エンジニアãªã‚‰è„†å¼±æ€§æƒ…å ±ã‚’èªã‚るよã†ã«ãªã‚ㆠ| Tech Blog
ã“ã‚“ã«ã¡ã¯ã€ã‚¢ãƒ‰ãƒ†ã‚¯ã‚¹ã‚¿ã‚¸ã‚ªã§ã‚»ã‚ュリティエンジニアをã—ã¦ã„る岡崎ã§ã™ã€‚ 皆様ã€å¹´æœ«å¹´å§‹ã¯ã‚†ã£ãã‚Šã§ãã¾ã—ãŸã§ã—ょã†ã‹ã€‚ç§ã¯å¹´å§‹ã«å…¬é–‹ã•ã‚ŒãŸã€ŒMeltdown and Spectreã€ã®ãŠé™°ã§å¹´å§‹æ—©ã€…ã€æƒ…å ±æ•´ç†ã«è¿½ã‚ã‚Œã¦ã¾ã—ãŸã€‚ 今回ã¯ã€å…ˆæ—¥ã€ŒMeltdown and Spectreã€ã®è„†å¼±æ€§ã®ã“ã¨ã‚‚ã‚ã‚Šã€è„†å¼±æ€§æƒ…å ±ã®è¦‹æ–¹ã¨è„†å¼±æ€§æƒ…å ±API活用ã«ã¤ã„ã¦ã€æ›¸ã‹ã›ã¦ã„ãŸã ãã¾ã™ã€‚ ï¼‘ï¼Œè„†å¼±æ€§æƒ…å ±ã®è¦‹æ–¹ エンジニアã®æ–¹ã§ã‚ã‚Œã°ã€è„†å¼±æ€§æƒ…å ±ã‚’ç¢ºèªã™ã‚‹ä¸ã§CVEã‚„CVSSãªã©ã‚’ç›®ã«ã™ã‚‹ã“ã¨ãŒå¤šã„ã¨æ€ã„ã¾ã™ã€‚ãã‚Œãžã‚Œã©ã®ã‚ˆã†ãªæ„味をæŒã¡ã€ã©ã®ã‚ˆã†ã«è¦‹ã‚‹ã®ã‹ã‚’知ã£ã¦ãŠãã¾ã—ょã†ã€‚ 先日ã‚ã£ãŸã€ŒMeltdown and Spectreã€ã‚’例ã«è¦‹ã¦ã„ãã¾ã—ょã†ã€‚ https://meltdownattack.com/ https://spectreattack.com/ ã¾ãšã€ã“ã®ã‚ˆã†ãªè„†å¼±æ€§æƒ…å ±ãŒå…¬é–‹ã•ã‚Œ
HackerNoon - read, write and learn about any technology
Programming"Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning." - Rich Cook, The Wizardry Compiled.
Encryption in transit  | Documentation  | Google Cloud
Send feedback Encryption in transit Stay organized with collections Save and categorize content based on your preferences. This is the third whitepaper on how Google uses encryption to protect your data. In this whitepaper, you will find more detail on encryption in transit for Google Cloud and Google Workspace. For all Google products, we strive to keep customer data highly protected and to be as
GitHub - google/wuffs: Wrangling Untrusted File Formats Safely
Wuffs is a memory-safe programming language (and a standard library written in that language) for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives. It is "ridiculously fast". Per its benchmarks and other linked-to blog posts: It can decode bzip2 1.3x faster than /usr/bin/bzca
CBCTF SSR Writeup
