GoogleãŒOpenSSLをフォークã—ãŸã€ŒBoringSSLã€ã‚’公開 | スラド ã‚»ã‚ュリティ
GoogleãŒOpenSSLをフォークã—ã€ã€ŒBoringSSLã€ã¨ã—ã¦å…¬é–‹ã—ãŸ(ImperialVioletブãƒã‚°ã®è¨˜äº‹ã€ Ars Technicaã®è¨˜äº‹ã€ 本家/.)。 Googleã¯ä½•å¹´ã‚‚ã®é–“ã€OpenSSLã«æ•°å¤šãã®ãƒ‘ッãƒã‚’当ã¦ã¦ä½¿ç”¨ã—ã¦ã„ãŸã¨ã„ã†ã€‚一部ã®ãƒ‘ッãƒã¯OpenSSLã®ãƒ¡ã‚¤ãƒ³ãƒªãƒã‚¸ãƒˆãƒªã«å–ã‚Šè¾¼ã¾ã‚ŒãŸãŒã€å¤§åŠã¯APIã‚„ABIã®å®‰å®šæ€§ã®å•é¡ŒãŒã‚ã‚‹ãªã©ã®ç†ç”±ã§å–ã‚Šè¾¼ã¾ã‚Œã¦ã„ãªã‹ã£ãŸã€‚Androidã‚„Chromeãªã©ã®è£½å“ã¯ãƒ‘ッãƒã®ä¸€éƒ¨ã‚’å¿…è¦ã¨ã™ã‚‹ãŒã€ãƒ‘ッãƒã¯70以上もã‚ã‚‹ãŸã‚ã«ä½œæ¥ãŒè¤‡é›‘ã«ãªã£ã¦ã„ãŸãã†ã 。ãã®ãŸã‚ã€OpenSSLをフォークã—ã¦ã€OpenSSLå´ã®å¤‰æ›´ã‚’インãƒãƒ¼ãƒˆã™ã‚‹æ–¹å¼ã«å¤‰æ›´ã—ãŸã¨ã—ã¦ã„る。BoringSSLã¯è¿‘ã„ã†ã¡ã«Chromiumã®ãƒªãƒã‚¸ãƒˆãƒªã«è¿½åŠ ã•ã‚Œã‚‹äºˆå®šã§ã€ã„ãšã‚ŒAndroidや内部的ã«ã‚‚使ã‚れるよã†ã«ãªã‚‹ã€‚ãŸã ã—ã€BoringSSLã§ã¯APIã‚„ABI
ImperialViolet - Apple's SSL/TLS bug
Yesterday, Apple pushed a rather spooky security update for iOS that suggested that something was horribly wrong with SSL/TLS in iOS but gave no details. Since the answer is at the top of the Hacker News thread, I guess the cat's out of the bag already and we're into the misinformation-quashing stage now. So here's the Apple bug: static OSStatus SSLVerifySignedServerKeyExchange(SSLContext *ctx, bo
iOSã®SSL周りã®ãƒã‚°ã«è¦‹ã‚‹C言語ã«ãŠã‘るエラーãƒãƒ³ãƒ‰ãƒªãƒ³ã‚°ãŒç³žã ã¨ã„ã†è©±
Y!J API ãŒæ¢ã¾ã£ãŸæ—¥ - GlobalSign ã® Root 証明書切れã‹ã‚‰å¦ã‚“ã ã“㨠- OAuth.jp
昨日ã‚ãŸã‚Šã‹ã‚‰ã€Yahoo! Wallet ã‚„ YConnect ã¨ã„ã£ãŸã€Yahoo! Japan ã® API ã«ã‚¢ã‚¯ã‚»ã‚¹ã§ããªããªã£ãŸã£ã¦äººã€ã¡ã‚‰ã»ã‚‰ã„ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã。 僕もã¡ã‚‡ã£ã¨ãã†ã„ã†ã‚±ãƒ¼ã‚¹è¦‹ã‹ã‘ã¾ã—ãŸã€‚ ãªã‚“ã‹ Yahoo! Japan ãŒãƒã‚«ã—ã¡ã‚ƒã£ãŸã®ï¼Ÿã¨ã‹ã€ã¾ã昨日ã¾ã§å¥åº·ã«å‹•ã„ã¦ãŸã‚·ã‚¹ãƒ†ãƒ ãŒçªç„¶ Yahoo! Japan ã® API ã«ã‚¢ã‚¯ã‚»ã‚¹ã§ããªããªã£ã¡ã‚ƒã£ãŸã‚“ã ã—ã€ãらãã†æ€ã†ã®ã‚‚ムリã¯ãªã„。 