[B! security] InoHiroã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

InoHiro id:InoHiro

securityã«é–¢ã™ã‚‹InoHiroã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (127)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

æƒ…å ±æµå‡ºã§NTTç¤¾é•·ãŒè¬ç½ªã€€USBãƒ¡ãƒ¢ãƒªãƒ¼ã¯å…¨é¢ä½¿ç”¨ç¦æ¢ã« | æ¯Žæ—¥æ–°èž
NTTã®å³¶ç”°æ˜Žç¤¾é•·ã¯7æ—¥ã®è¨˜è€…ä¼šè¦‹ã§ã€å‚˜ä¸‹ã®NTTè¥¿æ—¥æœ¬ã®åä¼šç¤¾ã‹ã‚‰ç´„900ä¸‡ä»¶ã®é¡§å®¢æƒ…å ±ãŒä¸æ£æµå‡ºã—ãŸå•é¡Œã«ã¤ã„ã¦ã€Œã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã—ãŸãŠå®¢ã•ã¾ã«ã¯èª ã«ç”³ã—è¨³ãªã„ã€ã¨è¬ç½ªã—ãŸã€‚é¡§å®¢æƒ…å ±ã¯å…ƒæ´¾é£ç¤¾å“¡ãŒUSBãƒ¡ãƒ¢ãƒªãƒ¼ã«è¨˜éŒ²ã—ã¦æŒã¡å‡ºã—ãŸã¨ã¿ã‚‰ã‚Œã€ã‚°ãƒ«ãƒ¼ãƒ—å…¨ä½“ã§USBãƒ¡ãƒ¢ãƒªãƒ¼ã‚’æ¥å‹™ã«ä¸€åˆ‡ä½¿ã‚ãªã„ãªã©ã®å†ç™ºé˜²æ¢ç–ã‚‚æ˜Žã‚‰ã‹ã«ã—ãŸã€‚ å³¶ç”°æ°ã¯ã€Œè¨˜éŒ²åª’ä½“ã‚’æŒã¡è¾¼ã¾ãªã„ãªã©ã®ç¤¾å†…ãƒ«ãƒ¼ãƒ«ã¯è¨ã‘ã¦ã„ãŸãŒâ€¦
InoHiro 2023/11/08
security
ãƒªãƒ³ã‚¯
checkov
Policy-as-code for everyone Checkov scans cloud infrastructure configurations to find misconfigurations before they're deployed. Checkov uses a common command line interface to manage and analyze infrastructure as code (IaC) scan results across platforms such as Terraform, CloudFormation, Kubernetes, Helm, ARM Templates and Serverless framework. Get started Supported clouds and frameworks Verify c
InoHiro 2021/07/21
python

security
ãƒªãƒ³ã‚¯
GitHub - bridgecrewio/checkov: Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
InoHiro 2021/07/21
python

security
ãƒªãƒ³ã‚¯
SHA-1 is a Shambles
We have computed the very first chosen-prefix collision for SHA-1. In a nutshell, this means a complete and practical break of the SHA-1 hash function, with dangerous practical implications if you are still using this hash function. To put it in another way: all attacks that are practical on MD5 are now also practical on SHA-1. Check our paper here for more details. Slides from RWC are also availa
InoHiro 2020/01/08
security
ãƒªãƒ³ã‚¯
ãƒˆãƒ¬ãƒ³ãƒ‰ãƒžã‚¤ã‚¯ãƒ å†…éƒ¨ä¸æ£ã§é¡§å®¢ãƒ‡ãƒ¼ã‚¿æœ€å¤§12ä¸‡äººåˆ†ã‚’å£²å´ | NHKãƒ‹ãƒ¥ãƒ¼ã‚¹
æ—¥æœ¬ã«æœ¬ç¤¾ãŒã‚ã‚‹å¤§æ‰‹æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼ä¼šç¤¾ã€ãƒˆãƒ¬ãƒ³ãƒ‰ãƒžã‚¤ã‚¯ãƒã¯ã€æµ·å¤–ã®äº‹æ¥æ‰€ã®å¾“æ¥å“¡ãŒæœ€å¤§12ä¸‡äººåˆ†ã®é¡§å®¢ã®ãƒ‡ãƒ¼ã‚¿ã‚’ä¸æ£ã«æŒã¡å‡ºã—ã¦å£²å´ã—ã¦ã„ãŸã“ã¨ã‚’æ˜Žã‚‰ã‹ã«ã—ã¾ã—ãŸã€‚æŒã¡å‡ºã•ã‚ŒãŸãƒ‡ãƒ¼ã‚¿ã«ã¯æ—¥æœ¬å›½å†…ã®é¡§å®¢ã¯å«ã¾ã‚Œã¦ã„ãªã‹ã£ãŸã¨ã„ã†ã“ã¨ã§ã™ã€‚ æµå‡ºã—ãŸã®ã¯ã€éŽåŽ»ã«ãƒˆãƒ¬ãƒ³ãƒ‰ãƒžã‚¤ã‚¯ãƒã®ã‚µãƒãƒ¼ãƒˆçª“å£ã«é€£çµ¡ã—ãŸã‚¢ãƒ¡ãƒªã‚«ã‚„ãƒ‰ã‚¤ãƒ„ãªã©ï¼˜ã‹å›½ã®é¡§å®¢ã®åå‰ã‚„ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã€ãã‚Œã«é›»è©±ç•ªå·ãªã©ã§ã€æ—¥æœ¬å›½å†…ã®é¡§å®¢ã¯å«ã¾ã‚Œã¦ã„ãªã‹ã£ãŸã¨ã„ã†ã“ã¨ã§ã™ã€‚ ä¼šç¤¾ã«ã‚ˆã‚Šã¾ã™ã¨ã€ã“ã¨ã—ï¼˜æœˆã€é¡§å®¢ã®æ‰€ã«ã‚µãƒãƒ¼ãƒˆã‚’åä¹—ã‚‹ä¸å¯©ãªé›»è©±ãŒã‚ã‚Šã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¼å¯¾ç–ã®ãŸã‚ã«é‡‘ã‚’æ”¯æ‰•ã†ã‚ˆã†æ±‚ã‚ãŸã“ã¨ã‹ã‚‰èª¿æŸ»ã—ãŸã¨ã“ã‚ã€æµå‡ºãŒç™ºè¦šã—ãŸã¨ã„ã†ã“ã¨ã§ã™ã€‚ ä¼šç¤¾ã§ã¯ã€æƒ…å ±ã‚’æŒã¡å‡ºã—ãŸå¾“æ¥å“¡ã‚’æ‡²æˆ’è§£é›‡ã«ã—ãŸã†ãˆã§ã€æœæŸ»æ©Ÿé–¢ã«æƒ…å ±ã‚’æä¾›ã™ã‚‹ãªã©ã®å¯¾å¿œã‚’å–ã£ãŸã¨ã„ã†ã“ã¨ã§ã™ã€‚ ãƒˆãƒ¬ãƒ³ãƒ‰ãƒžã‚¤ã‚¯ãƒã¯ã€ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã«ã‚³ãƒ¡ãƒ³ãƒˆã‚’æŽ²è¼‰ã—ã€ã€Œæ¥µã‚ã¦éºæ†¾ã§ã€ãŠå®¢æ§˜ã‚’
InoHiro 2019/11/07
security

