[B! Security][è„†å¼±æ€§] atsushifxã®ãƒ

atsushifx id:atsushifx

Securityã¨è„†å¼±æ€§ã«é–¢ã™ã‚‹atsushifxã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

USBãƒ¡ãƒ¢ãƒªã®è„†å¼±æ€§ã‚’çªã„ãŸãƒžãƒ«ã‚¦ã‚§ã‚¢ãŒèª°ã§ã‚‚æ‰‹ã«å…¥ã‚‹çŠ¶æ…‹ã«
ã¿ãªã•ã‚“ã€USBãƒ¡ãƒ¢ãƒªã«ã¯æ°—ã‚’ã¤ã‘ã¾ã—ã‚‡ã†ï¼ äºŒäººã®ãƒãƒƒã‚«ãƒ¼ãŒã€USBã®ãƒ•ã‚¡ãƒ¼ãƒ ã‚¦ã‚§ã‚¢ã«å«ã¾ã‚Œã¦ã„ã‚‹è„†å¼±æ€§ã‚’åˆ©ç”¨ã—ãŸãƒžãƒ«ã‚¦ã‚§ã‚¢ã®ã‚³ãƒ¼ãƒ‰ã‚’å…¬é–‹ã—ã¾ã—ãŸã€‚ å•é¡Œã®ãƒžãƒ«ã‚¦ã‚§ã‚¢ã¯ã„ã‚ã‚†ã‚‹BadUSBæ”»æ’ƒã¨ã‚ˆã°ã‚Œã‚‹ã‚‚ã®ã«ã¨ã¦ã‚‚ã‚ˆãä¼¼ã¦ã„ã¾ã™ã€‚BadUSBã¯æ¤œå‡ºä¸å¯èƒ½ãªãƒžãƒ«ã‚¦ã‚§ã‚¢ã§ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ã®Karsten Nohlã•ã‚“ã¨Jakob Lellã•ã‚“ãŒUSBã®ãƒ•ã‚¡ãƒ¼ãƒ ã‚¦ã‚§ã‚¢ã‚’è§£æžã—ã¦ä½œã‚Šã¾ã—ãŸã€‚BadUSBã¯USBãƒ‡ãƒã‚¤ã‚¹ã‹ã‚‰ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã€PCã‚’å®Œå…¨ã«ä¹—ã£å–ã£ãŸã‚Šã€çŸ¥ã‚‰ãªã„é–“ã«ãƒ¡ãƒ¢ãƒªãƒ¼ã‚¹ãƒ†ã‚£ãƒƒã‚¯ã‹ã‚‰ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚ŒãŸãƒ•ã‚¡ã‚¤ãƒ«ã‚’å¤‰ãˆãŸã‚Šã€ãƒ¦ãƒ¼ã‚¶ãŒã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚’é€šã—ã¦ã‚„ã‚Šã¨ã‚Šã—ã¦ã„ã‚‹ãƒ‡ãƒ¼ã‚¿ã‚’ãƒªãƒ€ã‚¤ãƒ¬ã‚¯ãƒˆã™ã‚‹ã“ã¨ã•ãˆã§ãã¾ã™ã€‚ ã“ã†ã„ã£ãŸå±é™ºãŒåºƒãŒã‚‹ã“ã¨ã‚’æ‡¸å¿µã—ã¦ã€Nohlã•ã‚“ã¨Lellã•ã‚“ã¯BadUSBã‚’å…¬é–‹ã—ãªã„ã“ã¨ã«ã—ã¾ã—ãŸã€‚ã—ã‹ã—ã€ç ”ç©¶è€…ã®Adam Caudillã•ã‚“ã¨Brandon W
atsushifx 2014/10/04
ãƒãƒƒã‚«ãƒ¼å€«ç†ã«å¾“ã£ã¦BadUSBã‚’ä½¿ã£ãŸæ”»æ’ƒã‚³ãƒ¼ãƒ‰ã‚’GitHubã«å…¬é–‹ã—ãŸã¨ã€‚è„†å¼±æ€§ãŒã‚ã‚‹ã¨ã„ã†å ±å‘Šã ã‘ã§ã¯å…·ä½“çš„ãªå¯¾ç–ãŒã‚ã‹ã‚‰ãªã„ã—æ”¾ç½®ã•ã‚Œã‚‹å±é™ºæ€§ãŒã‚ã‚‹ã‹ã‚‰ã¨ã„ã†ã®ãŒãƒãƒƒã‚«ãƒ¼å¼

BadUSB

Security

è„†å¼±æ€§

USBãƒ•ã‚¡ãƒ¼ãƒ ã‚¦ã‚§ã‚¢

ãƒãƒƒã‚«ãƒ¼å€«ç†
ãƒªãƒ³ã‚¯
Critical Vulnerability and Privacy LoopHole Found in RoboForm Password Manager
atsushifx 2014/07/05
ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒžãƒãƒ¼ã‚¸ãƒ£ãƒ¼ã‚½ãƒ•ãƒˆã®Roboformã§PINå…¥åŠ›ã‚’ã—ãªãã¦ã‚‚èµ·å‹•ã§ãã‚‹è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸã¨ã®ã“ã¨ã€‚

