[B! security] mad-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

mad-p id:mad-p

securityã«é–¢ã™ã‚‹mad-pã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (79)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³å¯¾ç–ã‚‚ã‚Œã®è²¬ä»»ã‚’é–‹ç™ºä¼šç¤¾ã«å•ã†åˆ¤æ±º
ãƒã‚¤ãƒ³ãƒˆã¯ä¸‹è¨˜ã®é€šã‚Šã§ã™ã€‚ Xç¤¾ï¼ˆåŽŸå‘Šï¼‰ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã«ã¤ã„ã¦ç‰¹ã«æŒ‡ç¤ºã¯ã—ã¦ã„ãªã‹ã£ãŸ æå®³è³ å„Ÿã«ã¤ã„ã¦å€‹åˆ¥å¥‘ç´„ã«å®šã‚ã‚‹å¥‘ç´„é‡‘é¡ã®ç¯„å›²å†…ã¨ã™ã‚‹æå®³è³ å„Ÿè²¬ä»»åˆ¶é™ãŒã‚ã£ãŸ å½“åˆã‚·ã‚¹ãƒ†ãƒ ã¯ã‚«ãƒ¼ãƒ‰æ±ºæ¸ˆã‚’å¤–éƒ¨å§”è¨—ã—ç›´æŽ¥ã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’æ‰±ã£ã¦ã„ãªã‹ã£ãŸ Xç¤¾ãŒã€Œã‚«ãƒ¼ãƒ‰ä¼šç¤¾æ¯Žã®æ±ºæ¸ˆé‡‘é¡ã‚’çŸ¥ã‚ŠãŸã„ã€ã¨Yç¤¾ã«ä¾é ¼ã‚’ã—ã¦ã€ãã®çµæžœã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ã„ã£ãŸã‚“DBã«ä¿å˜ã™ã‚‹ä»•æ§˜ã¨ãªã£ãŸï¼ˆ2010å¹´1æœˆ29æ—¥ï¼‰ Xç¤¾ã‹ã‚‰ã®å•ã„åˆã‚ã›ã«å¯¾ã—ã¦Yç¤¾ã¯ã€ã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ä¿æŒã—ãªã„æ–¹å¼ã«å¤‰æ›´ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã§ã€ãã®ã»ã†ãŒå®‰å…¨ã¨ãªã‚Šã€è²»ç”¨ã¯20ä¸‡å††ç¨‹åº¦ã§ã‚ã‚‹æ—¨ã‚’ä¼ãˆãŸï¼ˆ2010å¹´9æœˆ27æ—¥ï¼‰ãŒã€ãã®å¾ŒXç¤¾ã¯æ”¹è‰¯ã®æŒ‡ç¤ºã‚’ã—ãªã‹ã£ãŸ ä»¥ä¸‹ã®è„†å¼±æ€§ãã®ä»–ãŒèªã‚ã‚‰ã‚ŒãŸ ã‚·ã‚¹ãƒ†ãƒ ç®¡ç†æ©Ÿèƒ½ã®IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãŒ admin/password ã§ã‚ã£ãŸ å€‹äººæƒ…å ±ãŒè¨˜è¼‰ã•ã‚ŒãŸãŠå•ã„åˆã‚ã›ãƒã‚°ãƒ•ã‚¡ã‚¤ãƒ«ã®é–²è¦§ãŒå¯èƒ½ï¼ˆãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒªã‚¹ãƒ†ã‚£ãƒ³ã‚°ã¨æ„å›³ã—ãªã„ãƒ•ã‚¡ã‚¤
mad-p 2015/01/22
SQL