compliance
ãƒªãƒ³ã‚¯
LastPass Beta for Firefox 57 - The LastPass Blog
Self-service library of resources and guides for all LastPass products.
InoHiro 2019/09/17
ðŸ‘€

security
ãƒªãƒ³ã‚¯
ã‚ˆãã‚ã‹ã‚‰ãªã„JavaScriptãŒç¶ºéº—ã«ã•ã‚ŒãŸã‚‰Card Stealerã ã£ãŸä»¶ | ãƒªã‚¯ãƒ«ãƒ¼ãƒˆ ãƒ†ãƒƒã‚¯ãƒ–ãƒã‚°
ã“ã‚“ã«ã¡ã¯ã€Recruit-CSIRTã®ãã£ã‹ã‚ã§ã™ã€‚ ã€Œã‚¦ã‚£ãƒ«ã‚¹ã‚ªã‚¿ã‚¯ã®è‹¥æ‰‹ã‚¨ãƒ¼ã‚¹ã€ã¨å‘¼ã°ã‚Œã‚‹ã‚ˆã†ã«ãªã£ãŸã‹ã‚‰ã€ã¨ã„ã†ã‚ã‘ã§ã¯ãªã„ã§ã—ã‚‡ã†ãŒï¼ˆç¬‘ï¼‰ã€ã“ã®ãŸã³ã€è©±ã«ã¯ã‚ˆãèžããŒè¦‹ã‹ã‘ãŸã“ã¨ã®ãªã‹ã£ãŸã€Œã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ç›—ã‚€Javscriptã€ã‚’è¦‹ã¤ã‘ãŸã®ã§ã€ãã®ãƒžãƒ«ã‚¦ã‚§ã‚¢ã¨å‘¨è¾ºã®æ”»æ’ƒã«ã¤ã„ã¦æƒ…å ±ã‚’å…±æœ‰ã—ã¾ã™ã€‚ã¿ãªã•ã‚“ã«ã¨ã£ã¦æœ¬ãƒ–ãƒã‚°ãŒæœ‰ç›Šãªæƒ…å ±ã«ãªã‚Œã°å¹¸ã„ã§ã™ã€‚ å¿™ã—ã„æ–¹ã¸ ä»Šå›žç™ºè¦‹ã•ã‚ŒãŸJavaScriptã®æ¦‚è¦ ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰ã®ãƒã‚§ãƒƒã‚¯ãƒ‡ã‚£ã‚¸ãƒƒãƒˆã®è¨ˆç®—ã¨ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰ç•ªå·ã®æ§‹æˆã‚’ãƒã‚§ãƒƒã‚¯ã™ã‚‹ ãƒã‚§ãƒƒã‚¯ãŒé€šã‚‹ã¨ã€å¤–éƒ¨ã‚µã‚¤ãƒˆã¸å…¥åŠ›æƒ…å ±ã‚’å…¨ã¦é€ä¿¡ã™ã‚‹ Javascriptã‚³ãƒ¼ãƒ‰ã®ä»•è¾¼ã¾ã‚Œæ–¹ Webã‚µã‚¤ãƒˆã®jsãƒ•ã‚¡ã‚¤ãƒ«ã‚’æ”¹ã–ã‚“ã—ã¦å‹•ä½œ å…ƒã®ã‚µã‚¤ãƒˆã®å‹•ãã«å¯¾ã—ã¦ã€è¦‹ãŸç›®ä¸Šã®å‹•ãã¯å¤‰ã‚ã‚‰ãªã„ IOC https://ww1-filecloud[.]com/img æ”»æ’ƒã®æµã‚Œ ä»Šå›žè¦³æ¸¬ã—ãŸæ”»
InoHiro 2019/05/11
JavaScript