cbctf_ssr.md CBCTF SSR Writeup ゲームã®ã‚ˆã†ãªã‚¢ãƒ—リケーション。ã–ã£ã¨å¤§ã¾ã‹ãªå‹•ä½œã‚’ã¿ã¦ã„ã。 ガãƒãƒ£ã‚’回ã™ã¨ã‚¢ã‚¤ãƒ‰ãƒ«ã‚’入手ã§ãる。 ガãƒãƒ£ã®éš›ã€ã‚µãƒ¼ãƒã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ã¯ç™ºç”Ÿã—ãªã„(=ガãƒãƒ£ã¯ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ã®ã¿ã§å®Œçµ) 入手ã—ãŸã‚¢ã‚¤ãƒ‰ãƒ«ã¯idolsã¨ã„ã†åå‰ã®Cookieã§è¨˜éŒ²ã€‚ レア度"SSR"ã®ã‚¢ã‚¤ãƒ‰ãƒ«"Uzuki"を引ã„ãŸå ´åˆã®Cookieã¯æ¬¡ã®ã‚ˆã†ã«ãªã£ãŸï¼š [{"key":["ssr","0"]}] リãƒãƒ¼ãƒ‰ã—ã¦ãƒ¬ã‚¹ãƒãƒ³ã‚¹å†…容をã¿ã‚‹ã¨ã€å…¥æ‰‹ã—ãŸUzukiã®ãƒ‡ãƒ¼ã‚¿ãŒHTMLã«ç›´æŽ¥å«ã¾ã‚Œã¦ã„ãŸ(=Cookieを見ã¦ã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ã§å…¥æ‰‹æ¸ˆã¿ã®ã‚ャラクターを返ã—ã¦ã„る様å) 入手ã—ãŸã‚¢ã‚¤ãƒ‰ãƒ«ã«ã¯æ¬¡ã®ã‚ˆã†ã«é€£ç•ªã§å€‹åˆ¥ã®ãƒšãƒ¼ã‚¸ãŒä½œã‚‰ã‚Œã‚‹ï¼š http://ssr.tasks.ctf.codeblue.jp/idols/0 個別ã®ãƒšãƒ¼ã‚¸ã§ã¯ã€æ¬¡ã®ã‚ˆã†ãªURLã®voic
ブラウザã®UIã®ãƒã‚°ã‚’探㙠/ Secusoba PopUnder
第40回セã‚ュãã°å‹‰å¼·ä¼š(http://secusoba.info/?%E7%AC%AC40%E5%9B%9E%2811%E6%9C%8825%E6%97%A5%29) ã§ç™ºè¡¨ã—ãŸè³‡æ–™ã§ã™ã€‚
2014å¹´9月ã®ç±³å›½ã«ãŠã‘ã‚‹Equationマルウェア検知インシデントã«é–¢ã™ã‚‹èª¿æŸ»ãƒ¬ãƒãƒ¼ãƒˆ
2017å¹´10月ã®Wall Street Journalã«ã‚ˆã‚‹å ±é“ã‚’å—ã‘ã€Kaspersky LabãŒå®Ÿæ–½ã—ãŸè©³ç´°ãªå†…部調査ã«ã¤ã„ã¦çµæžœã‚’発表ã—ã¾ã™ã€‚ 背景 10月åˆæ—¬ã€Kaspersky Labã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ãŒNSAè·å“¡ã®è‡ªå®…コンピューターã‹ã‚‰æ©Ÿå¯†æƒ…å ±ã‚’å¸ã„上ã’ã‚‹ã®ã«ä½¿ã‚ã‚ŒãŸã¨ã™ã‚‹è¨˜äº‹ãŒã€Wall Street Journalã«ã¦å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚サイãƒãƒ¼ã‚¹ãƒ‘イ行為ãŠã‚ˆã³ã‚µã‚¤ãƒãƒ¼çŠ¯ç½ªæ´»å‹•ã®æœ€å‰ç·šã§20å¹´ã«ã‚ãŸã‚Šæˆ¦ã£ã¦ããŸKaspersky Labã§ã¯ã€ã“れらã®ç”³ã—ç«‹ã¦ã‚’éžå¸¸ã«æ·±åˆ»ãªã‚‚ã®ã¨å—ã‘æ¢ã‚ã¦ã„ã¾ã™ã€‚個別ã«æœ¬ä»¶ã‚’調査ã™ã‚‹æ–¹ã€…ã€ãã—ã¦ã“れら申ã—ç«‹ã¦ãŒçœŸå®Ÿãªã®ã‹ã¨å•ã†ã¦ããŸæ–¹ã€…ã®ãŸã‚ã«ã€å½“è©²å ±é“ã«é–¢é€£ã™ã‚‹ä»¥ä¸‹ã®10ã®è³ªå•ã«ç”ãˆã‚‹ã¹ã内部調査を実行ã—ã€ã“ã“ã«èª¿æŸ»çµæžœã‚’å ±å‘Šã—ã¾ã™ã€‚※ä¸é–“å ±å‘Šã«ã¤ã„ã¦ã¯ã“ã¡ã‚‰ã‚’ã”å‚ç…§ãã ã•ã„ Kaspersky Labã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ã‚³ãƒ³ãƒ”ューターã‹
Node.js Security Overview | Gergely Nemeth
Node.js Security Overview The initial Node.js release happened a little bit more than 8 years ago. Since then Node.js became one of the leading platforms for building backend applications. As such, security becomes more and more important. In the first part of this article you will learn where Node.js and npm are when it comes to security. In the second part, you will learn some best security prac
iOS Privacy: steal.password - Easily get the user’s Apple ID password, just by asking