sqlã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³

security
ãƒªãƒ³ã‚¯
vol.19å ±å‘Š(1/2)â€•2014ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼äº‹ä»¶ã®æŒ¯ã‚Šè¿”ã‚Šã€å°‚é–€å®¶ã‚‚ãƒ¦ãƒ¼ã‚¶ãƒ¼åŒæ§˜ã«æ‚©ã¿æˆ¦ã£ã¦ã„ãŸ - TechLION
TechLIONå–æçã®ã¾ã¤ã†ã‚‰ã§ã™ã€‚ä»Šé€±ãã—ã¦æ¥é€±ã®ãƒ–ãƒã‚°ã§ã¯ã€11/25ã«é–‹å‚¬ã—ãŸTechLION vol.19ã®ãƒ¬ãƒãƒ¼ãƒˆã‚’ãŠå±Šã‘ã—ã¾ã™ã€‚ æœ¬æ—¥ã®ã‚²ã‚¹ãƒˆã¯ã€å…¨å“¡ã‚¹ãƒ¼ãƒ„ã‚’ç€ã¦ã„ãŸï¼ˆå¯¾ã™ã‚‹MCãŒã‚«ã‚¸ãƒ¥ã‚¢ãƒ«ã™ãŽ?ï¼‰ ã‚‚ã†å¹¾ã¤å¯ã‚‹ã¨ãŠæ£æœˆâ€¦â€¦ã€ã«ã¯ã¡ã‚‡ã£ã¨æ—©ã„ã§ã™ãŒä»Šå¹´ã‚‚ã„ã‚ˆã„ã‚ˆæœ€å¾Œã®æœˆã«ã€‚ã“ã®2014å¹´ã¯IT ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã«ã¨ã£ã¦ã‚‚æœ¬å½“ã«ã„ã‚ã„ã‚ã‚ã‚Šã¾ã—ãŸã€‚ã¨ã„ã†ã‚ã‘ã§æœ¬æ—¥ã®TechLIONã¯ã€é…’ã‚’é…Œã¿äº¤ã‚ã—ãªãŒã‚‰ä»Šå¹´ä¸€å¹´ã‚’æŒ¯ã‚Šè¿”ã‚‹ã€ä¸€è¶³æ—©ã„å¿˜å¹´ä¼šãªã®ã§ã™ã€‚ ä»Šå›žã®ã‚²ã‚¹ãƒˆã¯ã€ãã‚“ãªIT ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ä¸ã§ã‚‚ç‰¹ã«ã„ã‚ã„ã‚ã‚ã£ãŸã§ã‚ã‚ã†ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼æ¥ç•Œã‹ã‚‰ãŠå‘¼ã³ã—ãŸä¸‰é¸æ‰‹ã€‚Heartbleedã«Shellshockã€ã‚‚ã†å°‘ã—ä¸€èˆ¬ã«çŸ¥ã‚‰ã‚Œã¦ã„ã‚‹è©±ã§ã¯ãƒ™ãƒãƒƒã‚»ã®å²ä¸Šæœ€å¤§ç´šã®é¡§å®¢æƒ…å ±æ¼æ´©äº‹ä»¶ãªã©ã€‚ä»Šå¹´ã®é¨’ãŽã¯è¿‘å¹´ç¨€ã«è¦‹ã‚‹è¦æ¨¡ã§ã—ãŸãŒã€ãã‚“ãªä¸€å¹´ã‚’çš†ã§æŒ¯ã‚Šè¿”ã£ã¦ã„ãã¾ã—ã‚‡ã†ã€‚ å½“æ—¥ã®å…¨ã‚»ãƒƒã‚·ãƒ§ãƒ³ã®æ¨¡æ§˜ã®éŒ²ç”»(
mad-p 2014/12/03
security
ãƒªãƒ³ã‚¯
TLSã¨SPDYã®é–“ã§Google ChromeãŒãƒãƒžã£ãŸè„†å¼±æ€§(CVE-2014-3166ã®è§£èª¬) - ã¼ã¡ã¼ã¡æ—¥è¨˜
1. ã¯ã˜ã‚ã«ã€ GoogleãŒãƒãƒžã£ãŸã‚·ãƒªãƒ¼ã‚ºç¬¬3å¼¾ã€‚ä»Šåº¦ã¯ Chrome ã®è„†å¼±æ€§ãŒãƒ†ãƒ¼ãƒžã§ã™ã€‚ å…ˆæ—¥(8æœˆ12æ—¥é ƒï¼‰çªç„¶Google Chromeã§SPDYã®æ©Ÿèƒ½ãŒä¸€æ—¦åœæ¢ã•ã‚Œã¾ã—ãŸã€‚CloudFareã®äººãŒæ°—ã¥ã„ã¦spdy-devã¸ã®MLã®å•ã„åˆã‚ã›ã—ã€ã™ãGoogleã®aglã•ã‚“ã‹ã‚‰ã®è¿”äº‹ã§è¨ˆç”»çš„ã§ä¸€æ™‚çš„ãªã‚‚ã®ã§ã‚ã‚‹ã“ã¨ãŒã‚ã‹ã‚Šã¾ã—ãŸã€‚ twitterã‚„facebookã‚‚SPDYãŒå…¨ã¦ä½¿ãˆãªããªã‚Šéžå¸¸ã«é©šã„ãŸã®ã§ã™ãŒã€ç›´å¾Œã« Chrome ã® Stable/Beta/Dev ãƒãƒ£ãƒ³ãƒãƒ«ãŒã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã•ã‚Œã€ã»ã©ãªãã—ã¦å•é¡ŒãªãSPDYãŒä½¿ãˆã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ ã“ã®ç†ç”±ã¯å…¬å¼ã«ã¯æ˜Žã‚‰ã‹ã«ã•ã‚Œã¦ã„ã¾ã›ã‚“ãŒã€Chromeã®ãƒªãƒªãƒ¼ã‚¹ã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã«ãƒ’ãƒ³ãƒˆãŒã‚ã‚Šã¾ã—ãŸã€‚ãã“ã«ã¯ã€ High CVE-2014-3166: Information disclosure in SPDY. Credi
mad-p 2014/08/22
Public Key PinningãŒé‡è¦ãªå½¹å‰²ã‚’æŒã£ã¦ã„ã‚‹ã®ã‹ã€‚å‹‰å¼·ã«ãªã‚Šã¾ã—ãŸ!