security
ãƒªãƒ³ã‚¯
ã–ã£ãã‚Šåˆ†ã‹ã‚‹è„†å¼±æ€§æŒ‡æ¨™ - CVE CVSS CWE - Qiita
èƒŒæ™¯ ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®è„†å¼±æ€§ã‚’ç¢ºèªã™ã‚‹éš›ã€å¿…ãšå‡ºã¦ãã‚‹ç”¨èªžã§ã‚ã‚‹CVE, CVSS, CWEã‚’ã–ã£ãã‚ŠæŠŠæ¡ã—ã¦ãŠãã€‚ ç°¡å˜ã«è¨€ã†ã¨ã€ CVEã¯ä¸–ã®ä¸ã®è„†å¼±æ€§ã®ä¸€å…ƒçš„ãªIDã€ CVSSã¯ãã®è„†å¼±æ€§ã®æ·±åˆ»åº¦ç‚¹æ•°ã€ CWEã¯ãã®è„†å¼±æ€§ãŒã©ã®ã‚«ãƒ†ã‚´ãƒªãªã®ã‹ ã‚’è¡¨ã™ã€‚ å‚è€ƒæ–‡çŒ® æƒ…å ±ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¹ãƒšã‚·ãƒ£ãƒªã‚¹ãƒˆ - SEå¨˜ã®å‰£ - IPA - å…±é€šè„†å¼±æ€§è©•ä¾¡ã‚·ã‚¹ãƒ†ãƒ CVSSæ¦‚èª¬ CVE Details CVE (Common Vulnerabilities and Exposures) - å…±é€šè„†å¼±æ€§è˜åˆ¥å ä¸€è¨€ã§ã„ã†ã¨ã€ã€Œä¸–ã®ä¸ã®è„†å¼±æ€§æƒ…å ±ã‚’ä¸€æ„ã«ç®¡ç†ã™ã‚‹ãŸã‚ã®IDã€ æ§˜ã€…ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢è£½å“ã®è„†å¼±æ€§ã«ä¸€æ„ã®è˜åˆ¥ç•ªå·ã€ŒCVEè˜åˆ¥ç•ªå·(CVE-ID)ã€ã‚’ä»˜ä¸Žã—ã€è„†å¼±æ€§ã‚’ç®¡ç† å‘½åè¦ç´„ã¯ã€ã€ŒCVE-YYYY-XXXXã€ : YYYYã¯å¹´ã€XXXXã¯ä¸€æ„ã®ç•ªå·ã‚’è¡¨ã™ã€‚ ä¾‹ï¼‰CVE-2014-3566ï¼ˆSSLv
InoHiro 2019/02/27
ã–ã£ãã‚Šã‚ã‹ã£ãŸ

security
ãƒªãƒ³ã‚¯
ã‚¯ãƒ©ã‚¦ãƒ‰ãƒã‚¤ãƒ†ã‚£ãƒ–ãªãƒãƒ‹ãƒ¼ãƒãƒƒãƒˆã‚’AWSä¸Šã«ä½œã£ã¦ã¿ãŸè©± - ã‚ã‚‹ç ”ç©¶è€…ã®æ‰‹è¨˜
TL;DR AWSã®ãƒžãƒãƒ¼ã‚¸ãƒ‰ã‚µãƒ¼ãƒ“ã‚¹ã‚’æ´»ç”¨ã—ã¦ä½Žã‚¤ãƒ³ã‚¿ãƒ©ã‚¯ã‚·ãƒ§ãƒ³åž‹ã®ãƒãƒ‹ãƒ¼ãƒãƒƒãƒˆç’°å¢ƒã‚’ä½œã£ãŸ ã‚³ã‚¹ãƒˆã‚‚æœˆã€…ç´„$15ã§é‹ç”¨å¯èƒ½ ã‚³ãƒžãƒ³ãƒ‰3å›žãã‚‰ã„ã§èª°ã§ã‚‚ãƒ‡ãƒ—ãƒã‚¤ã§ãã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ã®ã§èˆˆå‘³ãŒã‚ã‚Œã°ä½¿ã£ã¦ã¿ã¦ãã‚Œã‚ˆãª èƒŒæ™¯ AWSã«ç½®ãä½Žã‚¤ãƒ³ã‚¿ãƒ©ã‚¯ã‚·ãƒ§ãƒ³åž‹ãƒãƒ‹ãƒ¼ãƒãƒƒãƒˆï¼ˆsynã«å¯¾ã—ã¦synackã ã‘è¿”ã—ã¦å¾Œã¯é€ã‚‰ã‚Œã¦ãã‚‹é€šä¿¡ã‚’ç›£è¦–ã™ã‚‹ã‚„ã¤ï¼‰ã€ä»Šãªã‚‰ã‚·ãƒ£ã‚ãƒƒã¨ã‚¹ãƒ‘ãƒƒã¨å®Ÿè£…ã§ãã‚‹ã‚“ã ã‚ã†ãªã‚ã‚ã‚ã¨éŽåŽ»ã®ã‚¯ã‚½å®Ÿè£…ã‚’æ€ã„å‡ºã—ã¦æ‚¶çµ¶ã—ã¦ã‚‹â€” Masayoshi MIZUTANI (@m_mizutani) 2019å¹´2æœˆ1æ—¥ ã¨ã„ã†æ„Ÿã˜ã§æ˜”ã‚¯ãƒ©ã‚¦ãƒ‰ä¸Šã§é‹ç”¨ã—ã¦ã„ãŸãƒãƒ‹ãƒ¼ãƒãƒƒãƒˆã®ã“ã¨ã‚’ãµã¨æ€ã„å‡ºã—ãŸã®ã§ã™ãŒã€ä»•äº‹ã§å¤šå°‘AWSã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ç†è§£ã—ãŸä»Šã ã£ãŸã‚‰ã‚‚ã†ã¡ã‚‡ã£ã¨ã¾ã¨ã‚‚ã«å®Ÿè£…ã§ããã†ã ã‚ˆãªãã€å®Ÿè£…ã™ã‚‹ãªã‚‰ã‚¤ãƒ³ã‚¹ã‚¿ãƒ³ã‚¹ã§å®Œçµã™ã‚‹ã‚“ã˜ã‚ƒãªãã¦ã‚¯ãƒ©ã‚¦ãƒ‰ã®ãƒžãƒãƒ¼ã‚¸ãƒ‰ã‚µãƒ¼ãƒ“ã‚¹ã¡ã‚ƒã‚“ã¨ä½¿ã£ã¦æ¶ˆè€—ã—ãªã„ä½œã‚Šã«ã—
InoHiro 2019/02/12
aws

