[B! ã‚ã¨ã§èªã‚€][security] mad-pã®ãƒ

mad-p id:mad-p

ã‚ã¨ã§èªã‚€ã¨securityã«é–¢ã™ã‚‹mad-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (11)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒãƒƒãƒˆã®ä¿¡é ¼ã‚’æ”¯ãˆã‚‹åŸºç›¤ãŒå´©å£Šï¼Ÿã€€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é¨’å‹•ã§æµ®ä¸Šã—ãŸèª²é¡Œ
ãƒãƒƒãƒˆã®ä¿¡é ¼ã‚’æ”¯ãˆã‚‹åŸºç›¤ãŒå´©å£Šï¼Ÿã€€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é¨’å‹•ã§æµ®ä¸Šã—ãŸèª²é¡Œï¼šæ¥ç•Œã®ã‚¨ã‚ã‚¹ãƒ‘ãƒ¼ãƒˆãŒè¨Žè«–ï¼ˆ1/3 ãƒšãƒ¼ã‚¸ï¼‰ OpenSSLã®è„†å¼±æ€§å•é¡Œã‚„ãƒªã‚¹ãƒˆåž‹æ”»æ’ƒãªã©ã€è¿‘å¹´ã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ä¿¡é ¼ã‚’æ”¯ãˆã‚‹åŸºç›¤ã‚’æºã‚‹ãŒã—ã‹ããªã„äº‹è±¡ãŒå¤šç™ºã—ã¦ã„ã‚‹ã€‚ä¿¡é ¼ã®ãŸã‚ã®åŸºç›¤ã¯å´©å£Šã—ã¦ã—ã¾ã†ã®ã‹â€•â€•ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¥ç•Œã®å°‚é–€å®¶é™£ãŒè°è«–ã‚’äº¤ã‚ã—ãŸã€‚ 4æœˆã‹ã‚‰5æœˆã«ã‹ã‘ã¦ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆåˆ©ç”¨ã‚’æ”¯ãˆã‚‹é‡è¦ãªã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®è„†å¼±æ€§å•é¡ŒãŒä¸–é–“ã‚’è³‘ã‚ã›ãŸã€‚ã€Œã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ä¿¡é ¼åŸºç›¤ã‚’æºã‚‹ãŒã—ã‹ããªã„ã€ã¨ã„ã£ãŸå ±é“ã‚‚ç›¸æ¬¡ã„ã ã€‚ã“ã†ã—ãŸäº‹æ…‹ã‚’å—ã‘ã¦æ—¥æœ¬ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å”ä¼šï¼ˆJNSAï¼‰ãŒã€Œç·Šæ€¥æ™‚äº‹ãƒ¯ãƒ¼ã‚¯ã‚·ãƒ§ãƒƒãƒ—ã€ã‚’é–‹å‚¬ã€‚ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¥ç•Œã®å°‚é–€å®¶ãŒã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ä¿¡é ¼ã‚’æ”¯ãˆã‚‹åŸºç›¤ã‚’ã©ã†å®ˆã‚‹ã¹ãã«ã¤ã„ã¦è°è«–ã—ãŸã€‚ ãƒ¯ãƒ¼ã‚¯ã‚·ãƒ§ãƒƒãƒ—ã«ã¯ã€ã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼ã®è¾»ä¼¸å¼˜æ°ã€NTTã‚»ã‚ãƒ¥ã‚¢ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ç ”ç©¶æ‰€ã®ç¥žç”°é›…é€æ°ã€æ—¥æœ¬ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã‚µãƒ¼
mad-p 2014/06/02
security

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
Covert Redirect and its real impact on OAuth and OpenID Connect
A Ph.D. Student in Mathematics by the name of Wang Jing discovered and publicized Open Redirectors at Relying party websites this morning ....
mad-p 2014/05/07
John Bradleyã«ã‚ˆã‚‹è§£èª¬ã€‚OAuth2ã¨OIDCã«é–¢ã—ã¦ã¯æ—¢çŸ¥ã®è„†å¼±æ€§ã§ã‚ã‚ŠRFC6819ã®4.2.4ã§å¯¾ç–ãŒæ˜Žè¨˜ã•ã‚Œã¦ã„ã‚‹ã€‚å¯¾ç–ã‚’ã¡ã‚ƒã‚“ã¨ã—ã¦ã„ãªã„Facebookã®å•é¡Œã€‚ãƒ‡ãƒ¢ã¯ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼ã‹ã‚‰ãƒ¦ãƒ¼ã‚¶ã—ã‹çŸ¥ã‚‰ãªã„æƒ…å ±ã‚’ã‚³ãƒ”ãƒšã—ã¦ã„ã‚‹ãªã©ä½œç‚ºçš„

