[B! security] mizdraã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

mizdra id:mizdra

securityã«é–¢ã™ã‚‹mizdraã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (314)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼ ã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯!! (1/5)
å¤ãã‹ã‚‰ã®mixiãƒ¦ãƒ¼ã‚¶ãƒ¼ã§ã‚ã‚Œã°ã€â€œã¯ã¾ã¡ã¡ã‚ƒã‚“äº‹ä»¶â€ã‚’è¦šãˆã¦ã„ã‚‹äººã‚‚å¤šã„ã ã‚ã†ã€‚2005å¹´4æœˆã€mixiã§å¤§å‹¢ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒâ€œã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼â€ã¨ã„ã†ã‚¿ã‚¤ãƒˆãƒ«ã‚’ä»˜ã‘ãŸã€è¬Žã®æ—¥è¨˜ã‚’æ¬¡ã€…ã«å…¬é–‹ã™ã‚‹ã¨ã„ã†æ€ªç¾è±¡ãŒèµ·ã“ã£ãŸã€‚ ãã£ã‹ã‘ã¨ãªã£ãŸã®ã¯ã€ã‚ã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒæŠ•ç¨¿ã—ãŸæ—¥è¨˜ã€‚ãã®æ—¥è¨˜ã®æœ¬æ–‡ã«ã¯ã€Œã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯!!ã€ã¨ã„ã†è¨€è‘‰ã¨ã¨ã‚‚ã«â€œã‚ã‚‹URLâ€ãŒè²¼ã‚Šä»˜ã‘ã¦ã‚ã£ãŸã€‚ ã“ã®URLãŒç½ ã§ã€ä¸æ€è°ã«æ€ã£ã¦æŠ¼ã™ã¨ã€ã‚¯ãƒªãƒƒã‚¯ã—ãŸãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒšãƒ¼ã‚¸ã«â€œã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼â€ã¨ã„ã†ã‚¿ã‚¤ãƒˆãƒ«ã§åŒã˜æ–‡é¢/URLã®æ—¥è¨˜ãŒå‹æ‰‹ã«ã‚¢ãƒƒãƒ—ã•ã‚Œã¦ã—ã¾ã†ã®ã ã€‚ æŠ•ç¨¿ã¯â€œããšã¿ç®—â€çš„ã«å¢—ãˆã€ä¸€æ™‚ã¯æ··ä¹±çŠ¶æ…‹ã«â€¦â€¦ ã•ã‚‰ã«ã€å‹æ‰‹ã«ã‚¢ãƒƒãƒ—ãƒãƒ¼ãƒ‰ã•ã‚ŒãŸæ—¥è¨˜ã‚’è¦‹ã¦ã€Œå‹é”ãŒå¤‰ãªæ—¥è¨˜ã‚’æ›¸ã„ã¦ã„ã‚‹ã€ã¨èˆˆå‘³ã‚’æŒã£ãŸå‹é”ãŒURLã‚’ã‚¯ãƒªãƒƒã‚¯â€¦â€¦ã€‚mixiå†…ã«ã¯â€œã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼â€ã¨ã„ã†é¡Œåã®æ—¥è¨˜ãŒâ€œããšã¿ç®—å¼â€ã«å¢—ãˆã¦ã„ãã€ä¸€éƒ¨ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’æ··
mizdra 2024/12/16
äº‹ä»¶

ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆ

security
ãƒªãƒ³ã‚¯
ã‚¢ãƒ‘ãƒ«ãƒˆãƒ˜ã‚¤ãƒˆçµ‚çµã«è²¢çŒ®ã—ãŸæš—å·ãƒ—ãƒã‚°ãƒ©ãƒ ã®ã‚³ãƒ¼ãƒ‰ãŒã€30å¹´ã‚’çµŒã¦å…¬é–‹ã•ã‚ŒãŸ
mizdra 2024/11/04
security
ãƒªãƒ³ã‚¯
Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security Advisory
Okta AD/LDAP Delegated Authentication - Username Above 52 Characters Security Advisory Description DescriptionOn October 30, 2024, a vulnerability was internally identified in generating the cache key for AD/LDAP DelAuth. The Bcrypt algorithm was used to generate the cache key where we hash a combined string of userId + username + password. Under a specific set of conditions, listed below, this co
mizdra 2024/11/02
security
ãƒªãƒ³ã‚¯
ActiveRecord SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã‚¯ã‚¤ã‚º (Rails 7.1.3.4)
Vueã§ Webã‚³ãƒ³ãƒãƒ¼ãƒãƒ³ãƒˆã‚’ä½œã£ã¦ Reactã§ä½¿ã† / 20241030-cloudsign-vuefes_after_night
mizdra 2024/10/29
ruby