security
ãƒªãƒ³ã‚¯
å®…ãµãã„ã‚‹ä¾¿
ã€Œå®…ãµãã„ã‚‹ä¾¿ã€ã‚µãƒ¼ãƒ“ã‚¹ã¯çµ‚äº†ã„ãŸã—ã¾ã—ãŸã€‚ 2020å¹´3æœˆ31æ—¥ã‚’ã‚‚ã¡ã¾ã—ã¦ã€Œå®…ãµãã„ã‚‹ä¾¿ã€ã‚µãƒ¼ãƒ“ã‚¹ã¯çµ‚äº†ã„ãŸã—ã¾ã—ãŸã€‚ ã“ã‚Œã«ä¼´ã„ã€é€€ä¼šç”³è«‹ã‚„ãƒã‚¤ãƒ³ãƒˆäº¤æ›ç‰ã®æ©Ÿèƒ½ã‚’ã”æä¾›ã—ã¦ãŠã‚Šã¾ã—ãŸWEBç‰¹è¨ã‚µã‚¤ãƒˆã‚‚ã‚µãƒ¼ãƒ“ã‚¹ã‚’çµ‚äº†ã„ãŸã—ã¾ã—ãŸã€‚ å¤§å¤‰é•·ã‚‰ãã”æ„›é¡§ã„ãŸã ãã€èª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã—ãŸã€‚
InoHiro 2019/01/26
security
ãƒªãƒ³ã‚¯
Rubyã‚„Rubyã®OSSã®è„†å¼±æ€§ã‚’è¦‹ã¤ã‘ãŸè©± - ooooooo_qã®æ—¥è¨˜
ã“ã®è¨˜äº‹ã¯Ruby Advent Calendar 2018 - Qiitaã®23æ—¥ç›®ã§ã™ã€‚ ä»Šå¹´ã¯Rubyã‚„OSSã®è„†å¼±æ€§ã‚’ã„ã‚ã„ã‚æŽ¢ã—ã¦ã„ãŸã®ã§ã€ãã®æ„Ÿæƒ³ã‚’ã€‚ Ruby (Cruby) Tmpã§ã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒˆãƒ©ãƒãƒ¼ã‚µãƒ« Dirã§ã®NULæ–‡å—ã®æ‰±ã„ã®å•é¡Œ UNIX ãƒ‰ãƒ¡ã‚¤ãƒ³ã‚½ã‚±ãƒƒãƒˆã§ã®NULæ–‡å— Ruby 2.6ã§ã®æŒ™å‹•å¤‰æ›´ Dir[]ã§ã®NULæ–‡å—ã«ã¤ã„ã¦ Rubygems rubygems 65534å€åŠ¹çŽ‡çš„ãªãƒ–ãƒ«ãƒ¼ãƒˆãƒ•ã‚©ãƒ¼ã‚¹ minitarã§ã®Kernel.open*2 geminabox Discourse Heroku Rails pgã§ã®NULæ–‡å— Active Storageã§ã®XSS å ±å¥¨é‡‘ æ„Ÿæƒ³ Rubyã«è©³ã—ããªã£ãŸ è„†å¼±æ€§ã¨ã—ã¦ã®åˆ¤å®š è‡ªåˆ†ãŒä½¿ã†ã‚‚ã®ã‚’å®‰å…¨ã«ã™ã‚‹ ã¾ãšã¯Rubyã‹ã‚‰ Ruby (Cruby) techlife.cookpad.com æ˜¨å¹´å…¬é–‹ã•ã‚ŒãŸ
InoHiro 2019/01/25
ã™ã’ãˆ...

