[B! security] dobocchoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

doboccho id:doboccho

securityã«é–¢ã™ã‚‹dobocchoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (17)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãã®ãµã‚ˆã‚Šã‘ãµã€ã‘ãµã‚ˆã‚Šã‚ã—ãŸã€€ã€Javaã€‘Oracle11g ã®JDBCãƒ‰ãƒ©ã‚¤ãƒãƒ¼ã§ã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³å–å¾—ãŒå¤±æ•—ã™ã‚‹ã€JDBCã€‘
ã€Javaã€‘Oracle11g ã®JDBCãƒ‰ãƒ©ã‚¤ãƒãƒ¼ã§ã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³å–å¾—ãŒå¤±æ•—ã™ã‚‹ã€JDBCã€‘ 2010-03-24 02:21:00 Wed â– å•é¡Œ Oracle11g ã®JDBCãƒ‰ãƒ©ã‚¤ãƒã‚’ä½¿ç”¨ã—ã¦ã‚³ãƒã‚¯ã‚·ãƒ§ãƒ³ã‚’å–å¾—ã™ã‚‹ã¨å˜ç™ºå‡ºã‚Œã°æˆåŠŸã™ã‚‹ã€‚ ã ãŒã€è¤‡æ•°å›žé€£ç¶šå®Ÿè¡Œã™ã‚‹ã¨å–å¾—ã§ããšã« IOException ã§å¤±æ•—ã—ã¦ã—ã¾ã†ã€‚ â– ç’°å¢ƒï¼ˆã–ã£ãã‚Šï¼‰ OSÂ Â Â Â Â Â ï¼šÂ CentOS JDKÂ Â Â Â ï¼šÂ OpenJDKÂ 1.6 OracleÂ ï¼šÂ OracleÂ 11g â– è§£æ±ºæ–¹æ³• # ãƒ†ã‚ã‚¹ãƒˆ ã‚¨ãƒ‡ã‚£ã‚¿ã‚’ä½¿ç”¨ã—ã¦ $JAVA_HOME/jre/lib/security/java.security ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é–‹ãã¾ã™ã€‚ # ä»¥ä¸‹ã®è¡Œã‚’ç·¨é›†ã—ã¾ã™ã€‚ securerandom.source=file:/dev/random ä»¥ä¸‹ã®ã‚ˆã†ã«å¤‰æ›´ã—ã¾ã™ã€‚ securerandom.source=file:/de
doboccho 2015/08/11
Oracle

security

Java

jdbc
ãƒªãƒ³ã‚¯
Struts1ã®è„†å¼±æ€§å•é¡Œã®å¯¾å‡¦æ–¹æ³• - ã‚¨ãƒ³ã‚¿ãƒ¼ãƒ—ãƒ©ã‚¤ã‚ºã‚®ãƒ¼ã‚¯ã‚¹ (Enterprise Geeks)
Apache Struts 1ã®è„†å¼±æ€§å•é¡Œã®å¯¾å‡¦æ–¹æ³•ã‚’ç´¹ä»‹ã™ã‚‹ã€‚ ã“ã®å•é¡Œã¯ã€4æœˆ24æ—¥ã«æ ªå¼ä¼šç¤¾ãƒ©ãƒƒã‚¯ã«ã‚ˆã£ã¦ä»¥ä¸‹ã®ã‚ˆã†ã«å ±å‘Šã•ã‚ŒãŸã€‚ http://www.lac.co.jp/security/alert/2014/04/24_alert_01.html ServletFilterã«ã‚ˆã‚‹å¯¾å‡¦ã§ã¯ã€multipart/form-dataã«å¯¾å¿œã§ããªã„ã€‚ ä¸Šè¨˜å ±å‘Šã«è¨˜è¼‰ã•ã‚Œã¦ã„ã‚‹ ä¸æ£ãªæ–‡å—åˆ—ãŒãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ã«å«ã¾ã‚Œã‚‹å ´åˆï¼ˆæ£è¦è¡¨ç¾ï¼šã€Œ(^|\W)[cC]lass\Wã€ã«åˆè‡´ã™ã‚‹ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿åãŒå«ã¾ã‚Œã‚‹å ´åˆç‰ï¼‰ã«ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’æ‹’å¦ã™ã‚‹ãƒ•ã‚£ãƒ«ã‚¿æ©Ÿèƒ½ã‚’å®Ÿè£…ã™ã‚‹ ã¨ã„ã†æ–¹æ³•ã¯ã€ãƒªã‚¹ã‚¯è»½æ¸›ç–ã¨ã—ã¦ã¯æœ‰åŠ¹ã ã€‚ ã—ã‹ã—æ®‹å¿µãªãŒã‚‰ã€ServletFilterã§å¯¾å¿œã™ã‚‹ã“ã®æ–¹æ³•ã§ã¯ enctype="multipart/form-data" ã§ã‚ã‚‹ã‚µãƒ–ãƒŸãƒƒãƒˆæƒ…å ±ãŒæ¥ãŸå ´åˆã¯é˜²ãã“ã¨ãŒã§ããªã„ã€‚ å•é¡Œã®æœ¬è³ª Str
doboccho 2014/05/02
â€œå¯¾ã™ã‚‹ã‚¢ã‚¯ã‚»ã‚¹ã‚’åˆ¶é™ã™ã‚‹ã“ã¨ãŒã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã«ã¯é‡è¦ã¨ãªã‚‹ã€‚â€