spdy

Chrome

security

tls
ãƒªãƒ³ã‚¯
BlackHat2014USA_Prompt_20140808_J - æš—å·ãƒ—ãƒãƒˆã‚³ãƒ«è©•ä¾¡æŠ€è¡“ã‚³ãƒ³ã‚½ãƒ¼ã‚·ã‚¢ãƒ CELLOS
Cryptographic protocol Evaluation toward Long-Lived Outstanding Security Consortium [2014/8/08] Black Hat 2014 USAã§ç™ºè¡¨ã•ã‚ŒãŸSSL/TLSã¸ã®è¤‡æ•°ã®æ–°ãŸãªæ”»æ’ƒæ‰‹æ³•ã«ã¤ã„ã¦ 2014å¹´8æœˆ6æ—¥ï¼ˆæ—¥æœ¬æ™‚é–“8æœˆ7æ—¥æ—©æœï¼‰ã€Black Hat 2014 USA ã«ãŠã„ã¦ Antoine Delignat-Lavaud æ°ã«ã‚ˆã‚Š SSL/TLS ã«å¯¾ã™ã‚‹è¤‡æ•°ã®æ”»æ’ƒæ‰‹æ³•ãŒç™ºè¡¨ã•ã‚Œã¾ã—ãŸ [1]ã€‚å…¬é–‹ã•ã‚ŒãŸäº‹å¾Œè³‡æ–™ã¨ãƒ‡ãƒ¢ [2] ã§ã¯ä»¥ä¸‹ã®3ã¤ã®ãƒˆãƒ”ãƒƒã‚¯ãŒæ‰±ã‚ã‚Œã¦ã„ã¾ã™ã€‚ (1) Cookie Cutter attack : IEEE S&P2014 [3] ã§ç™ºè¡¨æ¸ˆã¿ (2) Virtual Host Confusion (3) Triple Handshake : IEEE S&P20
mad-p 2014/08/08
security
ãƒªãƒ³ã‚¯
Widespread Weak Keys in Network Devices - factorable.net
We performed a large-scale study of RSA and DSA cryptographic keys in use on the Internet and discovered that significant numbers of keys are insecure due to insufficient randomness. These keys are being used to secure TLS (HTTPS) and SSH connections for hundreds of thousands of hosts. We found that 5.57% of TLS hosts and 9.60% of SSH hosts share public keys in an apparently vulnerable manner, due
mad-p 2014/07/08
å¼±ã„å› æ•°ãŒãªã„ã‹ãƒã‚§ãƒƒã‚¯

security

ssh

SSL

rsa
ãƒªãƒ³ã‚¯
New OpenSSL Flaws Aren't a Heartbleed Repeat
mad-p 2014/06/09
"some that argued in the wake of Heartbleed that open-source software itself is not to be trusted and is not secure. The new OpenSSL vulnerabilities prove the opposite." ä¸å…·åˆå…¬é–‹ã®å‰ã«é–‹ç™ºè€…ã«é€šçŸ¥ã€ä¿®æ£ãŒç”¨æ„ã•ã‚ŒãŸ

security

OpenSSL
ãƒªãƒ³ã‚¯
Latest OpenSSL bug â€˜may be more dangerous than Heartbleedâ€™
Heartbleed was deemed to be one of the most critical internet vulnerabilities ever when it was uncovered in April. OpenSSL is supposed to protect peopleâ€™s data with digital keys but has been exposed as flawed numerous times in recent months. The latest vulnerability was introduced in 1998 and has been missed by both paid and volunteer developers working on the open-source project for 16 years. Mea
mad-p 2014/06/06
ssl

OpenSSL

security
ãƒªãƒ³ã‚¯
ImperialViolet - Early ChangeCipherSpec Attack
OpenSSL 1.0.1h (and others) were released today with a scary looking security advisiory and that's always an event worth looking into. (Hopefully people are practiced at updating OpenSSL now!) Update: the original reporter has a blog post up. Also, I won't, personally, be answering questions about specific Google services. (I cut this blog post together from notes that I'm writing for internal gro
mad-p 2014/06/06
OpenSSL MITMã§ãªã«ãŒèµ·ã“ã‚‹ã‹ã®è©³ç´°ãªåˆ†æžã€‚1.0.1ä»¥é™ã§ã¯éŽåŽ»ã®ä¿®æ£ãŒé€†ã«ç½ã„ã—ã¦é€šä¿¡ã®å‚å—ã‚„ãªã‚Šã™ã¾ã—ãŒå¯èƒ½