ruby

security
ãƒªãƒ³ã‚¯
Chrome 70ã‹ã‚‰ã€WebAuthnã§Macã®TouchIDã¨Androidã®æŒ‡ç´‹èªè¨¼ãŒãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§åˆ©ç”¨å¯èƒ½ã«ã€‚Webã‚µã‚¤ãƒˆã¸ã®ãƒã‚°ã‚¤ãƒ³ã‚‚ã‚¿ãƒƒãƒã§
Chrome 70ã‹ã‚‰ã€WebAuthnã§Macã®TouchIDã¨Androidã®æŒ‡ç´‹èªè¨¼ãŒãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§åˆ©ç”¨å¯èƒ½ã«ã€‚Webã‚µã‚¤ãƒˆã¸ã®ãƒã‚°ã‚¤ãƒ³ã‚‚ã‚¿ãƒƒãƒã§ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä½¿ã‚ãšãƒ‡ãƒã‚¤ã‚¹å´ã§ã®æŒ‡ç´‹èªè¨¼ã‚„PINã‚³ãƒ¼ãƒ‰ãªã©ã«ã‚ˆã‚‹èªè¨¼ã«ã‚ˆã‚ŠWebã‚µã‚¤ãƒˆã¸ãƒã‚°ã‚¤ãƒ³ã§ãã‚‹WebAuthnã¯ã€2018å¹´4æœˆã«W3Cã®å‹§å‘Šå€™è£œã«ãªã‚Šã€Chromeã€Firefoxã€Microsoft Edgeã¸ã®å®Ÿè£…ãŒé€²ã‚ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ å‚è€ƒï¼šãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«ä¾å˜ã—ãªã„èªè¨¼ã€ŒWebAuthnã€ã‚’Chrome/Firefox/EdgeãŒå®Ÿè£…é–‹å§‹ã€W3CãŒæ¨™æº–åŒ–ã€‚Webã¯ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«ä¾å˜ã—ãªã„ã‚ˆã‚Šå®‰å…¨ã§ä¾¿åˆ©ãªã‚‚ã®ã¸ Googleã¯5æœˆã«ãƒªãƒªãƒ¼ã‚¹ã—ãŸChrome 67ã§WebAuthnã¸ã®å¯¾å¿œã‚’è¡Œã„ã¾ã—ãŸãŒã€10æœˆã«ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã‚‹Chrome 70ã§ã¯å®Ÿè£…ã‚’é€²åŒ–ã•ã›ã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§Macã®TouchIDã¨Androidã®æŒ‡ç´‹èªè¨¼ã«å¯¾å¿œã™ã‚‹ã“
InoHiro 2018/09/19
FIDO2 ãªã‚‰ Yubikey ã‚‚ä½¿ãˆã‚‹ã‹ãªï¼Ÿ

security
ãƒªãƒ³ã‚¯
ã‚ªãƒ•ã‚£ã‚¹ãƒ»AWSç’°å¢ƒã‚’ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç›£è¦–ã™ã‚‹ãŸã‚ã®ãƒã‚°åŽé›† - ã‚¯ãƒƒã‚¯ãƒ‘ãƒƒãƒ‰é–‹ç™ºè€…ãƒ–ãƒã‚°
ã‚¤ãƒ³ãƒ•ãƒ©ã‚¹ãƒˆãƒ©ã‚¯ãƒãƒ£ãƒ¼éƒ¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚°ãƒ«ãƒ¼ãƒ—ã®æ°´è°· (@m_mizutani) ã§ã™ã€‚ ç¾åœ¨ã€ã‚¯ãƒƒã‚¯ãƒ‘ãƒƒãƒ‰ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚°ãƒ«ãƒ¼ãƒ—ã§ã¯ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç›£è¦–ã‚’é«˜åº¦åŒ–ã«å¯¾ã—ã¦å–ã‚Šçµ„ã‚“ã§ã„ã¾ã™ã€‚ã‚µãƒ¼ãƒ“ã‚¹ã«é–¢é€£ã™ã‚‹éƒ¨åˆ†ã®ç›£è¦–ã¯ä»¥å‰ã‹ã‚‰ã‚„ã£ã¦ããŸã®ã§ã™ãŒã€ã“ã“ã—ã°ã‚‰ãã¯ãã‚Œä»¥å¤–ã®ã‚¤ãƒ³ãƒ•ãƒ©ã‚„ã‚ªãƒ•ã‚£ã‚¹ã§ç™ºç”Ÿã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¾µå®³ã‚’æ¤œçŸ¥ã™ã‚‹ã“ã¨ã‚’ç›®çš„ã¨ã—ãŸç›£è¦–åŸºç›¤ã®æ§‹ç¯‰ã«åŠ›ã‚’å…¥ã‚Œã¦ã„ã¾ã™ã€‚ æ˜”ã¯ä¸€èˆ¬çš„ã«ã‚ªãƒ•ã‚£ã‚¹ã€ã‚¤ãƒ³ãƒ•ãƒ©ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç›£è¦–ã¨è¨€ãˆã°ã€ã‚¤ãƒ³ãƒˆãƒ©ãƒãƒƒãƒˆå†…ã«é–‰ã˜ãŸç’°å¢ƒã§ã®ãƒã‚°åŽé›†ã‹ã‚‰åˆ†æžã¾ã§å®Œçµã—ã¦ã„ãŸã‚±ãƒ¼ã‚¹ã‚‚å°‘ãªããªã£ãŸã¨è€ƒãˆã‚‰ã‚Œã¾ã™ã€‚ã—ã‹ã—ç¾åœ¨ã ã¨ã‚¤ãƒ³ãƒ•ãƒ©ã¨ã—ã¦ã‚¯ãƒ©ã‚¦ãƒ‰ã‚µãƒ¼ãƒ“ã‚¹ã‚’å¤šç”¨ã—ãŸã‚Šã€æ¥å‹™ã§ä½¿ã†ãƒ„ãƒ¼ãƒ«ã‚’SaaSã«ã‚ˆã£ã¦æä¾›ã™ã‚‹ã¨ã„ã†å ´é¢ã‚‚å¢—ãˆã¦ã„ã‚‹ã‹ã¨æ€ã„ã¾ã™ã€‚ã“ã®ã‚ˆã†ãªçŠ¶æ³ã ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç›£è¦–ã®ãŸã‚ã«è¦‹ã‚‹ã¹ãç®‡æ‰€ãŒã°ã‚‰ã‘ã¦ã—ã¾ã†ã¨ã„ã£ãŸã“ã¨ãŒèµ·ã“ã‚Šã¾ã™ã€‚ã‚¯ãƒƒã‚¯ãƒ‘ãƒƒãƒ‰ã§ã‚‚ç©æ¥µçš„ã«SaaSã‚„AWS
InoHiro 2018/06/04
cookpad