Roboform

Security

Incident

è„†å¼±æ€§

password manager
ãƒªãƒ³ã‚¯
OpenSSLã®æ–°ãŸãªè„†å¼±æ€§ CCS Injection ãŒç™ºè¦‹ã•ã‚Œã‚‹
OpenSSLã®æ–°ãŸãªè„†å¼±æ€§ CCSã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ (CVE-2014-0224) ãŒç™ºè¦‹ã•ã‚Œã¾ã—ãŸã€‚OpenSSLãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆã‹ã‚‰ã¯ä»–ã®è„†å¼±æ€§(6ã¤ã‚ã‚Šã¾ã™)ã¸ã®å¯¾å¿œã‚‚å«ã‚“ã 0.9.8zaã€1.0.0mã€1.0.1hãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ã¾ã™ã€‚ã“ã®ã¾ã¨ã‚ã§ã¯ä¸»ã«CVE-2014-0224ã‚’æ‰±ã„ã¾ã™ã€‚ ãã‚Œã‚’ç™ºè¦‹ã—ãŸæ—¥æœ¬ã®ä¼šç¤¾ã§ã‚ã‚‹ãƒ¬ãƒ”ãƒ€ãƒ ã«ã‚ˆã‚‹ãƒ„ã‚¤ãƒ¼ãƒˆã¨ã€ãã®åå¿œã‚’ã„ãã¤ã‹ã€‚
atsushifx 2014/06/05
CCS Injectionã«ã¤ã„ã¦ã¯ã€http://lepidum.co.jp/blog/2014-06-05/CCS-Injection/ ã§ã€‚ã—ã‹ã—æœ€åˆã®ãƒªãƒªãƒ¼ã‚¹ã‹ã‚‰ã¨ã„ã†ã“ã¨ã¯ãƒã‚°ãŒå…¥ã‚Šè¾¼ã¿ã‚„ã™ã„éƒ¨åˆ†ã ã¨ã„ã†ã“ã¨ã ã—GNU/TLSã®ã»ã†ã‚‚ç¢ºèªã—ã¦ã»ã—ã„

OpenSSL

CCS Injection

Security

è„†å¼±æ€§

HandShake
ãƒªãƒ³ã‚¯
SSL/SPDYã‚’æ”»æ’ƒã™ã‚‹CRIMEã¯BEASTã®æ£çµ±ãªå¾Œç¶™è€…ã
ã¯ã˜ã‚ã« ä»¥å‰ã®ã‚¨ãƒ³ãƒˆãƒªã§SSLã«å¯¾ã™ã‚‹æ–°ã—ã„æ”»æ’ƒæ‰‹æ³•ã€ŒBEASTã€ã‚’ç´¹ä»‹ã—ã¾ã—ãŸãŒã€ä»Šå›žã¯BEASTã‚’ã•ã‚‰ã«ç™ºå±•ã•ã›ãŸã€ŒCRIMEã€ã¨ã„ã†æ”»æ’ƒã«ã¤ã„ã¦ç°¡å˜ã«ç´¹ä»‹ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ä¸€æ¬¡æƒ…å ±æºã¨ã—ã¦ã“ã¡ã‚‰ã®ã‚¹ãƒ©ã‚¤ãƒ‰ï¼ˆè‹±èªžï¼‰ãŒé–²è¦§ã§ãã¾ã™ã®ã§ã€æ™‚é–“ãŒã‚ã‚‹æ–¹ã¯ãœã²ç›®ã‚’é€šã—ã¦ã¿ã¦ãã ã•ã„ã€‚ CRIMEã®æ„å‘³ CRIMEã¯ "Compression Ratio Info-Leak Made Easy" ã‚ã‚‹ã„ã¯ "Compression Ratio Info-Leak Mass Exploitation" ã®é æ–‡å—ã§ã€SSLã‚„SPDYï¼ˆã‚ã‚‹ã„ã¯HTTPãƒœãƒ‡ã‚£éƒ¨ã®gzipåœ§ç¸®ï¼‰ã§ä½¿ã‚ã‚Œã‚‹åœ§ç¸®ã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ ã«æ³¨ç›®ã—ãŸæ”»æ’ƒæ‰‹æ³•ã§ã™ã€‚ã‚ã¾ã‚ŠçŸ¥ã‚‰ã‚Œã¦ã„ã¾ã›ã‚“ãŒSSLã«ã¯åœ§ç¸®æ©Ÿèƒ½ãŒå˜åœ¨ã—ã¦ãŠã‚Šã€ã‚µãƒ¼ãƒå´ãƒ»ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆå´åŒæ–¹ãŒåœ§ç¸®æ©Ÿèƒ½ã‚’ONã«ã—ã¦ã„ã‚‹å ´åˆã«ã€ãƒ‡ãƒ¼ã‚¿ãŒåœ§ç¸®ã•ã‚Œã¾ã™ã€‚ BEASTã¨ã®é–¢ä¿‚ CRIMEã¯B
atsushifx 2013/11/21
SSL