howisFelix.today? Want to be the first to hear about more privacy and mobile related essays? Subscribe Do you want the user’s Apple ID password, to get access to their Apple account, or to try the same email/password combination on different web services? Just ask your users politely, they’ll probably just hand over their credentials, as they’re trained to do so 👌 Disclaimer This is just a proof
è„†å¼±æ€§è¨ºæ– åˆå¿ƒè€…ãƒãƒ³ã‚ºã‚ªãƒ³ãƒˆãƒ¬ãƒ¼ãƒ‹ãƒ³ã‚° ã«å‚åŠ ã—㟠- 僻地ã®å¤§å¦é™¢ç”Ÿã®é›‘記帳
10月7日土曜日ã«, è„†å¼±æ€§è¨ºæ– åˆå¿ƒè€…ãƒãƒ³ã‚ºã‚ªãƒ³ãƒˆãƒ¬ãƒ¼ãƒ‹ãƒ³ã‚° ã«å‚åŠ ã—ã¦ããŸ. OWASP Japan, ISOG-J WG1, ãã—ã¦, Burp Suite Japanã®å…±å‚¬ã«ã‚ˆã‚‹ãƒˆãƒ¬ãƒ¼ãƒ‹ãƒ³ã‚°ã§, 脆弱性診æ–ガイドラインã«æ²¿ã£ã¦è¨ºæ–ã‚’å¦ã¼ã†ã¨ã„ã†ã‚‚ã®. ä¼šå ´ã¯ã‚µã‚¤ãƒœã‚¦ã‚ºæ ªå¼ä¼šç¤¾ã•ã‚“. 森ãŒã‚ã£ã¦ãƒ•ã‚¯ãƒã‚¦ãŒã„ãŸ....ã™ã”ã„... 以下, トレーニングã®æµã‚Œã‚’ç°¡å˜ã«ç´¹ä»‹ã™ã‚‹. å°Žå…¥ 脆弱性診æ–士スã‚ルマッププãƒã‚¸ã‚§ã‚¯ãƒˆ ( Pentester Skillmap Project JP - OWASP ) ã®ç´¹ä»‹, ãã—ã¦, ãã®ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã®ä¸€ç’°ã¨ã—ã¦2017å¹´4月ã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚ŒãŸWebアプリケーション脆弱性診æ–ガイドラインã®ç´¹ä»‹ãŒã‚ã£ãŸ. 脆弱性診æ–士スã‚ルマッププãƒã‚¸ã‚§ã‚¯ãƒˆã¨ã¯, 以下ã®é€šã‚Š. 脆弱性診æ–ã‚’è¡Œã†å€‹äººã®æŠ€è¡“çš„ãªèƒ½åŠ›ã‚’具体的ã«ã™ã¹ãã€è„†å¼±æ€§è¨ºæ–ã‚’è¡Œã†æŠ€è¡“者(以下ã€è„†å¼±æ€§è¨º
ãŠçŸ¥ã‚‰ã›
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
https://www.exploit-db.com/docs/english/44319-web-application-security-testing.pdf
Content-Types Matter More Than You Think
GitHub - SecureSkyTechnology/BadLibrary: vulnerable web application for training
This is how you respond to a disclosure
The Definitive TypeScript Guide - Blog | SitePen
安全ãªé€šä¿¡ã‚’実ç¾ã™ã‚‹ãŸã‚ã®æš—å·æŠ€è¡“ã¨ã‚»ã‚ュアプãƒãƒˆã‚³ãƒ«ï¼ã‚¹ãƒŽãƒ¼ãƒ‡ãƒ³äº‹ä»¶ãŒæ¨™æº–化è°è«–ã«ã‚‚ãŸã‚‰ã—ãŸå¤§ããªã†ãã‚Šã€IETFトピックス2016-17】
WebRTC IP Address Handling Requirements
Cure53 🇺🇦 on Twitter: "Cure53 Browser Security White Paper https://t.co/iUTeiUS19d This is almost all we know about browsers in one document. Enjoy :)"
Privacy Enhanced RTP Conferencing with WebRTC - PERC
Why Do You Need to Focus On WebRTC Security?
{{#tags}}- {{label}}
{{/tags}}