rails

security
ãƒªãƒ³ã‚¯
Chrome on Android to support third-party autofill services natively
mizdra 2024/10/18
æ‰‹å…ƒã§è©¦ã—ã¦ã¿ã¦ã„ã‚‹ã‘ã©ã€Chrome for Android ã§ Basic èªè¨¼ã® id/pass ã‚’ 1Password ã§ autofill ã§ãã‚‹ã‚ˆã†ã«ãªã£ã¦ãŸã€‚ä¾¿åˆ©ã€‚

security
ãƒªãƒ³ã‚¯
Safer with Google: Advancing Memory Safety
The latest news and insights from Google on security and safety on the Internet
mizdra 2024/10/17
security

rust
ãƒªãƒ³ã‚¯
Eliminating Memory Safety Vulnerabilities at the Source
The latest news and insights from Google on security and safety on the Internet
mizdra 2024/10/17
Google ã®ãƒ¡ãƒ¢ãƒªå®‰å…¨æ€§ã®è„†å¼±æ€§ã¸ã®å–ã‚Šçµ„ã¿æˆ¦ç•¥ã«ã¤ã„ã¦ã€‚è„†å¼±æ€§ã®å¤§éƒ¨åˆ†ã¯æœ€è¿‘å¤‰æ›´ã•ã‚ŒãŸã‚³ãƒ¼ãƒ‰ã«ã‚ã‚‹ãŸã‚ã€æ–°ã—ã„ã‚³ãƒ¼ãƒ‰ã‚’ãƒ¡ãƒ¢ãƒªå®‰å…¨ãªè¨€èªžã§æ›¸ã„ã¦ã„ãã€‚ã¾ãŸã€C++ ã¨ãƒ¡ãƒ¢ãƒªå®‰å…¨ãªè¨€èªžã®ç›¸äº’é‹ç”¨æ€§ã«æŠ•è³‡ã™ã‚‹ã€‚

security

rust
ãƒªãƒ³ã‚¯
ãƒ‘ã‚¹ã‚ãƒ¼ã®ã‚¯ãƒ¬ãƒ‡ãƒ³ã‚·ãƒ£ãƒ«ãŒãƒ™ãƒ³ãƒ€é–“ã§äº¤æ›å¯èƒ½ã«ã€æ¥ç•Œæ¨™æº–ã€ŒCredential Exchange Specificationsã€ãƒ¯ãƒ¼ã‚ãƒ³ã‚°ãƒ‰ãƒ©ãƒ•ãƒˆã‚’FIDOã‚¢ãƒ©ã‚¤ã‚¢ãƒ³ã‚¹ãŒå…¬é–‹
ãƒ‘ã‚¹ã‚ãƒ¼ã®ã‚¯ãƒ¬ãƒ‡ãƒ³ã‚·ãƒ£ãƒ«ãŒãƒ™ãƒ³ãƒ€é–“ã§äº¤æ›å¯èƒ½ã«ã€æ¥ç•Œæ¨™æº–ã€ŒCredential Exchange Specificationsã€ãƒ¯ãƒ¼ã‚ãƒ³ã‚°ãƒ‰ãƒ©ãƒ•ãƒˆã‚’FIDOã‚¢ãƒ©ã‚¤ã‚¢ãƒ³ã‚¹ãŒå…¬é–‹ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒ¬ã‚¹ã‚’å®Ÿç¾ã™ã‚‹æ¥ç•Œæ¨™æº–ã€Œãƒ‘ã‚¹ã‚ãƒ¼ã€ï¼ˆPasskeyï¼‰ã®ä»•æ§˜ç–å®šã‚„æŽ¨é€²ã‚’è¡Œã£ã¦ã„ã‚‹FIDOã‚¢ãƒ©ã‚¤ã‚¢ãƒ³ã‚¹ï¼ˆãƒ•ã‚¡ã‚¤ãƒ‰ã‚¢ãƒ©ã‚¤ã‚¢ãƒ³ã‚¹ï¼‰ã¯ã€ã‚¯ãƒ¬ãƒ‡ãƒ³ã‚·ãƒ£ãƒ«ã‚’å®‰å…¨ã«äº¤æ›ã™ã‚‹ãŸã‚ã®æ–°ä»•æ§˜ã€ŒCredential Exchange Specificationsã€ã®ãƒ¯ãƒ¼ã‚ãƒ³ã‚°ãƒ‰ãƒ©ãƒ•ãƒˆã‚’ç™ºè¡¨ã—ã¾ã—ãŸã€‚ ã“ã‚Œã«ã‚ˆã‚Šãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯ãƒ‘ã‚¹ã‚ãƒ¼ã‚„ãã®ä»–ã™ã¹ã¦ã®ã‚¯ãƒ¬ãƒ‡ãƒ³ã‚·ãƒ£ãƒ«ã‚’ã€ç•°ãªã‚‹ãƒ™ãƒ³ãƒ€é–“ã§ã‚ã£ã¦ã‚‚å®‰å…¨ã«ç§»å‹•ã‚„äº¤æ›ã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ ä¾‹ãˆã°ã€Googleãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒžãƒãƒ¼ã‚¸ãƒ£ã«ä¿å˜ã•ã‚ŒãŸãƒ‘ã‚¹ã‚ãƒ¼ã®ã‚¯ãƒ¬ãƒ‡ãƒ³ã‚·ãƒ£ãƒ«ã‚’Appleã‚¢ã‚«ã‚¦ãƒ³ãƒˆã®iCloudã‚ãƒ¼ãƒã‚§ãƒ¼ãƒ³ã¸ç§»å‹•ã—ã¦iPhoneã§ãƒ‘ã‚¹ã‚ãƒ¼ã‚’ä½¿ã†ã€ã‚ã‚‹ã„ã¯1Passwordãªã©ä»–ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰
mizdra 2024/10/17
security
ãƒªãƒ³ã‚¯
Webã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ã‚ã‚‹ãã‹ãŸ
2024/10/5 YAPC::Hakodate 2024
mizdra 2024/10/07
ã‚ˆãã¾ã¨ã¾ã£ã¦ã¦è‰¯ã‹ã£ãŸ