OpenSSL

security

SSL
ãƒªãƒ³ã‚¯
CCS Injectionè„†å¼±æ€§(CVE-2014-0224)ç™ºè¦‹ã®çµŒç·¯ã«ã¤ã„ã¦ã®ç´¹ä»‹ - OpenSSL #ccsinjection Vulnerability
èŠæ± ã§ã™ã€‚CCS Injectionè„†å¼±æ€§(CVE-2014-0224)ç™ºè¦‹ã®çµŒç·¯ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ ãƒã‚°ã®ç°¡å˜ãªè§£èª¬ OpenSSLãŒãƒãƒ³ãƒ‰ã‚·ã‚§ãƒ¼ã‚¯ä¸ã«ä¸é©åˆ‡ãªçŠ¶æ…‹ã§ChangeCipherSpecã‚’å—ç†ã—ã¦ã—ã¾ã†ã®ãŒä»Šå›žã®ãƒã‚°ã§ã™ã€‚ ã“ã®ãƒã‚°ã¯OpenSSLã®æœ€åˆã®ãƒªãƒªãƒ¼ã‚¹ã‹ã‚‰å˜åœ¨ã—ã¦ã„ã¾ã—ãŸã€‚ é€šå¸¸ã®ãƒãƒ³ãƒ‰ã‚·ã‚§ãƒ¼ã‚¯ã§ã¯ã€å³ã®å›³ã®ã‚ˆã†ãªé †åºã§ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’äº¤æ›ã—ã¾ã™(RFC5246 The Transport Layer Security (TLS) Protocol Version 1.2 Â§7.3ã‚ˆã‚Šä½œæˆ)ã€‚ ChangeCipherSpecã¯å¿…ãšã“ã®ä½ç½®ã§è¡Œã†ã“ã¨ã«ãªã£ã¦ã„ã¾ã™ã€‚OpenSSLã‚‚ChangeCipherSpecã‚’ã“ã®ã‚¿ã‚¤ãƒŸãƒ³ã‚°ã§é€ä¿¡ã—ã¾ã™ãŒã€å—ä¿¡ã¯ä»–ã®ã‚¿ã‚¤ãƒŸãƒ³ã‚°ã§ã‚‚è¡Œã†ã‚ˆã†ã«ãªã£ã¦ã„ã¾ã—ãŸã€‚ã“ã‚Œã‚’æ‚ªç”¨ã™ã‚‹ã“ã¨ã§ã€æ”»æ’ƒè€…ãŒé€šä¿¡ã‚’è§£èªãƒ»æ”¹ã–ã‚“å¯èƒ½ã§ã™ã€‚ ç™ºè¦‹ã®å›°é›£ã•
mad-p 2014/06/05
ç™ºè¦‹è€…ã«ã‚ˆã‚‹ã€è„†å¼±æ€§ã®è§£èª¬ã¨ã€ã©ã†ã‚„ã£ã¦ç™ºè¦‹ã«è‡³ã£ãŸã‹ã®çµŒç·¯

security

OpenSSL
ãƒªãƒ³ã‚¯
How I discovered CCS Injection Vulnerability (CVE-2014-0224) - OpenSSL #ccsinjection Vulnerability
Hello. My name is Masashi Kikuchi. Here is my story how I find the CCS Injection Vulnerability. (CVE-2014-0224) What is the bug? The probl em is that OpenSSL accepts ChangeCipherSpec (CCS) inappropriately during a handshake. This bug has existed since the very first release of OpenSSL. In a correct handshake, the client and the server exchange messages in the order as depicted in this figure. (See
mad-p 2014/06/05
A story from the discoverer of OpenSSL MITM #ccsinjection bug. CVE-2014-0224

security

OpenSSL
ãƒªãƒ³ã‚¯
OpenSSL #ccsinjection Vulnerability
[Japanese] Last update: Mon, 16 Jun 2014 18:21:23 +0900 CCS Injection Vulnerability Overview OpenSSLâ€™s ChangeCipherSpec processing has a serious vulnerability. This vulnerability allows malicious intermediate nodes to intercept encrypted data and decrypt them while forcing SSL clients to use weak keys which are exposed to the malicious nodes. Because both of servers and clients are affected by thi
mad-p 2014/06/05
Explanation of OpenSSL MITM #ccsinjection bug. CVE-2014-0224

security

OpenSSL
ãƒªãƒ³ã‚¯
OpenSSL #ccsinjection Vulnerability
[English] æœ€çµ‚æ›´æ–°æ—¥: Mon, 16 Jun 2014 18:21:23 +0900 CCS Injection Vulnerability æ¦‚è¦ OpenSSLã®ChangeCipherSpecãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®å‡¦ç†ã«æ¬ é™¥ãŒç™ºè¦‹ã•ã‚Œã¾ã—ãŸã€‚ ã“ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã•ã‚ŒãŸå ´åˆã€æš—å·é€šä¿¡ã®æƒ…å ±ãŒæ¼ãˆã„ã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ ã‚µãƒ¼ãƒã¨ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã®ä¸¡æ–¹ã«å½±éŸ¿ãŒã‚ã‚Šã€è¿…é€Ÿãªå¯¾å¿œãŒæ±‚ã‚ã‚‰ã‚Œã¾ã™ã€‚ æ”»æ’ƒæ–¹æ³•ã«ã¯å……åˆ†ãªå†ç¾æ€§ãŒã‚ã‚Šã€æ¨™çš„åž‹æ”»æ’ƒç‰ã«åˆ©ç”¨ã•ã‚Œã‚‹å¯èƒ½æ€§ã¯éžå¸¸ã«é«˜ã„ã¨è€ƒãˆã¾ã™ã€‚ å¯¾ç– å„ãƒ™ãƒ³ãƒ€ã‹ã‚‰æ›´æ–°ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã‚‹ã¨æ€ã‚ã‚Œã‚‹ã®ã§ã€ãã‚Œã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã™ã‚‹ã“ã¨ã§å¯¾ç–ã§ãã¾ã™ã€‚ ï¼ˆéšæ™‚æ›´æ–°ï¼‰ Ubuntu Debian FreeBSD CentOS Red Hat 5 Red Hat 6 Amazon Linux AMI åŽŸå› OpenSSLã®ChangeCipherSpecãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã®å‡¦ç†ã«ç™ºè¦‹
mad-p 2014/06/05
OpenSSL MITMè„†å¼±æ€§(CCS Injection)ã®è§£èª¬ #ccsinjection