struts

java

security
ãƒªãƒ³ã‚¯
Strutsã®è„†å¼±æ€§CVE-2014-0094ã«ã¤ã„ã¦æ”¹ã‚ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
Struts2ã«ãŠã„ã¦ã‚¯ãƒ©ã‚¹ãƒãƒ¼ãƒ€ãƒ¼ã®æ“ä½œã‚’è¨±ã—ã¦ã—ã¾ã†è„†å¼±æ€§(CVE-2014-0094)ã«ã¤ã„ã¦å…ˆæ—¥èª¿ã¹ãŸã®ã§ã™ãŒã€ãã®å¾Œã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ™ãƒ³ãƒ€ã®èª¿æŸ»ã«ã‚ˆã‚Šå½“åˆã«æ¯”ã¹ã¦å½±éŸ¿ç¯„å›²ãŒå¤‰ã‚ã£ã¦ãã¦ã„ã‚‹ã“ã¨ã‹ã‚‰ã€å†åº¦æ•´ç†ã‚’ã‹ãã¦ã¾ã¨ã‚ã¾ã™ã€‚å°šã€ã“ã‚Œã‚‰æƒ…å ±ã¯piyokangoãŒå…¨ã¦æ¤œè¨¼ã—ãŸã‚ã‘ã§ã¯ãªã„ãŸã‚ã”æ³¨æ„ãã ã•ã„ã€‚ã¾ãŸå½“ç„¶ãªãŒã‚‰æ‚ªç”¨ã™ã‚‹ã“ã¨ã¯åŽ³ç¦ã§ã™ã€‚ Apache Software Foundationã‚ˆã‚Šã€å½“è©²è„†å¼±æ€§æƒ…å ±ã«é–¢ã™ã‚‹ã‚¢ãƒŠã‚¦ãƒ³ã‚¹ãŒå‡ºã¾ã—ãŸã€‚ 24 April 2014 - Struts up to 2.3.16.1: Zero-Day Exploit Mitigation S2-021 ã‚¯ãƒ©ã‚¹ãƒãƒ¼ãƒ€ãƒ¼ãŒæ“ä½œã•ã‚Œã‚‹è„†å¼±æ€§ã®å½±éŸ¿ç¯„å›² NTT-CERTã‚„MBSDã€LACã®èª¿æŸ»ã«ã‚ˆã‚Šæ¬¡ã®Strutsã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ãŒå½±éŸ¿ã‚’å—ã‘ã‚‹ã“ã¨ãŒåˆ¤æ˜Žã—ã¦ã„ã¾ã™ã€‚ã¾ãŸBeanUtilsã‚’ä½¿ã£ã¦ãƒªã‚¯ã‚¨ã‚¹ãƒˆ
doboccho 2014/04/26
struts

Java

Security

CVE-2014-0094
ãƒªãƒ³ã‚¯
Struts1è„†å¼±æ€§ã®æ¤œè¨¼ [S2-020]
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
doboccho 2014/04/25
struts