security
ãƒªãƒ³ã‚¯
W3Cã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ä¸è¦ã®ã‚¦ã‚§ãƒ–èªè¨¼ã€ŒWeb Authenticationã€ã‚’å‹§å‘Šå€™è£œã«
ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«ã¯å•é¡ŒãŒã‚ã‚Šã€å¤šãã®äººãŒãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’é©åˆ‡ã«ç®¡ç†ã—ã¦ã„ãªã„ã€‚ãã“ã§ä»£æ›¿ç–ãŒã€è¤‡æ•°ã®ä¸»è¦ã‚¦ã‚§ãƒ–ãƒ–ãƒ©ã‚¦ã‚¶ã§ã‚µãƒãƒ¼ãƒˆã•ã‚Œã‚‹ã€‚Googleã€Mozillaã€Microsoftã¯ä»Šå¾Œã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ä¸è¦ã®èªè¨¼æ–¹å¼ã‚’ã€ŒChromeã€ã€ŒFirefoxã€ã€ŒEdgeã€ã®å„ãƒ–ãƒ©ã‚¦ã‚¶ã«çµ„ã¿è¾¼ã‚€è¦‹é€šã—ã ã€‚
InoHiro 2018/04/14
security

w3c
ãƒªãƒ³ã‚¯
3/28ã«å…¬é–‹ã•ã‚ŒãŸRubyã®è„†å¼±æ€§æƒ…å ±ã«ã¤ã„ã¦ã®ãƒã‚¨ãƒ çš„è§£èª¬ - pixiv inside
ã“ã‚“ã«ã¡ã¯ã€‚Rubyã‚³ãƒŸãƒƒã‚¿ãƒ¼ã®usaã§ã™ã€‚ ãªã‚“ã‹Ruby ã® æœ€æ–° ãƒªãƒªãƒ¼ã‚¹ã¨ä¸€ç·’ã«ã€è„†å¼±æ€§ æƒ…å ± ãŒ ã„ã£ã±ã„ å…¬é–‹ ã•ã‚Œã¾ã—ãŸãã€‚ã†ã‚ãƒ¼ã€ãªã‚“ã‹ã‚ˆãã‚ã‹ã‚“ãªã„ã‘ã©ã€ã‚„ã°ãã†ã§ã™ãï¼æ£å‘³ã®ã¨ã“ã‚ã€ã“ã„ã¤ã‚‰çµå±€ã©ã‚Œãã‚‰ã„å±ãªãã†ãªã®ã‹ã€ãã‚Œã‚‰ã®è„†å¼±æ€§ã®è¨˜äº‹ã‚’æ›¸ã„ãŸäººãŒãŸã¾ãŸã¾ãƒ”ã‚¯ã‚·ãƒ–ã«ã„ã¾ã—ãŸã®ã§ã€çŽ‡ç›´ã«æœ¬éŸ³ã‚’èªžã£ã¦ã„ã“ã†ã¨æ€ã„ã¾ã™ã€‚ CVE-2017-17742: WEBrick ã«ãŠã‘ã‚‹ HTTP ãƒ¬ã‚¹ãƒãƒ³ã‚¹å½è£…ã®è„†å¼±æ€§ã«ã¤ã„ã¦ ã†ã¾ãåˆ©ç”¨ã™ã‚‹ã®ã¯é›£ã—ã„ã¨ã¯æ€ã„ã¾ã™ãŒã€ä½¿ã„ã‚ˆã†ã«ã‚ˆã£ã¦ã¯åˆ©ç”¨è€…(WEBrickã§ä½œã£ã¦å…¬é–‹ã—ãŸã‚µã‚¤ãƒˆã‚’è¨ªå•ã—ãŸäºº)ã‚’ã²ã©ã„ã‚ã«ã‚ã‚ã›ã‚‹ã“ã¨ãŒã§ãã‚‹ã‹ã‚‚ã—ã‚Œãªã„è„†å¼±æ€§ã§ã™ã€‚ ã§ã‚‚ã€WEBrickã§ä½œã£ãŸã‚µã‚¤ãƒˆã‚’ãƒ—ãƒãƒ€ã‚¯ã‚·ãƒ§ãƒ³ã§å…¬é–‹ã—ã¦ã‚‹äººãªã‚“ã¦ã„ã‚‹ã‚ã‘ãªã„ã‚ˆãã¯ã¯ã¯ã€‚ CVE-2018-8777: WEBrick ã«ãŠã‘ã‚‹å·¨å¤§ãƒªã‚¯ã‚¨ã‚¹ãƒˆã«ã¨ã‚‚ãªã† DoS
InoHiro 2018/03/30
ruby