OpenSSL

security

è„†å¼±æ€§

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
OAuthã‚„OpenIDã‚’ä½¿ã‚ãªã„Password-Less Authenticationã¯å¯èƒ½ã‹ï¼Ÿ - ç©ºç¹°å†ç¹°
OAuthã‚„OpenIDã‚’ä½¿ã‚ãªã„Password-Less Authenticationã¯å¯èƒ½ã‹ï¼Ÿ æ¦‚è¦: ã¨ã„ã†ã‚ˆã†ãªã‚³ãƒˆã‚’ä»Šæ—¥ã®åˆå‰ä¸ã€ãšã£ã¨è€ƒãˆã¦ãŸ çµè«–ã‹ã‚‰è¨€ã†ã¨ã€æ—¢ã«å˜åœ¨ã—ãŸã€‚ãã‚ŒãŒä»¥ä¸‹: NoPassword ã§ã€ä¸Šè¨˜ãƒªãƒ³ã‚¯å…ˆã®èªè¨¼æ–¹æ³•ã¯å‡„ã„ç°¡å˜ã§ã€ ãƒã‚°ã‚¤ãƒ³ã™ã‚‹éš›ã«ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹å…¥åŠ›ã•ã›ã‚‹ å…¥åŠ›ã•ã‚ŒãŸãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã«ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒˆãƒ¼ã‚¯ãƒ³ãã£ã¤ã‘ã¦é€ã‚‹ ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒˆãƒ¼ã‚¯ãƒ³ä»˜ããƒªãƒ³ã‚¯ã‚’è¸ã‚€ ã™ã‚‹ã¨èªè¨¼ã•ã‚Œã¦ãƒã‚°ã‚¤ãƒ³å®Œäº† ã¨ã„ã†æ„Ÿã˜ã€‚ ã§ã€åƒ•ã¯ã“ã‚Œè¦‹ã¦æ€ã£ãŸã®ãŒã€ ãƒã‚°ã‚¤ãƒ³ã™ã‚‹ãŸã³ã«ãƒ¡ãƒ¼ãƒ«é€ã‚‰ã‚Œã¦ãã‚‹ã®ã‚¦ã‚¶ããï¼Ÿ ã¨ã‹ç´ ç›´ã«æ€ã„ã¾ã—ãŸã€‚ ã§ã€ä¸Šè¨˜ã®èªè¨¼æ–¹æ³•ã‚‚çµæ§‹å¤‰æ…‹ã¨è¨€ãˆã°å¤‰æ…‹ãªã‚“ã ã‘ã©ã€åƒ•ãªã‚Šã«è€ƒãˆãŸçµæžœã€ ãƒ¡ãƒ¼ãƒ«é€ã‚‹ä»£ã‚ã‚Šã«Websocket with SSL/TLSã§ã€å…¬é–‹éµèªè¨¼ã™ã‚Œã°ã„ã„ã‚“ã˜ã‚ƒãï¼Ÿ ã¨ã‹æ€ã„ã¤ã„ãŸã®ã§ã€ãã‚Œã‚‚æ›¸ã„ã¦ãŠãã¨ã€ å‰æ ãƒ¦ãƒ¼ã‚¶ãƒ¼
mad-p 2014/06/03
self-issued IdPã¨ã®é•ã„ã‚’è€ƒãˆã¦ã¿ã‚‹ã¨é¢ç™½ãã†

security

èªè¨¼
ãƒªãƒ³ã‚¯
ãƒãƒƒãƒˆã®ä¿¡é ¼ã‚’æ”¯ãˆã‚‹åŸºç›¤ãŒå´©å£Šï¼Ÿã€€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é¨’å‹•ã§æµ®ä¸Šã—ãŸèª²é¡Œ
ãƒãƒƒãƒˆã®ä¿¡é ¼ã‚’æ”¯ãˆã‚‹åŸºç›¤ãŒå´©å£Šï¼Ÿã€€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é¨’å‹•ã§æµ®ä¸Šã—ãŸèª²é¡Œï¼šæ¥ç•Œã®ã‚¨ã‚ã‚¹ãƒ‘ãƒ¼ãƒˆãŒè¨Žè«–ï¼ˆ1/3 ãƒšãƒ¼ã‚¸ï¼‰ OpenSSLã®è„†å¼±æ€§å•é¡Œã‚„ãƒªã‚¹ãƒˆåž‹æ”»æ’ƒãªã©ã€è¿‘å¹´ã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ä¿¡é ¼ã‚’æ”¯ãˆã‚‹åŸºç›¤ã‚’æºã‚‹ãŒã—ã‹ããªã„äº‹è±¡ãŒå¤šç™ºã—ã¦ã„ã‚‹ã€‚ä¿¡é ¼ã®ãŸã‚ã®åŸºç›¤ã¯å´©å£Šã—ã¦ã—ã¾ã†ã®ã‹â€•â€•ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¥ç•Œã®å°‚é–€å®¶é™£ãŒè°è«–ã‚’äº¤ã‚ã—ãŸã€‚ 4æœˆã‹ã‚‰5æœˆã«ã‹ã‘ã¦ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆåˆ©ç”¨ã‚’æ”¯ãˆã‚‹é‡è¦ãªã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®è„†å¼±æ€§å•é¡ŒãŒä¸–é–“ã‚’è³‘ã‚ã›ãŸã€‚ã€Œã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ä¿¡é ¼åŸºç›¤ã‚’æºã‚‹ãŒã—ã‹ããªã„ã€ã¨ã„ã£ãŸå ±é“ã‚‚ç›¸æ¬¡ã„ã ã€‚ã“ã†ã—ãŸäº‹æ…‹ã‚’å—ã‘ã¦æ—¥æœ¬ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å”ä¼šï¼ˆJNSAï¼‰ãŒã€Œç·Šæ€¥æ™‚äº‹ãƒ¯ãƒ¼ã‚¯ã‚·ãƒ§ãƒƒãƒ—ã€ã‚’é–‹å‚¬ã€‚ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¥ç•Œã®å°‚é–€å®¶ãŒã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã®ä¿¡é ¼ã‚’æ”¯ãˆã‚‹åŸºç›¤ã‚’ã©ã†å®ˆã‚‹ã¹ãã«ã¤ã„ã¦è°è«–ã—ãŸã€‚ ãƒ¯ãƒ¼ã‚¯ã‚·ãƒ§ãƒƒãƒ—ã«ã¯ã€ã‚½ãƒ•ãƒˆãƒãƒ³ã‚¯ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼ã®è¾»ä¼¸å¼˜æ°ã€NTTã‚»ã‚ãƒ¥ã‚¢ãƒ—ãƒ©ãƒƒãƒˆãƒ•ã‚©ãƒ¼ãƒ ç ”ç©¶æ‰€ã®ç¥žç”°é›…é€æ°ã€æ—¥æœ¬ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã‚µãƒ¼
mad-p 2014/06/02
security

ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®çˆ¶ã¯è¨€ã†ï½¢ã‚‚ã†ç„¡ç†ã€æ‚ªå¤¢ï½£ã¨
å½¼ã®åå‰ã¯ãƒ•ã‚§ãƒ«ãƒŠãƒ³ãƒ‰ãƒ»Jãƒ»ã‚³ãƒ«ãƒãƒˆã€‚ä¸–ç•Œã‚’å¤‰ãˆãŸç”·ã€æœ€åˆã«ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’è€ƒãˆã ã—ãŸäººç‰©ã§ã™ã€‚ç¾ä»£ã®ãƒ†ã‚¯ãƒŽãƒã‚¸ãƒ¼ã®ã‚ã‚Šæ–¹ã ã‘ã§ãªãã€ç§ãŸã¡ã®ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼ã¸ã®è€ƒãˆæ–¹ã«ã‚‚å½±éŸ¿ã‚’ä¸ŽãˆãŸäººç‰©ã¨è¨€ãˆã‚‹ã§ã—ã‚‡ã†ã€‚å½¼ãŒã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¨ã„ã†æ¦‚å¿µã‚’æ‰“ã¡å‡ºã—ã¦ã‹ã‚‰ã€ç´„åŠä¸–ç´€ã€‚ãƒžã‚µãƒãƒ¥ãƒ¼ã‚»ãƒƒãƒ„å·¥ç§‘å¤§ï¼ˆMITï¼‰å…ƒæ•™æŽˆã§ã‚ã‚‹å½¼ã¯ã€ä»Šã“ã†è€ƒãˆã¦ã„ã¾ã™ã€‚ ï½¢ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯æ‚ªå¤¢ã ï½£ã¨ã€‚ ã‚³ãƒ«ãƒãƒˆæ°ã¯ã€ ã‚¦ã‚©ãƒ¼ãƒ«ãƒ»ã‚¹ãƒˆãƒªãƒ¼ãƒˆç´™ã®å–æã§ã€ã‚µã‚¤ãƒãƒ¼ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã¯ãã®æ´å²ã®é•·ã•ã«å¯¾ã—ã¦ã‚ã¾ã‚Šé€²æ©ã—ã¦ã„ãªã„ã¨èªžã£ã¦ã„ã¾ã™ã€‚ä»Šå›žã®æ‚ªå¤¢ç™ºè¨€ã¯ã“ã®ã‚¤ãƒ³ã‚¿ãƒ´ãƒ¥ãƒ¼å†…ã§è¿°ã¹ã‚‰ã‚ŒãŸã‚‚ã®ã€‚ å½¼ãŒMITã§æ•™éžã‚’åŸ·ã£ã¦ã„ãŸå½“æ™‚ã€æ ¡å†…ã®å…¨å“¡ãŒãƒ¡ã‚¤ãƒ³ãƒ•ãƒ¬ãƒ¼ãƒ ã¨1ã¤ã®ãƒãƒ¼ã‚«ãƒ«ãƒ‡ã‚£ã‚¹ã‚¯Cã‚’å…±æœ‰ã—ã¦ã„ãŸãã†ã§ã™ã€‚ãã®çµæžœã€1äºº1äººã®ãƒ•ã‚¡ã‚¤ãƒ«ãŒç›¸äº’ã«é¦–ã‚’çªã£è¾¼ã¾ãªã„ã‚ˆã†ã«ã™ã‚‹æ–¹æ³•ãŒå¿…è¦ã«ãªã«ãªã‚Šã¾ã—ãŸã€‚ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯ã€ã“ã®è§£æ±ºæ–¹æ³•ã¨ã—ã¦ç·¨ã¿å‡ºã•ã‚Œ
mad-p 2014/05/28
security