Java

security
ãƒªãƒ³ã‚¯
IPAãŒæ³¨æ„å–šèµ·ã‚’ã—ãŸApache Struts2ã®è„†å¼±æ€§CVE-2014-0094ã«ã¤ã„ã¦èª¿ã¹ã¦ã¿ãŸã€‚ - piyolog
Apache Struts2ã®è„†å¼±æ€§ã«ã¤ã„ã¦IPAãŒæ³¨æ„å–šèµ·ã‚’4æœˆ17æ—¥ã«æŽ²è¼‰ã—ã¾ã—ãŸã€‚ Apache Struts2 ã®è„†å¼±æ€§å¯¾ç–ã«ã¤ã„ã¦(CVE-2014-0094)(S2-020) Apache Struts 2 Documentation S2-020 ãƒ‹ãƒ¥ãƒ¼ã‚¹ - Apache Struts 2ã®è„†å¼±æ€§å¯¾ç–ãŒæ€¥å‹™ã€æ”»æ’ƒãƒ—ãƒã‚°ãƒ©ãƒ ãŒå‡ºå›žã‚‹ï¼šITpro Apache Struts2ã«è„†å¼±æ€§æ”»æ’ƒã®æã‚Œã€IPAãŒç·Šæ€¥å‹§å‘Š - ITmedia ã‚¨ãƒ³ã‚¿ãƒ¼ãƒ—ãƒ©ã‚¤ã‚º æ¤œè¨¼ã‚³ãƒ¼ãƒ‰ãŒæ—¢ã«ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã§å…¬é–‹ã•ã‚Œã¦ã„ã‚‹ã“ã¨ã€ãã—ã¦æ‚ªç”¨ãŒæ¯”è¼ƒçš„å®¹æ˜“ã§ã‚ã‚‹ã“ã¨ã‹ã‚‰ã€ã“ã“ã§ã¯S2-020ã®ClassLoaderãŒæ“ä½œã•ã‚Œã¦ã—ã¾ã†è„†å¼±æ€§CVE-2014-0094ã«ã¤ã„ã¦èª¿ã¹ãŸçµæžœã‚’ã¾ã¨ã‚ã¾ã™ã€‚ ï¼‘ï¼Žæ¤œè¨¼ç’°å¢ƒã®æº–å‚™ æ¤œè¨¼ã«ã‚ãŸã‚Šã€Apache Struts2ã®ç’°å¢ƒã®ãƒ¡ãƒ¢ã§ã™ã€‚Struts2ã‚’å‹•ã‹ã™ã ã‘ã§ã‚ã‚Œã°
doboccho 2014/04/20
apache

Struts2

security

Java
ãƒªãƒ³ã‚¯
Webã‚¢ãƒ—ãƒªé–‹ç™ºè€…ã®ãŸã‚ã®HTML5ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å…¥é–€
Enterprise x HTML5 Web Application Conference 2014ã®ç™ºè¡¨è³‡æ–™ã§ã™ã€‚Read less
doboccho 2014/02/28
HTML5

JavaScript

Security
ãƒªãƒ³ã‚¯
Spring Securityã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’å¼·åŒ–ã™ã‚‹ #2 - m-namikiã®æ—¥è¨˜
å‰å›žã®è¨˜äº‹ã§ã¯ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã®ãƒãƒƒã‚¯ã‚¢ã‚¦ãƒˆã«ã¤ã„ã¦è€ƒãˆã¦ã¿ã¾ã—ãŸã€‚ä»Šå›žã¯ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®Saltå¯¾å¿œã«ã¤ã„ã¦è€ƒãˆã¦ã¿ã¾ã™ã€‚ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®Saltã«ã¤ã„ã¦ã§ã™ãŒã€ä»Šå›žã¯åˆ†ã‹ã‚Šã‚„ã™ãã™ã‚‹ãŸã‚ã«ãƒ¦ãƒ¼ã‚¶IDã‚’ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«è¿½åŠ ã—ãŸã‚‚ã®ã‚’ãƒãƒƒã‚·ãƒ¥åŒ–ã™ã‚‹ã€ã¨ã„ã†æ–¹æ³•ã‚’æŽ¡ã‚Šã¾ã™ã€‚ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä¿è·ã™ã‚‹å ´åˆã®æ–¹æ³•ã«ã¤ã„ã¦ã¯ã€ã“ã¡ã‚‰ã®ãƒšãƒ¼ã‚¸ãŒåˆ†ã‹ã‚Šã‚„ã™ã„ã‹ã¨ã€‚ æœ¬å½“ã¯æ€–ã„ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®è©±ï¼ˆ1/4ï¼‰ âˆ’ ï¼ IT SpringSecurityã§ã¯ã€Saltã‚’ãƒ¦ãƒ¼ã‚¶æƒ…å ±ã®ãƒ—ãƒãƒ‘ãƒ†ã‚£ã‹ã‚‰å–ã‚‹ã‹ã€ã‚·ã‚¹ãƒ†ãƒ ã§å…±é€šã®å€¤ã‚’å–ã‚‹ã‹ã‚’æŒ‡å®šã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ Saltã‚’ãƒ¦ãƒ¼ã‚¶æƒ…å ±ã®ãƒ—ãƒãƒ‘ãƒ†ã‚£ã‹ã‚‰å–å¾—ã™ã‚‹å ´åˆã¯ä»¥ä¸‹ã®ã‚ˆã†ã«è¨˜è¿°ã—ã¾ã™ã€‚ <authentication-manager> <authentication-provider user-service-ref="myUserDetailsService"> <password-enc
doboccho 2013/06/03
spring