covert redirect

oauth

openid

oidc

security

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html
mad-p 2014/05/07
ã“ã£ã¡ã‚‚ã˜ã£ãã‚Šèªã‚€

covert redirect

oauth

openid

security

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
http://tetraph.com/covert_redirect/
mad-p 2014/05/07
ã¡ã‚‡ã£ã¨ã˜ã£ãã‚Šèªã‚“ã§ã¿ã‚‹

covert redirect

oauth

openid

security

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
å¼·çƒˆãªDNSã‚ãƒ£ãƒƒã‚·ãƒ¥ãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°æ‰‹æ³•ãŒå…¬é–‹ã•ã‚Œã‚‹:Geekãªãºãƒ¼ã˜
æœ¬æ—¥ã€JPRSãŒç·Šæ€¥ã®æ³¨æ„å–šèµ·ã‚’å…¬è¡¨ã—ã¾ã—ãŸã€‚ ç·Šæ€¥ï¼‰ã‚ãƒ£ãƒƒã‚·ãƒ¥ãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°æ”»æ’ƒã®å±é™ºæ€§å¢—åŠ ã«ä¼´ã†DNSã‚µãƒ¼ãƒãƒ¼ã®è¨å®šå†ç¢ºèªã«ã¤ã„ã¦ï¼ˆ2014å¹´4æœˆ15æ—¥å…¬é–‹ï¼‰- å•ã„åˆã‚ã›UDPãƒãƒ¼ãƒˆã®ãƒ©ãƒ³ãƒ€ãƒ åŒ–ã®é€Ÿã‚„ã‹ãªç¢ºèªãƒ»å¯¾å¿œã‚’å¼·ãæŽ¨å¥¨ ãã‚Œã«å¯¾ã—ã¦ã€2æœˆä¸æ—¬ã«è„†å¼±æ€§ã‚’ç™ºè¦‹ã—ã¦JPRSã¸ã¨å ±å‘Šã—ã¦ã„ãŸéˆ´æœ¨æ°(è„†å¼±æ€§ã¯å‰é‡Žæ°ã¨ã®å…±åŒç™ºè¦‹)ãŒã€JPRSã®æ³¨æ„å–šèµ·ã§ã¯ã€Œå±é™ºæ€§ã‚’ã‚ˆãç†è§£ã—ã¦å¯¾ç–ã‚’ã¨ã‚‹ã«ã‚ãŸã£ã¦ååˆ†ãªæƒ…å ±ãŒå«ã¾ã‚Œã¦ã„ã‚‹ã¨ã¯ã„ãˆã¾ã›ã‚“ã€ã¨ã—ã¦ã€ä»¥ä¸‹ã®æƒ…å ±ã‚’å…¬é–‹ã—ã¦ã„ã¾ã™ã€‚ é–‹ã„ãŸãƒ‘ãƒ³ãƒ‰ãƒ©ã®ç®± - é•·å¹´æ”¾ç½®ã•ã‚Œã¦ããŸDNSã®æã‚‹ã¹ãæ¬ é™¥ãŒæ˜Žã‚‰ã‹ã« ã‚ãƒ£ãƒƒã‚·ãƒ¥ãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°ã®é–‹ã„ãŸãƒ‘ãƒ³ãƒ‰ãƒ©ã®ç®± ã‚ãƒ£ãƒƒã‚·ãƒ¥ãƒã‚¤ã‚ºãƒ‹ãƒ³ã‚°ã®é–‹ã„ãŸãƒ‘ãƒ³ãƒ‰ãƒ©ã®ç®± - 2 - æœ¬æ¥ã§ã‚ã‚Œã°ã€ã‚ˆã‚Šä¸Šä½ã‹ã‚‰ã®æ£è¦ã®å›žç”ãŒå„ªå…ˆã•ã‚Œãªã‘ã‚Œã°ãªã‚‰ãªã„ã¯ãšãªã®ã«ã€ä¸‹ä½å´ãŒå„ªå…ˆã•ã‚Œã‚‹ä»•æ§˜ã«ãªã£ã¦ã„ã‚‹ã®ã§ã€å½è£…ã•ã‚ŒãŸãƒ‡ãƒ¼ã‚¿ãŒå„ªå…ˆã•ã‚Œã¦ã—ã¾ã†
mad-p 2014/04/16
ã“ã“ã‹ã‚‰ãƒªãƒ³ã‚¯ã•ã‚Œã¦ã‚‹è³‡æ–™ã‚‚èªã¾ãã°