password
ãƒªãƒ³ã‚¯
ã€æ³¨æ„ã€‘GitHubã®rawãƒ•ã‚¡ã‚¤ãƒ«ç”¨URLãŒå¤‰ã‚ã£ãŸã‚ˆã†ã§ã™ - agri-note inside
ã“ã‚“ã«ã¡ã¯ã€‚Androidãƒãƒ¼ãƒ ã®ä¸å·@Nkznã§ã™ã€‚ ä½œã£ãŸã¾ã¾æ”¾ç½®ã—ã¦ã„ãŸæŠ€è¡“è€…ãƒ–ãƒã‚°ã‚’ãã‚ãã‚å‹•ã‹ã—ã¦è¡ŒããŸã„ã¨æ€ã„ã¾ã™ã€‚ å¤‰ã‚ã£ãŸã“ã¨ GitHubã§Markdownãªã©ã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é–²è¦§ã™ã‚‹éš›ã«ã€å…ƒã€…ã®ãƒ—ãƒ¬ãƒ¼ãƒ³ãƒ†ã‚ã‚¹ãƒˆã®ãƒ•ã‚¡ã‚¤ãƒ«ãŒè¦‹ãŸããªã‚‹ã¨ã€ã€Œrawã€ã¨ã„ã†ãƒœã‚¿ãƒ³ã«ãŠä¸–è©±ã«ãªã‚‹ã¨æ€ã„ã¾ã™ã€‚ã“ã‚Œâ†“ã§ã™ãã€‚ ã•ã¦ã€ã“ã‚Œã¾ã§ã¯rawã§ãƒ•ã‚¡ã‚¤ãƒ«ã‚’è¦‹ãŸå ´åˆã®URLã¯ https://raw.github.com/android/platform_packages_apps_settings/master/res/layout/display.xml ã“ã‚“ãªæ„Ÿã˜ã§ã—ãŸã€‚ ãã‚ŒãŒã“ã®åº¦ã€ã“ã†ãªã‚Šã¾ã—ãŸã€‚ https://raw.githubusercontent.com/android/platform_packages_apps_settings/master/res/layout/disp
mad-p 2014/05/19
ã“ã‚Œã€user contentã‚’åˆ¥ãƒ‰ãƒ¡ã‚¤ãƒ³ã«åˆ†é›¢ã¨ã„ã†ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼çš„ã«ã¯é‡è¦ãªå¤‰æ›´ã§ã™ã

github

security
ãƒªãƒ³ã‚¯
OAuth 2.0 ã® code ã¯æ¼ã‚Œã¦ã‚‚å¤§ä¸ˆå¤«ã£ã¦ãƒ›ãƒ³ãƒˆ!? - OAuth.jp
æ˜¨æ—¥ã®Covert Redirect ã§ Query æ¼ã‚Œã‚‹ã‚±ãƒ¼ã‚¹ã‚‚ã‚ã‚‹!?ã‚„OAuth 2.0 ã®è„†å¼±æ€§ (!?) â€œCovert Redirectâ€ ã¨ã¯ã«ã‚ã‚‹ã‚ˆã†ã«ã€OAuth 2.0 ã® code ãŒæ¼ã‚Œã¡ã‚ƒã†ã“ã¨ã‚‚ã€ã‚ã‚Šãˆã¾ã™ã€‚ æ¼ã‚Œãªã„ãŸã‚ã«ã‚„ã‚‹ã¹ãã“ã¨ã¯ã€ä¸Šè¨˜ã®è¨˜äº‹ã‚„Facebook Login ã§ Covert Redirect ã‚’é˜²æ¢ã™ã‚‹ãªã‚“ã‹ã§ã‚‚ç´¹ä»‹ã—ã¦ã‚‹ã®ã§ã€ãã¡ã‚‰èªã‚“ã§ãã ã•ã„ã€‚ ã§ã€ä»Šå›žã®å†…å®¹ã¯ã€Œcode ãŒæ¼ã‚ŒãŸã‚‰ä½•ãŒã¾ãšã„ã®ã‹ã€ã«ã¤ã„ã¦ã§ã™ã€‚ ã€Œcode ã¯æ¼ã‚Œã¦ã‚‚å¤§ä¸ˆå¤«ã€èª¬ ã€ŒCovert Redirectã€ã«ã¤ã„ã¦ã® John Bradley æ°ã®è§£èª¬ï¼ˆè¿½è¨˜ã‚ã‚Šï¼‰ã«ã‚‚ã€ã“ã†ã‚ã‚Šã¾ã—ãŸãã€‚ OAuth ã¨ OpenID Connect ã«ã¯è¤‡æ•°ã® response_type ãŒã‚ã‚‹ã‚“ã ã‘ã©ã€ã•ãã®ãƒªãƒãƒ¼ãƒˆã®è‘—è€…ã¯ã€æœ€ã‚‚ä¸€èˆ¬çš„ãª response_type ãŒ
mad-p 2014/05/09
codeã‚’ä¸æ£ã«å…¥æ‰‹ã•ã‚Œã¦ã‚‚ã€stateã‚„redirect_uriã®ãƒã‚§ãƒƒã‚¯ã§RPã€OPä¸¡å´ã§æ¤œè¨¼ã§ãã‚‹