Security

è„†å¼±æ€§

CRIMEæ”»æ’ƒ

SPDY
ãƒªãƒ³ã‚¯
å—ã‘å…¥ã‚Œãƒ†ã‚¹ãƒˆç”¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚§ãƒƒã‚¯ãƒªã‚¹ãƒˆ for Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³
ã‚µãƒ¼ãƒ“ã‚¹çµ‚äº†ã®ãŠçŸ¥ã‚‰ã› ã„ã¤ã‚‚Yahoo! JAPANã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”åˆ©ç”¨ã„ãŸã ãèª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ ãŠå®¢æ§˜ãŒã‚¢ã‚¯ã‚»ã‚¹ã•ã‚ŒãŸã‚µãƒ¼ãƒ“ã‚¹ã¯æœ¬æ—¥ã¾ã§ã«ã‚µãƒ¼ãƒ“ã‚¹ã‚’çµ‚äº†ã„ãŸã—ã¾ã—ãŸã€‚ ä»Šå¾Œã¨ã‚‚Yahoo! JAPANã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ã”æ„›é¡§ãã ã•ã„ã¾ã™ã‚ˆã†ã€ã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚
atsushifx 2006/04/24
Webé–‹ç™ºã§ã®ã‚·ã‚¹ãƒ†ãƒ ãƒ†ã‚¹ãƒˆã«å¿…é ˆãªé …ç›®ã€ãœã²èªã‚€ã¹ã—

å…¥åŠ›

Security

checklist

Webé–‹ç™º

ã‚·ã‚¹ãƒ†ãƒ ãƒ†ã‚¹ãƒˆ

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
1

ãŠçŸ¥ã‚‰ã›

ã‚‚ã£ã¨èªã‚€

å…¬å¼Twitter

@hatebu
æœ€æ–°ã®äººæ°—ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã®é…ä¿¡

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

jæ¬¡ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kå‰ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lã‚ã¨ã§èªã‚€

eã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã‚’é–‹ã

oãƒšãƒ¼ã‚¸ã‚’é–‹ã

è¨å®šã‚’å¤‰æ›´ã—ã¾ã—ãŸx

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (16)

Securityã¨è„†å¼±æ€§ã«é–¢ã™ã‚‹atsushifxã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (16)

Securityã¨è„†å¼±æ€§ã«é–¢ã™ã‚‹atsushifxã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

USBãƒ¡ãƒ¢ãƒªã®è„†å¼±æ€§ã‚’çªã„ãŸãƒžãƒ«ã‚¦ã‚§ã‚¢ãŒèª°ã§ã‚‚æ‰‹ã«å…¥ã‚‹çŠ¶æ…‹ã«

Critical Vulnerability and Privacy LoopHole Found in RoboForm Password Manager

OpenSSLã®æ–°ãŸãªè„†å¼±æ€§ CCS Injection ãŒç™ºè¦‹ã•ã‚Œã‚‹

SSL/SPDYã‚’æ”»æ’ƒã™ã‚‹CRIMEã¯BEASTã®æ­£çµ±ãªå¾Œç¶™è€…ã

å—ã‘å…¥ã‚Œãƒ†ã‚¹ãƒˆç”¨ã‚»ã‚­ãƒ¥ãƒªãƒ†ã‚£ãƒã‚§ãƒƒã‚¯ãƒªã‚¹ãƒˆ for Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚­ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (16)

Securityã¨è„†å¼±æ€§ã«é–¢ã™ã‚‹atsushifxã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

USBãƒ¡ãƒ¢ãƒªã®è„†å¼±æ€§ã‚’çªã„ãŸãƒžãƒ«ã‚¦ã‚§ã‚¢ãŒèª°ã§ã‚‚æ‰‹ã«å…¥ã‚‹çŠ¶æ…‹ã«

OpenSSLã®æ–°ãŸãªè„†å¼±æ€§ CCS Injection ãŒç™ºè¦‹ã•ã‚Œã‚‹

SSL/SPDYã‚’æ”»æ’ƒã™ã‚‹CRIMEã¯BEASTã®æ£çµ±ãªå¾Œç¶™è€…ã

å—ã‘å…¥ã‚Œãƒ†ã‚¹ãƒˆç”¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒã‚§ãƒƒã‚¯ãƒªã‚¹ãƒˆ for Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´12æœˆç¬¬1é€±ï¼‰

æœˆé–“ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆï¼‰

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2024å¹´11æœˆç¬¬5é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