security

web
ãƒªãƒ³ã‚¯
Chromium policy on JavaScript dialogs Â |Â Blog Â |Â Chrome for Developers
History of JavaScript dialogs JavaScript was introduced in 1995, and in the very first version of JavaScript were methods on the window object named alert(), confirm(), and prompt(). While they fit into the JavaScript of the time, their synchronous API is probl ematic for modern browsers. Because the JavaScript engine needs to pause until a user response is obtained, the JavaScript dialogs are app-
mizdra 2024/09/26
web

security
ãƒªãƒ³ã‚¯
ä¸€éƒ¨å ±é“ã«ã¤ã„ã¦ï¼ˆç¬¬äºŒå ±ï¼‰ | ãƒ‹ãƒ¥ãƒ¼ã‚¹ãƒªãƒªãƒ¼ã‚¹ | ã‚¢ã‚¤ã‚³ãƒ
æœ¬æ—¥æœªæ˜Žã€ãƒ¬ãƒãƒŽãƒ³ã§å½“ç¤¾ãƒã‚´ã®å…¥ã£ãŸã‚·ãƒ¼ãƒ«ãŒè²¼ä»˜ã•ã‚ŒãŸç„¡ç·šæ©ŸãŒçˆ†ç™ºã—ãŸã¨ã®å ±é“ãŒã‚ã‚Šã¾ã—ãŸã€‚ã“ã®äº‹æ¡ˆã«ã¤ã„ã¦ç¾æ™‚ç‚¹ã§åˆ¤æ˜Žã—ã¦ã„ã‚‹ã“ã¨ã‚’ã”å ±å‘Šã„ãŸã—ã¾ã™ã€‚ IC-V82ã¯ã€å½“ç¤¾ãŒ2004å¹´ã‹ã‚‰2014å¹´10æœˆã«ã‹ã‘ã¦ä¸æ±ã‚’å«ã‚€æµ·å¤–å‘ã‘ã«ç”Ÿç”£ãƒ»å‡ºè·ã—ã¦ã„ãŸãƒãƒ³ãƒ‡ã‚£åž‹ç„¡ç·šæ©Ÿã§ã™ã€‚ç´„10å¹´å‰ã«çµ‚å£²ã—ã¦ãŠã‚Šã€ãã‚Œä»¥é™æœ¬ç¤¾ã‹ã‚‰ã®å‡ºè·ã¯è¡Œãªã£ã¦ãŠã‚Šã¾ã›ã‚“ã€‚ã™ã§ã«æœ¬ä½“ã‚’å‹•ä½œã•ã›ã‚‹ãŸã‚ã®ãƒãƒƒãƒ†ãƒªãƒ¼ã®ç”Ÿç”£ã‚‚çµ‚å£²ã—ã¦ã„ã‚‹ã»ã‹ã€å½é€ å“é˜²æ¢ã®ãŸã‚ã®ãƒ›ãƒã‚°ãƒ©ãƒ ã‚·ãƒ¼ãƒ«ãŒè²¼ä»˜ã•ã‚Œã¦ãŠã‚‰ãšã€å½“ç¤¾ã‹ã‚‰å‡ºè·ã—ãŸè£½å“ã‹ã©ã†ã‹ã¯ç¢ºèªã§ãã¾ã›ã‚“ã€‚
mizdra 2024/09/19
äº‹ä»¶