security
ãƒªãƒ³ã‚¯
å›³è§£ã§ã‚ã‹ã‚‹Spectreã¨Meltdown - Speaker Deck
å›³è§£ã§ã‚ã‹ã‚‹ Spectreã¨Meltdown Feb. 17. 2018 Satoru Takeuchi Twitter ID: satoru_takeuchi 1 ã¯ã˜ã‚ã« â— è„†å¼±æ€§ã®ç¨®é¡žã¨ã€ã“ã®è³‡æ–™ã®èª¬æ˜Žç¯„å›² â— ã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚’ä½¿ã£ãŸã‚µã‚¤ãƒ‰ãƒãƒ£ãƒãƒ«ã‚¢ã‚¿ãƒƒã‚¯ã«ã‚ˆã‚‹ä¸æ£ãªãƒ‡ãƒ¼ã‚¿èªã¿å‡ºã— â— ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã§ã¯ãªãCPUã®é«˜é€ŸåŒ–æ©Ÿèƒ½ã«ã¾ã¤ã‚ã‚‹è„†å¼±æ€§ â—‹ ãã‚Œãžã‚Œè„†å¼±æ€§ã®ã‚ã‚‹ CPUã®ãƒªã‚¹ãƒˆãŒå…¬é–‹ã•ã‚Œã¦ã„ã‚‹ 2 ã‚³ãƒ¼ãƒ‰ãƒãƒ¼ãƒ åˆ¥å ã—ãã¿ å¯¾ç– Spectre Variant 1: Bounds Check Bypass âœ” Variant 2: Branch Target Injection Meltdown Variant 3: Rogue data cache load âœ” âœ”
InoHiro 2018/02/27
ã‚ã¨ã§èªã‚€

security
ãƒªãƒ³ã‚¯
ã€Œã‚«ãƒ©ãƒ¼ãƒŸãƒ¼ã‚·ãƒ§ãƒƒãƒ—ã€ã«ãŠã‘ã‚‹æƒ…å ±æµå‡ºã«é–¢ã™ã‚‹ã”å ±å‘Šã¨ãŠè©«ã³ã€€â€»2018å¹´2æœˆ21æ—¥è¿½è¨˜ | GMOãƒšãƒ‘ãƒœæ ªå¼ä¼šç¤¾
æœ¬ä»¶ã«é–¢ã™ã‚‹å•ã„åˆã‚ã›ã«ã¤ãã¾ã—ã¦ã¯ã€2æœˆ16æ—¥ï¼ˆé‡‘ï¼‰15æ™‚ã‚ˆã‚Šä»¥ä¸‹ã®é€šã‚Šã€å¤‰æ›´ã•ã›ã¦ã„ãŸã ãã¾ã™ã€‚ é›»è©±ç•ªå·ï¼š050-3204-4543 å—ä»˜æ™‚é–“ï¼šåˆå‰10æ™‚ï½žåˆå¾Œ7æ™‚ï¼ˆå¹³æ—¥ã®ã¿ï¼‰ ã“ã®ãŸã³ã€GMOãƒšãƒ‘ãƒœæ ªå¼ä¼šç¤¾ï¼ˆä»¥ä¸‹ã€ã€Œå¼Šç¤¾ã€ï¼‰ãŒé‹å–¶ã™ã‚‹ãƒãƒƒãƒˆã‚·ãƒ§ãƒƒãƒ—é‹å–¶ã‚µãƒ¼ãƒ“ã‚¹ã€Œã‚«ãƒ©ãƒ¼ãƒŸãƒ¼ã‚·ãƒ§ãƒƒãƒ—ã€ï¼ˆä»¥ä¸‹ã€ã€Œæœ¬ã‚µãƒ¼ãƒ“ã‚¹ã€ï¼‰ã«ãŠã„ã¦ã€ç¬¬ä¸‰è€…ã«ã‚ˆã‚‹ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ãŒç¢ºèªã•ã‚Œã€æœ¬ã‚µãƒ¼ãƒ“ã‚¹ã‚’åˆ©ç”¨ã—ã¦ãƒãƒƒãƒˆã‚·ãƒ§ãƒƒãƒ—ã‚’é‹å–¶ã„ãŸã ã„ã¦ã„ã‚‹ä¸€éƒ¨ã®ãŠå®¢æ§˜ï¼ˆä»¥ä¸‹ã€ã€Œã‚·ãƒ§ãƒƒãƒ—ã‚ªãƒ¼ãƒŠãƒ¼æ§˜ã€ï¼‰ã®æƒ…å ±ã®æµå‡ºã¨ã€ä¸€éƒ¨ã®ã‚·ãƒ§ãƒƒãƒ—ã‚ªãƒ¼ãƒŠãƒ¼æ§˜ãŠã‚ˆã³æœ¬ã‚µãƒ¼ãƒ“ã‚¹ã‚’åˆ©ç”¨ã—ã¦ã„ã‚‹ãƒãƒƒãƒˆã‚·ãƒ§ãƒƒãƒ—ã§è³¼å…¥ã•ã‚ŒãŸä¸€éƒ¨ã®æ–¹ï¼ˆä»¥ä¸‹ã€ã€Œè³¼å…¥è€…æ§˜ã€ï¼‰ã®ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ã®æµå‡ºã€ã¾ãŸã¯ãã®å¯èƒ½æ€§ãŒã‚ã‚‹ã“ã¨ï¼ˆä»¥ä¸‹ã€ã€Œæœ¬ä»¶ã€ï¼‰ãŒåˆ¤æ˜Žã„ãŸã—ã¾ã—ãŸã€‚
InoHiro 2018/01/26
security
ãƒªãƒ³ã‚¯
å¼Šç¤¾ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¼·åŒ–ã«é–¢ã™ã‚‹é‡è¦ãªãŠçŸ¥ã‚‰ã›ï½œã‚¹ã‚¿ãƒ¼ãƒãƒƒã‚¯ã‚¹ ã‚³ãƒ¼ãƒ’ãƒ¼ ã‚¸ãƒ£ãƒ‘ãƒ³
2017.09.05 ãŠå®¢æ§˜å„ä½ ã‚¹ã‚¿ãƒ¼ãƒãƒƒã‚¯ã‚¹ ã‚³ãƒ¼ãƒ’ãƒ¼ ã‚¸ãƒ£ãƒ‘ãƒ³ æ ªå¼ä¼šç¤¾ å¼Šç¤¾ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¼·åŒ–ã«é–¢ã™ã‚‹é‡è¦ãªãŠçŸ¥ã‚‰ã› å¹³ç´ ã‚ˆã‚Šå¼Šç¤¾ã‚’ã”æ„›é¡§è³œã‚Šã€åŽšãå¾¡ç¤¼ç”³ã—ä¸Šã’ã¾ã™ã€‚ ã“ã®ãŸã³ã€å¼Šç¤¾ã§ã¯ã€ãŠå®¢æ§˜ã®æƒ…å ±ä¿è·ã‚’ç¬¬ä¸€ã«è€ƒãˆã€é€šä¿¡ã®å®‰å…¨æ€§ã‚’ç¢ºä¿ã™ã‚‹ãŸã‚ã«ã€å¼Šç¤¾ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã«ãŠã‘ã‚‹ã€ŒTLS1.0/1.1ã€ã‚’ç„¡åŠ¹åŒ–ã™ã‚‹ã“ã¨ã¨ã„ãŸã—ã¾ã—ãŸã€‚ ã“ã‚Œã«ã‚ˆã‚Šã€ä¸€éƒ¨ã®ç«¯æœ«ã‚„ãƒ–ãƒ©ã‚¦ã‚¶ï¼ˆã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆé–²è¦§ã‚½ãƒ•ãƒˆï¼‰ã‹ã‚‰ã¯ã€ã‚µã‚¤ãƒˆã®é–²è¦§ãŠã‚ˆã³ã‚µãƒ¼ãƒ“ã‚¹ã®åˆ©ç”¨ãŒã§ããªããªã‚Šã¾ã™ã®ã§ã”ç¢ºèªãã ã•ã„ã€‚ â– å½±éŸ¿ãŒã‚ã‚‹ä¸»ãªã”åˆ©ç”¨ç’°å¢ƒ ãƒ»ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ iOS4ä»¥å‰ã€ãŠã‚ˆã³Android 4.4ä»¥å‰ã®ç«¯æœ«ã«ãŠã‘ã‚‹æ¨™æº–ãƒ–ãƒ©ã‚¦ã‚¶ç’°å¢ƒ ãƒ»ãƒ‘ã‚½ã‚³ãƒ³ Internet Explorer 10.0 ä»¥å‰ã®ãƒ–ãƒ©ã‚¦ã‚¶ç’°å¢ƒ â– å¯¾è±¡ãƒšãƒ¼ã‚¸ å¼Šç¤¾å…¬å¼ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸å†…ã®ã€ã€Œhttpsã€ã§å§‹ã¾ã‚‹ã‚¢ãƒ‰ãƒ¬ã‚¹ã®Webãƒšãƒ¼ã‚¸ï¼ˆMy Starb
InoHiro 2017/09/07
ã‹ã£ã“ã„ã„

