, 정상판정>
=================================================================
2013-10-04 (금)요일 추가
=================================================================
2013-10-05 (토)요일 추가
=================================================================
부산/동래 사업소를 방문하여 정비를 받음.
"선루프의 각도가 정상치 보다 높은것 같으니, 낮춰서 단차를 조절"
"단차 조절을 하였으나, 누수가 다시 발생할 경우 유리 교체를 해주겠다"
=================================================================
2013-10-06 (일)요일 추가