covert redirect

oauth2

security
ãƒªãƒ³ã‚¯
Facebook Login ã§ Covert Redirect ã‚’é˜²æ¢ã™ã‚‹ - OAuth.jp
OAuth 2.0 Implicit Flow ã§ã¯ Covert Redirect çµŒç”±ã§ access token ãŒæ¼ã‚Œã‚‹ä»¶ã«ã¤ã„ã¦ã¯æ—¢ã«ç´¹ä»‹ã—ã¾ã—ãŸãŒã€ã“ã“ã§ã¯ã¿ãªã•ã‚“å¤§å¥½ã Facebook Login ã§ OAuth Client Developer ãŒã§ãã‚‹å¯¾ç–ã«ã¤ã„ã¦ç´¹ä»‹ã™ã‚‹ã“ã¨ã«ã—ã¾ã™ã€‚ æ”»æ’ƒæ–¹æ³• æ”»æ’ƒå¯¾è±¡ã¨ãªã‚‹ OAuth Client ã® FB client_id ã‚’å–å¾— client_id ã¯ FB Login ãƒœã‚¿ãƒ³ã•ãˆã‚¯ãƒªãƒƒã‚¯ã™ã‚Œã°ã‚¢ãƒ‰ãƒ¬ã‚¹ãƒãƒ¼ã«è¡¨ç¤ºã•ã‚Œã‚‹ã€‚ Authorization Request URL ã‚’æ§‹ç¯‰ å¯¾è±¡ Client ãŒé€šå¸¸ response_type=code ã‚’ä½¿ã£ã¦ã‚‹å ´åˆã§ã‚‚ã€å•ç”ç„¡ç”¨ã§ response_type=token ã«ã—ã¦ãã ã•ã„ã€‚ https://www.facebook.com/dialog/oauth?client_i
mad-p 2014/05/09
Facebook Loginã§ã®å¯¾ç–

covert redirect

facebook

security
ãƒªãƒ³ã‚¯
OpenID 2.0 ã«ãŠã‘ã‚‹ Covert Redirect ã¨ RP Discovery - OAuth.jp
ã•ã¦ã€OAuth 2.0 & OpenID Connect ã«ãŠã‘ã‚‹ Covert Redirect ã®å•é¡Œ ã«ã¤ã„ã¦ã¯ã¾ã¨ã‚ãŸã®ã§ã€æ¬¡ã¯ OpenID 2.0 ã«ã¤ã„ã¦ã§ã™ã€‚ ã„ã„ã§ã™ã‹ã€OpenID Connect ã§ã¯ãªãã€OpenID 2.0 ã§ã™ã‚ˆã€‚å¤ã„æ–¹ã§ã™ã€‚æ‡ã‹ã—ã„ã§ã™ãã€OpenID Authentication 2.0 â€“ Finalã€‚ ãã†ã„ãˆã°ã€OpenID Foundation Japan ã®ç¿»è¨³ WG ã‚’ç«‹ã¡ä¸Šã’ã¦ã€ä¸€ç•ªæœ€åˆã«ç¿»è¨³ã—ãŸã®ãŒ OpenID Authentication 2.0 ã® æ—¥æœ¬èªžè¨³ã§ã—ãŸãâ€¦(é ã„ç›® ã¨ã€æ˜”è©±ã¯ãã‚Œãã‚‰ã„ã«ã—ã¦ã€æœ¬é¡Œã«å…¥ã‚Šã¾ã—ã‚‡ã†ã€‚ ã¾ãšã¯ Covert Redirect ç™ºç”Ÿæ¡ä»¶ã«ã¤ã„ã¦ OpenID 2.0 ã§ã¯ã€ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã¯ query ã«å¼•ã£ä»˜ã„ã¦ãã¾ã™ã€‚fragment ã¯ä½¿ã„ã¾ã›ã‚“ã€‚ ãªã®ã§ã€open r
mad-p 2014/05/08
Covert RedirectãŒOpenID 2.0(å¤ã„ã»ã†)ã«ä¸Žãˆã‚‹å½±éŸ¿ã¨å¯¾ç–ã¨ã—ã¦ã®RP Discovery

covert redirect

openid

security
ãƒªãƒ³ã‚¯
Covert Redirect is not new but.. A risk analysis and recommendations
Threats Case 1: â€œredirect_uriâ€ in full including the query parameter is an open redirector. RP really need to make sure that at least this uri is not an open redirector. NOTE: Even in this case, if the flow used is the â€œcode flowâ€ for a confidential client, the attack does not succeed on OpenID Connect and OAuth 2.0. Case 2: â€œredirect_uriâ€ behaves as an open redirector depending on the query compo
mad-p 2014/05/08
natã•ã‚“ã«ã‚ˆã‚‹Covert Redirectã®ãƒªã‚¹ã‚¯åˆ†æžã¨å¯¾ç–æ¡ˆã€‚RPã—ã£ã‹ã‚Šã—ã‚è«–èª¿ã§æ›¸ã‹ã‚Œã¦ã„ã‚‹ã‘ã©ã€auth reqã¯ã‚¯ãƒ©ãƒ•ãƒˆã•ã‚Œå¾—ã‚‹ã®ã§OPãŒãŒã‚“ã°ã‚‹ã—ã‹ãªã„ã®ã§ã¯?

covert redirect

openid

oauth

security
ãƒªãƒ³ã‚¯
1 2 3 4 æ¬¡ã®ãƒšãƒ¼ã‚¸