å›½éš›

security
ãƒªãƒ³ã‚¯
ãƒ¬ãƒãƒŽãƒ³ã§ã¾ãŸé€šä¿¡æ©Ÿå™¨çˆ†ç™ºã€20äººæ»äº¡ã€€æ—¥æœ¬è£½ãƒˆãƒ©ãƒ³ã‚·ãƒ¼ãƒãƒ¼ã‹
ï¼»ãƒ™ã‚¤ãƒ«ãƒ¼ãƒˆã€€ï¼‘ï¼˜æ—¥ã€€ãƒã‚¤ã‚¿ãƒ¼ï¼½ - ãƒ¬ãƒãƒŽãƒ³ã®é¦–éƒ½ãƒ™ã‚¤ãƒ«ãƒ¼ãƒˆéƒŠå¤–ãªã©åŒå›½å„åœ°ã§ï¼‘ï¼˜æ—¥ã€ã‚¤ã‚¹ãƒ©ãƒ æ•™ã‚·ãƒ¼ã‚¢æ´¾çµ„ç¹”ãƒ’ã‚ºãƒœãƒ©æˆ¦é—˜å“¡ãŒä½¿ç”¨ã—ã¦ã„ãŸãƒˆãƒ©ãƒ³ã‚·ãƒ¼ãƒãƒ¼ãŒä¸€æ–‰çˆ†ç™ºã—ãŸã€‚å‰æ—¥ã«ã¯ãƒ’ã‚ºãƒœãƒ©ãŒä½¿ã£ã¦ã„ãŸãƒã‚±ãƒƒãƒˆãƒ™ãƒ«ãŒç›¸æ¬¡ã„ã§çˆ†ç™ºã—ã¦ãŠã‚Šã€ã•ã‚‰ã«ç·Šå¼µãŒé«˜ã¾ã£ãŸã€‚ ãƒ¬ãƒãƒŽãƒ³ä¿å¥çœã¯ã€ï¼’ï¼äººãŒæ»äº¡ã—ã€ï¼”ï¼•ï¼äººä»¥ä¸ŠãŒè² å‚·ã—ãŸã¨ç™ºè¡¨ã—ãŸã€‚çˆ†ç™ºã¯ãƒ™ã‚¤ãƒ«ãƒ¼ãƒˆéƒŠå¤–ã‚„æ±éƒ¨ãƒ™ã‚«ãƒ¼é«˜åŽŸã‚’ä¸å¿ƒã«ç™ºç”Ÿã€‚å‰æ—¥ã®ä¸€æ–‰çˆ†ç™ºã§ã¯ï¼‘ï¼’äººãŒæ»äº¡ã€ï¼“ï¼ï¼ï¼äººè¿‘ããŒè² å‚·ã—ãŸã€‚ ã‚‚ã£ã¨è¦‹ã‚‹ çˆ†ç™ºã—ãŸé€šä¿¡æ©Ÿå™¨ã®ç”»åƒã«ã¯ã€Œï¼©ï¼£ï¼¯ï¼ã€ã¨ã€Œæ—¥æœ¬è£½ã€ã®ãƒ©ãƒ™ãƒ«ãŒè²¼ã‚‰ã‚Œã¦ã„ãŸã€‚æ—¥æœ¬ã®ç„¡ç·šæ©Ÿãƒ¡ãƒ¼ã‚«ãƒ¼ã€ã‚¢ã‚¤ã‚³ãƒ (6820.T), opens new tabã¯ï¼‘ï¼™æ—¥ã€ã“ã®å ±é“ã«ã¤ã„ã¦ã€Œå½“ç¤¾ã‹ã‚‰å‡ºè·ã—ãŸè£½å“ã‹ã©ã†ã‹ã¯ç¢ºèªã§ããªã„ã€ã¨ã®ã‚³ãƒ¡ãƒ³ãƒˆã‚’å‡ºã—ãŸã€‚ ã‚‚ã£ã¨è¦‹ã‚‹
mizdra 2024/09/19
security
ãƒªãƒ³ã‚¯
Passwords have problems, but passkeys have more
We had originally planned to go all-in on passkeys for ONCE/Campfire, and we built the early authentication system entirely around that. It was not a simple setup! Handling passkeys properly is surprisingly complicated on the backend, but we got it done. Unfortunately, the user experience kinda sucked, so we ended up ripping it all out again. The probl em with passkeys is that they're essentially a
mizdra 2024/09/12
security
ãƒªãƒ³ã‚¯
Security Advisory YSA-2024-03
With YubiKey thereâ€™s no tradeoff between great security and usability Why YubiKey
mizdra 2024/09/04
security
ãƒªãƒ³ã‚¯
Mozilla SSL Configuration Generator
Modern Services with clients that support TLS 1.3 and don't need backward compatibility Intermediate General-purpose servers with a variety of clients, recommended for almost all systems
mizdra 2024/08/18
security