security
ãƒªãƒ³ã‚¯
ãƒ–ãƒ©ã‚¦ã‚¶ã®è„†å¼±æ€§ã¨ãã®ã‚¤ãƒ³ãƒ‘ã‚¯ãƒˆ
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»ã‚ãƒ£ãƒ³ãƒ—å…¨å›½å¤§ä¼š2017ã®è¬›ç¾©è³‡æ–™ã§ã™ï¼ˆMasato Kinugawaã•ã‚“ã¨ã®å…±åŒåˆ¶ä½œã§ã™ï¼‰ã€‚
InoHiro 2017/08/16
security
ãƒªãƒ³ã‚¯
npmjs.com ã§è‘—åã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã«ã‚ˆãä¼¼ãŸåå‰ã®ãƒžãƒ«ã‚¦ã‚§ã‚¢ãŒå¤§é‡ã«ç™ºè¦‹ã•ã‚ŒãŸ - Islands in the byte stream
Malicious packages in npm. Hereâ€™s what to do | Ivan Akulovâ€™s blog People found malicious packages in npm that work like real ones, are named similarly real ones, but collect and send your process environment to a third-party server when you install them è¨³: æ‚ªæ„ã®ã‚ã‚‹ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ãŒnpmã§ç™ºè¦‹ã•ã‚ŒãŸã€‚ãã‚Œã‚‰ã¯ã€å®Ÿéš›ã®ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã«ã‚ˆãä¼¼ãŸåå‰ã§åŒã˜ã‚ˆã†ã«å‹•ããŒã€ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«æ™‚ã«ãƒ—ãƒã‚»ã‚¹ã®ç’°å¢ƒå¤‰æ•°ã‚’å¤–éƒ¨ã®ã‚µãƒ¼ãƒã«é€ä¿¡ã™ã‚‹ã€‚ ç™ºè¦‹ã•ã‚ŒãŸãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã®ä¸€è¦§ã¯å…ƒã‚¨ãƒ³ãƒˆãƒªã‚’ã©ã†ãžã€‚ã“ã®ã‚ˆã†ãªãƒžãƒ«ã‚¦ã‚§ã‚¢ã§ã‚ã‚‹å½ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã®ä¸€ä¾‹ã‚’ã‚ã’ã‚‹ã¨ã€ ba
InoHiro 2017/08/03
nodejs

npm

security
ãƒªãƒ³ã‚¯
1 2 3 4 5 6 7 æ¬¡ã®ãƒšãƒ¼ã‚¸