ãŒã€ä»Šå›žã®ã‚±ãƒ¼ã‚¹ã€Yahoo! ã¯å…¨ã悪ããªã„ï¼ ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼ãƒ•ãƒªãƒ¼ã‚¯ã¯ã©ã†ã‹ã¨æ€ã†ãŒãªï¼ï¼ ã§ã¯æ—©é€Ÿã€ä»Šå›žèµ·ã“ã£ãŸã“ã¨ã‚’ã€æŒ¯ã‚Šè¿”ã£ã¦ã¿ã¾ã—ょã†ã€‚ Yahoo! API ã«ã‚¢ã‚¯ã‚»ã‚¹ã§ããªããªã£ãŸ Yahoo! Japan ã¯ã€yahoo.co.jp 以外ã«ã‚‚ã€CDN 用や API 用ãªã©ã€ç”¨é€”ã”ã¨ã«ã„ãã¤ã‹ã®ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚’æŒã£ã¦ã¾ã™ã€‚ 今回æ¢ã¾ã£ãŸã®ã¯ã€ãã®ä¸ã® API 用
mitmproxy - an interactive HTTPS proxy
Command Line mitmproxy is your swiss-army knife for debugging, testing, privacy measurements, and penetration testing. It can be used to intercept, inspect, modify and replay web traffic such as HTTP/1, HTTP/2, HTTP/3, WebSockets, or any other SSL/TLS-protected protocols. You can prettify and decode a variety of message types ranging from HTML to Protobuf, intercept specific messages on-the-fly, m
iOS実機ã®SSL通信をプãƒã‚ã‚·ã«ã‚ˆã£ã¦å‚å—ã—ãŸã‚Šæ”¹ã–ã‚“ã™ã‚‹æ–¹æ³• - Qiita
ã¯ã˜ã‚㫠スマートフォンアプリ開発ã§APIを介ã—Web/APIサーãƒãƒ¼ã¨ã‚„ã‚Šã¨ã‚Šã‚’ã™ã‚‹å ´åˆã€ã€Œhttpsを使ã£ã¦ã„ã‚Œã°é€šä¿¡ã¯ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ãƒãƒ¬ãªã„ã€ãªã‚“ã¦ã“ã¨ã¯ãªãã€Webアプリã§ãƒ„ールを使ã£ã¦ã§ãã‚‹ã®ã¨åŒã˜ã‚ˆã†ã«ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ã¯é€šä¿¡å†…容ã®ç¢ºèªã‚„改竄ãªã©ãŒã§ãã¾ã™ã€‚ ãã®ãŸã‚ã€ãã®ã“ã¨ã‚’å‰æã«ã‚¢ãƒ—リやサーãƒãƒ¼APIã®è¨è¨ˆã¨å®Ÿè£…ã‚’è¡Œã‚ãªã„å ´åˆã€ã‚¢ãƒ—リ利用者ã«ã‚ˆã‚‹ã‚²ãƒ¼ãƒ スコアçµæžœé€ä¿¡ã®æ”¹ç«„ã‚„ã€ã‚½ãƒ¼ã‚·ãƒ£ãƒ«ã‚²ãƒ¼ãƒ ã«ãŠã‘るレイドボスãªã©ã¸ã®ãƒ€ãƒ¡ãƒ¼ã‚¸æ“作ã€ECサイトアプリã§ã®è³¼å…¥æ“作ãªã©ã‚‚å¯èƒ½ã«ãªã£ã¦ã—ã¾ã„ã¾ã™ã€‚ ã¾ãŸã€æœ€è¿‘自分ã¯ã€Œç„¡æ–™ã§éŸ³æ¥½è´ã放題!! - ãƒãƒƒãƒˆãƒ©ã‚¸ã‚ªã€ã¨ã„ã†ã‚¢ãƒ—リをリリースã—ãŸã®ã§ã™ãŒã€ã“ã®ã‚¢ãƒ—リã«å°Žå…¥ã™ã‚‹ã‚¹ã‚¿ãƒ†ã‚£ãƒƒã‚¯ãƒªãƒ³ã‚¯ãƒ©ã‚¤ãƒ–ラリãŒä¸æ˜Žãªå¤–部サーãƒãƒ¼ã¸é€šä¿¡ã—ã¦ã„ãªã„ã‹ã€SSLを使用ã—ã¦ã„ã‚‹ã¤ã‚‚ã‚ŠãŒãã†ã§ãªã„通信をã—ã¦ã—ã¾ã£ã¦ã„ãªã„ã‹ã®ãƒã‚§ãƒƒã‚¯ã‚’ã™ã‚‹ãŸã‚ã€è‡ªåˆ†ã¯mitmproxyã¨ã„ã†
SSL/SPDYを攻撃ã™ã‚‹CRIMEã¯BEASTã®æ£çµ±ãªå¾Œç¶™è€…ã
ã¯ã˜ã‚㫠以å‰ã®ã‚¨ãƒ³ãƒˆãƒªã§SSLã«å¯¾ã™ã‚‹æ–°ã—ã„攻撃手法「BEASTã€ã‚’紹介ã—ã¾ã—ãŸãŒã€ä»Šå›žã¯BEASTã‚’ã•ã‚‰ã«ç™ºå±•ã•ã›ãŸã€ŒCRIMEã€ã¨ã„ã†æ”»æ’ƒã«ã¤ã„ã¦ç°¡å˜ã«ç´¹ä»‹ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ä¸€æ¬¡æƒ…å ±æºã¨ã—ã¦ã“ã¡ã‚‰ã®ã‚¹ãƒ©ã‚¤ãƒ‰ï¼ˆè‹±èªžï¼‰ãŒé–²è¦§ã§ãã¾ã™ã®ã§ã€æ™‚é–“ãŒã‚ã‚‹æ–¹ã¯ãœã²ç›®ã‚’通ã—ã¦ã¿ã¦ãã ã•ã„。 CRIMEã®æ„味 CRIME㯠"Compression Ratio Info-Leak Made Easy" ã‚ã‚‹ã„㯠"Compression Ratio Info-Leak Mass Exploitation" ã®é æ–‡å—ã§ã€SSLã‚„SPDY（ã‚ã‚‹ã„ã¯HTTPボディ部ã®gzip圧縮）ã§ä½¿ã‚れる圧縮アルゴリズムã«æ³¨ç›®ã—ãŸæ”»æ’ƒæ‰‹æ³•ã§ã™ã€‚ã‚ã¾ã‚ŠçŸ¥ã‚‰ã‚Œã¦ã„ã¾ã›ã‚“ãŒSSLã«ã¯åœ§ç¸®æ©Ÿèƒ½ãŒå˜åœ¨ã—ã¦ãŠã‚Šã€ã‚µãƒ¼ãƒå´ãƒ»ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆå´åŒæ–¹ãŒåœ§ç¸®æ©Ÿèƒ½ã‚’ONã«ã—ã¦ã„ã‚‹å ´åˆã«ã€ãƒ‡ãƒ¼ã‚¿ãŒåœ§ç¸®ã•ã‚Œã¾ã™ã€‚ BEASTã¨ã®é–¢ä¿‚ CRIMEã¯B
スノーデン事件ã®è£ã§èµ·ãã¦ã„ãŸSSL秘密éµã‚’巡る戦ã„:Geekãªãºãƒ¼ã˜
今月7æ—¥ã‹ã‚‰9æ—¥ã«ã‚¢ãƒªã‚¾ãƒŠå·žã§é–‹å‚¬ã•ã‚ŒãŸNANOG 59ã§ã€Ladar Levisonæ°ãŒFBIã«ã‚µãƒ¼ãƒ“ス全体ã®SSL秘密éµã‚’è¦æ±‚ã•ã‚ŒãŸè©±ãŒå…¬é–‹ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚ Ladar Levisonæ°ãŒé‹å–¶ã—ã¦ã„ãŸã€Lavabitã¨ã„ã†é›»åメールサービスã¯ã‚¹ãƒŽãƒ¼ãƒ‡ãƒ³äº‹ä»¶ã«é–¢é€£ã—ã¦çªå¦‚8月8æ—¥ã«é–‰éŽ–ã•ã‚Œã¦ã„ã¾ã™ã€‚ 閉鎖時ã«ã¯è©³ç´°ãŒæ›¸ã‹ã‚Œã¦ãŠã‚‰ãšã€æ§˜ã€…ãªæ†¶æ¸¬ãŒèªžã‚‰ã‚Œã¦ã„ã¾ã—ãŸãŒã€ä¸–ç•Œä¸ã‹ã‚‰å¤šæ•°ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒé›†ã¾ã‚‹NANOGã§ã€ãã®ä¸€éƒ¨å§‹çµ‚ãŒèªžã‚‰ã‚Œã¾ã—ãŸã€‚ ã“ã®ç™ºè¡¨ã¯ã€NANOG 59ãŒé–‹å§‹ã•ã‚Œã‚‹å‰ã®é€±ã«ã€è£åˆ¤æ‰€ãŒèª¿æŸ»å¯¾è±¡ã®æ°å以外を機密解除ã—ãŸã“ã¨ã«ã‚ˆã£ã¦å®Ÿç¾ã—ã¦ã„ã¾ã™ã€‚ インターãƒãƒƒãƒˆä¸Šã§æä¾›ã•ã‚Œã¦ã„るサービス事æ¥è€…ã«SSL秘密éµã‚’æ出ã•ã›ã€ã‹ã¤ã€ãã®äº‹å®Ÿã®å…¬è¡¨ãŒé•æ³•è¡Œç‚ºã¨ãªã‚‹ã‚ˆã†ã«ã•ã‚Œã¦ã—ã¾ã£ã¦ã„る一方ã§ã€ã“ã†ã„ã£ãŸå†…容を公的ã«èªžã‚Œã‚‹ã‚ˆã†ã«è£åˆ¤æ‰€ã§æˆ¦ã£ã¦ã€å®Ÿéš›ã«ãれをå‹ã¡å–ã‚‹ã¨ã„ã†ã®ã¯å‡„
NSAã€æ¥µç§˜ãƒ—ãƒã‚°ãƒ©ãƒ 「Bullrunã€ã§æš—å·åŒ–技術を迂回ã‹--NYTå ±é“
The New York Times（NYT）ã®å ±é“ã«ã‚ˆã‚‹ã¨ã€ç±³å›½å®¶å®‰å…¨ä¿éšœå±€ï¼ˆNSA）ã¯ã€ã‚らゆる暗å·åŒ–技術を迂回ã™ã‚‹ãƒãƒƒã‚¯ãƒ‰ã‚¢ã‚’政府ã«ä¸Žãˆã‚‹ã“ã¨ã®æ˜¯éžã‚’ã‚ãã‚‹90年代ã®è«–争ã«æ•—ã‚ŒãŸã«ã‚‚ã‹ã‹ã‚らãšã€ã€ŒBullrunã€ã¨ã„ã†ã‚³ãƒ¼ãƒ‰ãƒãƒ¼ãƒ ã®æ¥µç§˜ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’ç«‹ã¡ä¸Šã’ã€ä»Šã§ã¯ã€æ—¥å¸¸çš„ãªé›»åメールã‹ã‚‰é‡‘èžãŠã‚ˆã³åŒ»ç™‚記録ã¾ã§ã€ã•ã¾ã–ã¾ãªãƒ‡ã‚¸ã‚¿ãƒ«é€šä¿¡ã®ä¿è·ã‚’目的ã¨ã™ã‚‹äº‹å®Ÿä¸Šã®é˜²å¾¡å£ã®å¤§åŠã‚’迂回ã™ã‚‹ã“ã¨ãŒã§ãã‚‹ã¨ã„ã†ã€‚ 英国ã®Guardianç´™ãŠã‚ˆã³éžå–¶åˆ©å ±é“æ©Ÿé–¢ProPublicaã¨å…±åŒã§åŸ·ç†ã•ã‚ŒãŸåŒè¨˜äº‹ã¯ã€ã€ŒPRISMã€ãƒ—ãƒã‚°ãƒ©ãƒ を暴露ã—ãŸEdward Snowdenæ°ã«ã‚ˆã£ã¦æä¾›ã•ã‚ŒãŸæ–‡æ›¸ã‚„ã€æ¥ç•Œé–¢ä¿‚者ã¨ã®ã‚¤ãƒ³ã‚¿ãƒ“ューを引用ã—ã€NSAã¯ã•ã¾ã–ã¾ãªæ‰‹æ³•ã§ä¸€èˆ¬çš„ãªãƒãƒƒãƒˆæš—å·åŒ–方法を迂回ã—ã¦ããŸã¨ä¼ãˆãŸã€‚ãれらã®æ‰‹æ³•ã«ã¯ã€æ°‘é–“ä¼æ¥ã®ã‚µãƒ¼ãƒã«ä¾µå…¥ã—ã¦æš—å·åŒ–ã‚ーを盗んã ã‚Šã€ãƒ†ã‚¯ãƒŽãƒã‚¸ä¼æ¥ã¨å…±åŒã§ãƒãƒƒã‚¯ãƒ‰ã‚¢ã‚’
1
ãŠçŸ¥ã‚‰ã›
ランã‚ング
ランã‚ング
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Googleã€SSL 3.0ã®è„†å¼±æ€§ã€ŒPOODLEã€ã‚’公表ã€SSL 3.0ã¯ä»Šå¾Œã‚µãƒãƒ¼ãƒˆå»ƒæ¢ã®æ„å‘　
Steve Streza ðŸ³ï¸â€ðŸŒˆ on Twitter: "Update your iPhones/iPads now. The SSL bug is really bad. Always brace your if statements. https://t.co/eyeDvhwAV9 http://t.co/lEgUdqZChu"
{{#tags}}- {{label}}
{{/tags}}