network
ãƒªãƒ³ã‚¯
ãƒã‚¹ãƒˆã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã®ç½ RE: TypeScriptã§ã€Œé¸æŠžè‚¢ã€ã®å®šç¾©ã‚’Enumçš„ãªå®šæ•°ã«ã¾ã¨ã‚ã‚‹
ã“ã®è¨˜äº‹ã¯ã€é™çš„è§£æžã¨ãƒ“ãƒ«ãƒ‰ã‚µã‚¤ã‚ºé¢ã§èˆˆå‘³æ·±ã„ãƒ†ãƒ¼ãƒžã§ã—ãŸã€‚è¨˜äº‹ã¨ã—ã¦è‡ªåˆ†ã®è€ƒãˆã‚’æ›¸ãã¾ã™ã€‚ æ³¨æ„ã€‚ã‚ãã¾ã§ãƒ“ãƒ«ãƒ‰ãƒ‘ãƒ•ã‚©ãƒ¼ãƒžãƒ³ã‚¹è¦–ç‚¹ã§ã®æœ€é©åŒ–ã§ã™ã€‚å¼·ã„æ„å›³ãŒã‚ã£ã¦ã€è‡ªåˆ†ã®ãƒ‰ãƒ¡ã‚¤ãƒ³ãƒ¢ãƒ‡ãƒªãƒ³ã‚°ã®æ–¹æ³•è«–ã§ã¯ã“ã‚ŒãŒæœ€é©ãªã‚“ã ã€ã¨ã„ã†ãªã‚‰å…ƒã‚³ãƒ¼ãƒ‰ã®æ–¹æ³•è«–ã‚’æ¢ã‚ã‚‹ã¤ã‚‚ã‚Šã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ å…ƒè¨˜äº‹ã®ã‚³ãƒ¼ãƒ‰ã‚’ minify ã™ã‚‹ã¨ã©ã†ãªã‚‹ã‹ å…ƒã‚³ãƒ¼ãƒ‰ã‚’å‚è€ƒã«ã€ãã‚Œã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã‚µãƒ³ãƒ—ãƒ«ã‚³ãƒ¼ãƒ‰ã‚’æ›¸ã„ã¦ã¿ã¾ã™ã€‚ const sortingOptions = { priceDesc: { id: "priceDesc", sort: "price", order: "desc", label: "ä¾¡æ ¼ãŒé«˜ã„é †", }, priceAsc: { id: "priceAsc", sort: "price", order: "asc", label: "ä¾¡æ ¼ãŒå®‰ã„é †", }, ratingDesc: { id: "ra
mizdra 2024/08/15
javascript

performance

security
ãƒªãƒ³ã‚¯
Requesting performance isolation with the Origin-Agent-Cluster header Â |Â Articles Â |Â web.dev
Requesting performance isolation with the Origin-Agent-Cluster header Stay organized with collections Save and categorize content based on your preferences. A new HTTP response header to limit domain-wide scripting and request dedicated resources from the browser. Origin-Agent-Cluster is a new HTTP response header that instructs the browser to prevent synchronous scripting access between same-site
mizdra 2024/08/05
web