security

Spring Security
ãƒªãƒ³ã‚¯
å®‰å…¨ãªã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã‚’å®Ÿç¾ã™ã‚‹ãŸã‚ã« â€• ï¼ IT
HTTPã‚’ä½¿ç”¨ã—ãŸWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã„ã¦ã€å®‰å…¨ãªã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã‚’è¡Œã†ã“ã¨ã¯é›£ã—ã„å•é¡Œã§ã‚ã‚‹ã€‚ã‚¿ãƒ–ãƒ–ãƒ©ã‚¦ã‚¶ã«ã‚ˆã‚‹ç”»é¢ã®è¤‡æ•°èµ·å‹•ã‚„ã€Webãƒ–ãƒ©ã‚¦ã‚¶ã®æˆ»ã‚‹ãƒœã‚¿ãƒ³ï¼æ›´æ–°ãƒœã‚¿ãƒ³ã®æŠ¼ä¸‹ã¨ã„ã£ãŸã€äºˆæœŸã—ãªã„ç”»é¢é·ç§»ã«èµ·å› ã™ã‚‹ãƒã‚°ã®ç™ºç”Ÿã«é ã‚’æ‚©ã¾ã›ã‚‹ã“ã¨ã¯å¤šã„ã ã‚ã†ã€‚ å¤§ããªå•é¡ŒãŒç™ºç”Ÿã—ãªã„ãªã‚‰ã°ã€ç”»é¢é·ç§»ã®ä»•æ§˜ä¸Šã®åˆ¶é™ã‚’ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã«è¨±å®¹ã—ã¦ã‚‚ã‚‰ã†é¸æŠžè‚¢ã‚‚ã‚ã‚‹ã ã‚ã†ãŒã€ä¸æ£ãªç”»é¢é·ç§»ã‚’åˆ©ç”¨ã—ãŸã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ›ãƒ¼ãƒ«ãŒå˜åœ¨ã™ã‚‹ãªã‚‰ã°ã€æ”¾ç½®ã—ã¦ãŠã„ã¦ã‚ˆã„å•é¡Œã§ã¯ãªããªã‚‹ã€‚ä»Šå›žã¯ã‚»ãƒƒã‚·ãƒ§ãƒ³ç®¡ç†ã‚’å®‰å…¨ã«è¡Œã†ãŸã‚ã®åŸºæœ¬çš„ãªæ³¨æ„ç‚¹ã«ã¤ã„ã¦è§£èª¬ã—ã¦ã„ã“ã†ã€‚ ã‚»ãƒƒã‚·ãƒ§ãƒ³å›ºå®šæ”»æ’ƒã¨ã¯ä½•ã‹ ã‚»ãƒƒã‚·ãƒ§ãƒ³å›ºå®šæ”»æ’ƒï¼ˆSession Fixationï¼‰ã¨ã„ã†è„†å¼±æ€§ã‚’è€³ã«ã—ãŸã“ã¨ã¯ã‚ã‚‹ã ã‚ã†ã‹ã€‚è„†å¼±æ€§ãã®ã‚‚ã®ã®è©³ã—ã„è§£èª¬ã¯æœ¬ç¨¿ã®è¶£æ—¨ã§ã¯ãªã„ãŸã‚å‰²æ„›ã™ã‚‹ãŒã€ç°¡æ½”ã«èª¬æ˜Žã™ã‚‹ã¨ã€ä»¥ä¸‹ã®ã‚ˆã†ãªæ‰‹é †ã‚’è¸ã‚€ã“ã¨ã«ã‚ˆã‚Šã‚»ãƒƒã‚·ãƒ§ãƒ³æƒ…å ±ãŒãƒã‚¤ã‚¸ãƒ£
doboccho 2013/05/08
è§£èª¬