security

DNS

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
ã‚¹ãƒŽãƒ¼ãƒ‡ãƒ³äº‹ä»¶ã®è£ã§èµ·ãã¦ã„ãŸSSLç§˜å¯†éµã‚’å·¡ã‚‹æˆ¦ã„:Geekãªãºãƒ¼ã˜
ä»Šæœˆ7æ—¥ã‹ã‚‰9æ—¥ã«ã‚¢ãƒªã‚¾ãƒŠå·žã§é–‹å‚¬ã•ã‚ŒãŸNANOG 59ã§ã€Ladar Levisonæ°ãŒFBIã«ã‚µãƒ¼ãƒ“ã‚¹å…¨ä½“ã®SSLç§˜å¯†éµã‚’è¦æ±‚ã•ã‚ŒãŸè©±ãŒå…¬é–‹ã•ã‚Œã¦ã„ã¾ã—ãŸã€‚ Ladar Levisonæ°ãŒé‹å–¶ã—ã¦ã„ãŸã€Lavabitã¨ã„ã†é›»åãƒ¡ãƒ¼ãƒ«ã‚µãƒ¼ãƒ“ã‚¹ã¯ã‚¹ãƒŽãƒ¼ãƒ‡ãƒ³äº‹ä»¶ã«é–¢é€£ã—ã¦çªå¦‚8æœˆ8æ—¥ã«é–‰éŽ–ã•ã‚Œã¦ã„ã¾ã™ã€‚ é–‰éŽ–æ™‚ã«ã¯è©³ç´°ãŒæ›¸ã‹ã‚Œã¦ãŠã‚‰ãšã€æ§˜ã€…ãªæ†¶æ¸¬ãŒèªžã‚‰ã‚Œã¦ã„ã¾ã—ãŸãŒã€ä¸–ç•Œä¸ã‹ã‚‰å¤šæ•°ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒé›†ã¾ã‚‹NANOGã§ã€ãã®ä¸€éƒ¨å§‹çµ‚ãŒèªžã‚‰ã‚Œã¾ã—ãŸã€‚ ã“ã®ç™ºè¡¨ã¯ã€NANOG 59ãŒé–‹å§‹ã•ã‚Œã‚‹å‰ã®é€±ã«ã€è£åˆ¤æ‰€ãŒèª¿æŸ»å¯¾è±¡ã®æ°åä»¥å¤–ã‚’æ©Ÿå¯†è§£é™¤ã—ãŸã“ã¨ã«ã‚ˆã£ã¦å®Ÿç¾ã—ã¦ã„ã¾ã™ã€‚ ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã§æä¾›ã•ã‚Œã¦ã„ã‚‹ã‚µãƒ¼ãƒ“ã‚¹äº‹æ¥è€…ã«SSLç§˜å¯†éµã‚’æå‡ºã•ã›ã€ã‹ã¤ã€ãã®äº‹å®Ÿã®å…¬è¡¨ãŒé•æ³•è¡Œç‚ºã¨ãªã‚‹ã‚ˆã†ã«ã•ã‚Œã¦ã—ã¾ã£ã¦ã„ã‚‹ä¸€æ–¹ã§ã€ã“ã†ã„ã£ãŸå†…å®¹ã‚’å…¬çš„ã«èªžã‚Œã‚‹ã‚ˆã†ã«è£åˆ¤æ‰€ã§æˆ¦ã£ã¦ã€å®Ÿéš›ã«ãã‚Œã‚’å‹ã¡å–ã‚‹ã¨ã„ã†ã®ã¯å‡„
mad-p 2013/10/18
ã‚ã¨ã§èªã‚€