performance

security
ãƒªãƒ³ã‚¯
Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor | mod%log
Ridiculous vulnerability disclosure process with CrowdStrike Falcon Sensor Today, we publish a new advisory for a vulnerability in the CrowdStrike Falcon Sensor, that was found by our team-mate Pascal Zenker as part of a recent red-teaming engagement. The vulnerability is a case of insufficient control flow management, that allows an attacker with administrative privileges to bypass the Falcon Age
mizdra 2024/07/21
security
ãƒªãƒ³ã‚¯
Technical Details: Falcon Update for Windows Hosts | CrowdStrike
What Happened? On July 19, 2024 at 04:09 UTC, as part of ongoing operations, CrowdStrike released a sensor configuration update to Windows systems. Sensor configuration updates are an ongoing part of the protection mechanisms of the Falcon platform. This configuration update triggered a logic error resulting in a system crash and blue screen (BSOD) on impacted systems. The sensor configuration upd
mizdra 2024/07/20
security

éšœå®³
ãƒªãƒ³ã‚¯
ãƒ–ãƒ©ã‚¦ã‚¶é–‹ç™ºè€…ãƒ„ãƒ¼ãƒ«ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¿ãƒ–ã«è¡¨ç¤ºã•ã‚Œãªã„æƒ…å ±é€ä¿¡æ‰‹æ³• - Qiita
ã¯ã˜ã‚ã« ã¯ã˜ã‚ã¾ã—ã¦ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®Satoki (@satoki00) ã§ã™ã€‚ä»Šå›žã¯ãƒ–ãƒ©ã‚¦ã‚¶ã®é–‹ç™ºè€…ãƒ„ãƒ¼ãƒ«ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¿ãƒ–ã‹ã‚‰éš ã‚Œã¦ã€Webã‚µã‚¤ãƒˆå†…ã®æƒ…å ±ã‚’é€ä¿¡ã™ã‚‹æ‰‹æ³•ã‚’ã¾ã¨ã‚ã¾ã™ã€‚æ‰€è¬‚Exfiltrationã¨ã„ã†ã‚„ã¤ã§ã™ã€‚ä¸ã«ã¯CSPã®åˆ¶é™ã‚’Bypassã™ã‚‹ãŸã‚ã«ç”¨ã„ã‚‰ã‚Œã‚‹ãƒ†ã‚¯ãƒ‹ãƒƒã‚¯ã‚‚ã‚ã‚Šã¾ã™ã€‚CTFãªã©ã§å®‰å…¨ã«ä½¿ã£ã¦ãã ã•ã„ã€‚ å‰æ ç™ºç«¯ã¯Webä¸Šã§ãƒ†ã‚ã‚¹ãƒˆã®æ–‡å—æ•°ã‚’ã‚«ã‚¦ãƒ³ãƒˆã§ãã‚‹ã‚µã‚¤ãƒˆãŒé–‰éŽ–ã™ã‚‹éš›ã®è©±ã§ã™ã€‚ã‚«ã‚¦ãƒ³ãƒˆå¯¾è±¡ã®ãƒ†ã‚ã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ãŒã‚µã‚¤ãƒˆé‹å–¶ (ã‚„ã‚µã‚¤ãƒˆã‚’æ”¹ç«„ã—ãŸæ”»æ’ƒè€…) ã«ç›—ã¿å–ã‚‰ã‚Œã¦ã„ãªã„ã‹ã¨ã„ã†è°è«–ãŒå·»ãèµ·ã“ã£ã¦ã„ã¾ã—ãŸã€‚ã€Œç›—ã¿å–ã‚‰ã‚Œã¦ã„ãªã„ã€å´ã®ä¸»å¼µã¯ã€ãƒ–ãƒ©ã‚¦ã‚¶ã®é–‹ç™ºè€…ãƒ„ãƒ¼ãƒ«ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¿ãƒ–ã«ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’é€ä¿¡ã—ãŸå½¢è·¡ãŒãªã„ã¨ã„ã†ã‚‚ã®ã§ã—ãŸã€‚ã“ã“ã§ ãƒ–ãƒ©ã‚¦ã‚¶ã®é–‹ç™ºè€…ãƒ„ãƒ¼ãƒ«ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¿ãƒ–ã«è¡¨ç¤ºãŒãªã‘ã‚Œã°å¤–éƒ¨ã¸ãƒ‡ãƒ¼ã‚¿ã‚’é€ä¿¡ã—ã¦ã„ãªã„ã®ã‹ï¼Ÿ ã¨ã„ã£ãŸç–‘å•ãŒ
mizdra 2024/07/15
network

security

web
ãƒªãƒ³ã‚¯
1 2 3 4 5 6 7 8 9 10 æ¬¡ã®ãƒšãƒ¼ã‚¸