http

security
ãƒªãƒ³ã‚¯
Java Tips - Using JAX-WS-Based Web Services with SSL
This Tech Tip reprinted with permission by java.sun.com In Java EE 5, a web service that is based on JAX-WS can be implemented either as an EJB endpoint or servlet endpoint. An example of a JAX-WS-based web service implemented as an EJB endpoint is provided in the Tech Tip Developing Web Services Using EJB 3.0. A JAX-WS-based web service implemented as a servlet endpoint is provided in the Tech T
doboccho 2012/10/12
JAX-WS

security
ãƒªãƒ³ã‚¯
Tomcat 7ã‚‚å¯¾å¿œã—ãŸServlet 3.0ã®å¤‰æ›´ç‚¹ å¾Œç·¨
Tomcat 7ã‚‚å¯¾å¿œã—ãŸServlet 3.0ã®å¤‰æ›´ç‚¹ å¾Œç·¨ï¼šTomcat 7ã®æ–°æ©Ÿèƒ½ã§ä½•ãŒã§ãã‚‹ã‚ˆã†ã«ãªã‚‹ã®ã‹ï¼Ÿï¼ˆ2ï¼‰ï¼ˆ2/3 ãƒšãƒ¼ã‚¸ï¼‰ èªè¨¼ç”¨APIã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£åˆ¶ç´„ã®è¿½åŠ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾å¿œã«ã¤ã„ã¦ã¯èªè¨¼ç”¨APIã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£åˆ¶ç´„ã®è¿½åŠ ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ â– èªè¨¼ç”¨APIã®è¿½åŠ Servlet 3.0ã‹ã‚‰Servlet APIã«ä»¥ä¸‹ã®èªè¨¼ç”¨ãƒ¡ã‚½ãƒƒãƒ‰ãŒè¿½åŠ ã•ã‚Œã¾ã—ãŸã€‚ HttpServletRequest#login(String username, String password) HttpServletRequest#logout() HttpServletRequest#authenticate(HttpServletResponse response) ä¸Šè¨˜ãƒ¡ã‚½ãƒƒãƒ‰ã‚’åˆ©ç”¨ã™ã‚‹ã¨æ¨™æº–ã®Servlet APIã‚’åˆ©ç”¨ã—ã¦ç‹¬è‡ªã®èªè¨¼ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’ä½œæˆã§ãã¾ã™ã€‚ èªè¨¼ãƒ¡ã‚½ãƒƒãƒ‰ã¯ã€Œlogi
doboccho 2012/07/06
Tomcat