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

SSL

ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆ
ãƒªãƒ³ã‚¯
HTTPSã‚’ä½¿ã£ã¦ã‚‚Cookieã®æ”¹å¤‰ã¯é˜²ã’ãªã„ã“ã¨ã‚’å®Ÿé¨“ã§è©¦ã—ã¦ã¿ãŸ
å¯ºç”°ã•ã‚“ã®ãƒ–ãƒã‚°ã‚¨ãƒ³ãƒˆãƒªã€Œä»–äººã®Cookieã‚’æ“ä½œã™ã‚‹ã€ã«ã¯ã€é€šä¿¡è·¯ä¸Šã®æ”»æ’ƒè€…ãŒã„ã‚‹å ´åˆã¯ã€SSLã‚’ä½¿ã£ã¦ã‚‚ã€Cookieã®ç›—è´ã‚’é˜²ãã“ã¨ã¯ã§ãã‚‹ãŒã€Cookieã®æ”¹å¤‰ã‚’é˜²ãã“ã¨ã¯ã§ããªã„ã¨æŒ‡æ‘˜ã•ã‚Œã¦ã„ã¾ã™ã€‚ã„ã‹ã«ã‚‚å¯ºç”°ã•ã‚“ã‚‰ã—ã„ç°¡ã«ã—ã¦è¦ã‚’å¾—ãŸã‚¨ãƒ³ãƒˆãƒªã§ã€ã“ã‚Œã«ä»˜ã‘åŠ ãˆã‚‹ã“ã¨ã¯ã‚ã¾ã‚Šãªã„ã®ã§ã™ãŒã€æ®‹å¿µãªãŒã‚‰ã¾ã èªã‚“ã§ã„ãªã„äººãŒå¤šãã†ã ã¨è¨€ã†ã“ã¨ã¨ã€ã‚ˆã‚Šåºƒã„èªè€…ã«å‘ã‘ã¦å…·ä½“çš„ã«èª¬æ˜Žã—ãŸæ–¹ãŒã‚ˆã„ã ã‚ã†ã¨è€ƒãˆã¾ã—ãŸã€‚ ãã“ã§ã€é€šä¿¡è·¯ä¸Šã«æ”»æ’ƒè€…ãŒã„ã‚‹å…¸åž‹ä¾‹ã¨ã—ã¦ã€å…¬è¡†ç„¡ç·šLANã®å½APï¼ˆã‚¢ã‚¯ã‚»ã‚¹ãƒã‚¤ãƒ³ãƒˆï¼‰ãŒã‚ã‚‹ã‚±ãƒ¼ã‚¹ã‚’é¡Œæã¨ã—ã¦ã€ã€ŒHTTPSã‚’ä½¿ã£ã¦ã‚‚Cookieã®æ”¹å¤‰ã¯é˜²ã’ãªã„ã€ã“ã¨ã‚’èª¬æ˜Žã—ã¾ã™ï¼ˆSecureå±žæ€§ä½¿ã†ã¨ç›—è´ã¯é˜²ã’ã¾ã™ãŒã€æ”¹å¤‰ã¯é˜²ã’ã¾ã›ã‚“ï¼‰ã€‚é•·ã„ã‚¨ãƒ³ãƒˆãƒªãªã®ã§çµè«–ã‚’å…ˆã«æ›¸ã„ã¦ãŠãã¾ã™ã€‚ Secureå±žæ€§ãŒãªã„Cookieã¯HTTPSã§ã‚‚ç›—è´ã§ãã‚‹ Cookieã®æ”¹å¤‰ã«ã¤ã„ã¦ã¯Se
mad-p 2013/09/30
ãªã‚‹ã»ã©ã€‚å¾Œã§ã˜ã£ãã‚Šèªã¿ç›´ã™

security

Cookie

ssl

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
The "Hoko Tate" TV show writeup
Many engineers in Japan are familiar with a TV show called "Hoko Tate". It is a family variety show run on Sundays that demonstrates a competition between two contradictory entities. For example, a drill that can penetrate any wall versus an impenetrable safe made of steel. The episode that we were asked to participate in was very unique for Fuji TV. The producer offered our team to play against a
mad-p 2013/08/20
ã»ã“Ã—ãŸã¦æ”»æ’ƒå´ã®è¦–ç‚¹

security

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
agilecatcloud.com
This domain may be for sale!
mad-p 2013/06/11
PRISM

security

NSA

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
HTTPS ã‚’ä½¿ã£ã¦ã‚‹ã‚¢ãƒ—ãƒªã‚’ AppStore ã‚„ Android Market ã§é…ä¿¡ã™ã‚‹ã¨ãã®è¼¸å‡ºæ‰‹ç¶šãã«ã¤ã„ã¦ - ã‚€ã‚‰ã‹ã¿ã®é›‘è¨˜å¸³
'12/11/24: ã“ã®ãƒ–ãƒã‚°ã®å†…å®¹ã‚’ã‚‚ã¨ã« Amazon Kindle ã‚¹ãƒˆã‚¢ã§é›»åæ›¸ç±ã‚’å‡ºç‰ˆã—ã¾ã—ãŸã€‚ ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã‚¢ãƒ—ãƒªé…ä¿¡ã®è¼¸å‡ºç®¡ç† ä½œè€…: æ‘ä¸Šå“å¼¥å‡ºç‰ˆç¤¾/ãƒ¡ãƒ¼ã‚«ãƒ¼: æ‘ä¸Šã€€å“å¼¥ç™ºå£²æ—¥: 2012/11/23ãƒ¡ãƒ‡ã‚£ã‚¢: Kindleç‰ˆ ã‚¯ãƒªãƒƒã‚¯: 1å›žã“ã®å•†å“ã‚’å«ã‚€ãƒ–ãƒã‚° (2ä»¶) ã‚’è¦‹ã‚‹ AppStore ã§ã‚¢ãƒ—ãƒªé…ä¿¡ã‚’ã—ã‚ˆã†ã¨ã—ã¦ iTunes Connect ã«ã‚¢ãƒ—ãƒªã‚’ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã—ã‚ˆã†ã¨ã™ã‚‹ã¨ã€ã€Œæš—å·ä½¿ã£ã¦ã‚‹ã‹ã„ï¼Ÿã€(Export Complianceã®ã¨ã“ã‚)ã¨ã„ã†è³ªå•ãŒã•ã‚Œã¾ã™ã‚ˆãï¼Ÿçš†ã•ã‚“ã€ã‚ãã“ã¡ã‚ƒã‚“ã¨ç”ãˆã¦ã¾ã™ã‹ï¼Ÿ ã»ã¨ã‚“ã©ã®ã‚µã‚¤ãƒˆã¯ No ã§ã„ã„ã‚ˆã€ã¨æ›¸ã„ã¦ã‚ã‚Šã¾ã™ã€‚ãŒã€ã“ã‚Œã¯é–“é•ã„ã€‚ã‚¢ãƒ—ãƒªãŒæš—å·é–¢é€£ã§ãªãã¦ã‚‚ã€ã‚¢ãƒ—ãƒªå†…ã«æš—å·ã‚³ãƒ¼ãƒ‰ãŒå…¥ã£ã¦ãªãã¦ã‚‚ã€iOS ã®æš—å·ã‚’ä½¿ã£ã¦ã„ã‚‹å ´åˆã¯ã“ã“ã¯ Yes ã¨ç”ãˆãªã„ã¨ã„ã‘ã¾ã›ã‚“ã€‚ å…·ä½“çš„ã«ã¯ã€HTTPS ã‚’ä½¿ã£ã¦ã‚‹å ´
mad-p 2011/10/10
ã¡ã‚ƒã‚“ã¨ãƒã‚§ãƒƒã‚¯ã—ãªã„ã¨ã„ã‘ãªã„ãª

security

ã‚¢ãƒ—ãƒª

æš—å·

è¼¸å‡º

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
Detecting Certificate Authority compromises and web browser collusion | Tor Project
Detecting Certificate Authority compromises and web browser collusion by ioerror | March 23, 2011 Thanks to Ian Gallagher, Seth Schoen, Jesse Burns, Chris Palmer, and other anonymous birds for their invaluable feedback on this writeup. The Tor Project has long understood that the certification authority (CA) model of trust on the internet is susceptible to various methods of compromise. Without st
mad-p 2011/03/24
Comodoã‹ã‚‰å½ã®è¨¼æ˜Žæ›¸ãŒå‡ºãŸä»¶ã®è¿½è·¡æ‰‹æ³•ã€‚CRLã‚’å‡ºã•ãšã«ãƒ‘ãƒƒãƒã§å¯¾å‡¦ã™ã‚‹ã®ã¯ãªãœ? CRLã¯æ©Ÿèƒ½ã—ãªã„ã€ã£ã¦æ›¸ã„ã¦ã‚ã‚‹ãªã‚

ã‚ã¨ã§èªã‚€

security
ãƒªãƒ³ã‚¯
1