security
ãƒªãƒ³ã‚¯
ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚° : å†éŒ²ï¼šãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯æœ¬å½“ã«SHA-1+saltã§ååˆ†ã ã¨æ€ã„ã¾ã™ã‹ï¼Ÿ
å†éŒ²ï¼šãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯æœ¬å½“ã«SHA-1+saltã§ååˆ†ã ã¨æ€ã„ã¾ã™ã‹ï¼Ÿ 2012å¹´06æœˆ07æ—¥19:05 ãƒ„ã‚¤ãƒ¼ãƒˆ sean_sullivan ãƒ˜ãƒ«ã‚·ãƒ³ã‚ç™ºÂ byï¼šã‚·ãƒ§ãƒ¼ãƒ³ãƒ»ã‚µãƒªãƒãƒ³ æ˜¨æ—¥ã€ä¸€éƒ¨ãƒ¡ãƒ³ãƒãƒ¼ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«éšœå®³ãŒèµ·ããŸã¨ã„ã†å ±é“ã‚’ã€LinkedInãŒèªã‚ãŸã€‚ ä»¥ä¸‹ã¯å½¼ã‚‰ã®ãƒ–ãƒã‚°ã‹ã‚‰ã®æƒ…å ±ã ï¼š ã€Œæˆ‘ã€…ãŒå…ˆé ƒå°Žå…¥ã—ãŸå¼·åŒ–ç‰ˆã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã«ã¯ã€ç¾è¡Œã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®ãƒãƒƒã‚·ãƒ¥ã¨saltãŒå«ã¾ã‚Œã¦ãŠã‚Šã€ä»Šå›žã®å½±éŸ¿ã§ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å¤‰æ›´ã™ã‚‹ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ã‚‚ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«éšœå®³ãŒèµ·ãã¦ã„ãªã„ãƒ¡ãƒ³ãƒãƒ¼ã«ã‚‚åˆ©ç›Šã‚’ä¸Žãˆã‚‹ã ã‚ã†ã€‚ã€ ãƒãƒƒã‚·ãƒ¥ã¨saltï¼Ÿ ãã‚Œã§ååˆ†ãªã®ã‹ï¼Ÿã€€ãã‚Œã¯ä»¥ä¸‹ã®å†éŒ²è¨˜äº‹ï¼ˆã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã‚’å«ã‚€ï¼‰ã§ã€æ˜¨å¹´ã€ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ã®ã‚¸ãƒ£ãƒ«ãƒŽãƒ»ãƒãƒ¡ãƒ©ãŒå‘ˆã—ãŸç–‘å•ã ã€‚ â€”â€”â€”â€”â€” ã‚¢ãƒŠãƒ¼ã‚ãƒ¼ãªã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚°ãƒ«ãƒ¼ãƒ—ã€ŒAnonymousã€ãŒå…ˆé ƒã€HBGary Federalã¨ãƒ«ãƒ¼ãƒˆã‚ãƒƒãƒˆãƒ†ã‚¯ãƒŽãƒã‚¸ã®åˆ†æž
doboccho 2012/06/13
security
ãƒªãƒ³ã‚¯
Javaã§ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®ãƒãƒƒã‚·ãƒ¥åŒ–: PBKDF2 - penultã®æ—¥è¨˜
ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚° : å†éŒ²ï¼šãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã¯æœ¬å½“ã«SHA-1+saltã§ååˆ†ã ã¨æ€ã„ã¾ã™ã‹ï¼Ÿ ã«æœ›ã¾ã—ã„ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®ãƒãƒƒã‚·ãƒ¥åŒ–æ–¹æ³•ã«ã¤ã„ã¦å…·ä½“çš„ã«è¼‰ã£ã¦ã„ãŸã®ã§ã€Javaã§ã©ã‚“ãªæ„Ÿã˜ã«ãªã‚‹ã®ã‹ç¢ºèªã—ã¦ã¿ã‚‹ã€‚ ä½¿ã†ã®ã¯ç¾åœ¨ä¸€å¿œå®‰å…¨ã ã¨èªã‚ã‚‰ã‚Œã¦ã„ã‚‹ã£ã½ã„ã‚‚ã®ã§ã€Oracle JDKã«ã‚‚æ¨™æº–ã§å«ã¾ã‚Œã¦ã„ã‚‹ PBKDF2 *1 ã¨ã„ã†æ–¹å¼ã€‚Wikipedia ã«ã‚ˆã‚‹ã¨è‰²ã€…ãªãƒ—ãƒãƒ€ã‚¯ãƒˆã§ã‚‚ä½¿ã‚ã‚Œã¦ã„ã‚‹ã‚ˆã†ã ã€‚ ãƒ†ã‚¹ãƒˆ package example; import java.security.NoSuchAlgorithmException; import java.security.SecureRandom; import java.security.spec.InvalidKeySpecException; import java.security.spec.KeySpec; import ja
doboccho 2012/06/13
Java

security
ãƒªãƒ³ã‚¯
Preventing CSRF with JSF 2.0
Have you ever had the need for higher security in one of your applications? Than you are probably familiar with the following topic. If not, I am going to tell you a little bit about attacks and web application security before we move over to implement a CSRF prevention approach with JSF 2.0. What is Application Security? And why should I care? Have you ever heard about attacks? Attacks are the te
doboccho 2012/05/16
JSF

security
ãƒªãƒ³ã‚¯
ãƒ‘ãƒ¼ãƒŸãƒƒã‚·ãƒ§ãƒ³ã‚’ä¸€åˆ‡è¦æ±‚ã—ãªã„Androidã‚¢ãƒ—ãƒªãŒãƒ‡ãƒ¼ã‚¿ã‚’å¤–éƒ¨ã«é€ä¿¡ã™ã‚‹å¯èƒ½æ€§ | ã‚¹ãƒ©ãƒ‰ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
Androidã‚¢ãƒ—ãƒªã«ã¯ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯æŽ¥ç¶šã‚„å€‹äººæƒ…å ±ãƒ‡ãƒ¼ã‚¿ã®èªã¿å–ã‚Šã€ã‚¹ãƒˆãƒ¬ãƒ¼ã‚¸ã¸ã®æ›¸ãè¾¼ã¿ãªã©ã®å‡¦ç†ã«å¯¾ã™ã‚‹ãƒ‘ãƒ¼ãƒŸãƒƒã‚·ãƒ§ãƒ³è¨å®šãŒã‚ã‚Šã€ãƒ‘ãƒ¼ãƒŸãƒƒã‚·ãƒ§ãƒ³è¦æ±‚ã®è¨å®šã•ã‚Œã¦ã„ãªã„ã‚¢ãƒ—ãƒªã§ã¯è©²å½“ã™ã‚‹ãƒªã‚½ãƒ¼ã‚¹ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ãŒã§ããªã„ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ã€‚ã—ã‹ã—ã€ãƒ‘ãƒ¼ãƒŸãƒƒã‚·ãƒ§ãƒ³è¦æ±‚ã‚’ä¸€åˆ‡ã—ãªã„ã‚¢ãƒ—ãƒªã§ã‚ã£ã¦ã‚‚ã€çŠ¶æ³ã«ã‚ˆã£ã¦å€‹äººãƒ‡ãƒ¼ã‚¿ã‚’èªã¿å–ã£ã¦ã‚µãƒ¼ãƒãƒ¼ã«é€ä¿¡ã§ãã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã“ã¨ã‚’Leviathan Security GroupãŒæŒ‡æ‘˜ã—ã¦ã„ã‚‹(Leviathan Security Groupã®ãƒ–ãƒã‚°è¨˜äº‹ã€ CNN.comã®è¨˜äº‹)ã€‚ ãŸã¨ãˆã°ã€SDã‚«ãƒ¼ãƒ‰ã«ã¯ã•ã¾ã–ã¾ãªãƒ‡ãƒ¼ã‚¿ãŒä¿å˜ã•ã‚Œã‚‹ã®ã«ã‚‚é–¢ã‚ã‚‰ãšã€èªã¿å–ã‚Šã«ã¤ã„ã¦ã¯ãƒ‘ãƒ¼ãƒŸãƒƒã‚·ãƒ§ãƒ³è¨å®šãŒå˜åœ¨ã—ãªã„ã€‚ãã®ãŸã‚ã€æš—å·åŒ–ã•ã‚Œã¦ã„ãªã„æƒ…å ±ã¯ä»»æ„ã®ã‚¢ãƒ—ãƒªã§èªã¿å–ã‚Œã‚‹ã€‚æœ¬ä½“ãƒ¡ãƒ¢ãƒªãƒ¼ã«ãƒ‡ãƒ¼ã‚¿ã‚’ä¿å˜ã™ã‚‹å ´åˆã‚‚ã€ã‚¢ãƒ—ãƒªãŒé©åˆ‡ãªã‚¢ã‚¯ã‚»ã‚¹è¨±å¯ã‚’è¨å®šã—ã¦ã„ãªã‘ã‚Œã°ã€ä»–ã®ã‚¢ãƒ—ãƒªã‹ã‚‰èªã¿
doboccho 2012/05/01
security

android
ãƒªãƒ³ã‚¯
http://www.machu.jp/posts/20060507/p01/
doboccho 2012/04/25
security

èªè¨¼

hmac
ãƒªãƒ³ã‚¯
Bugtraq
doboccho 2012/04/25
Java

java7

Security
ãƒªãƒ³ã‚¯
ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ã‚’åŒºåˆ¥ã™ã‚‹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ - Android Zaurusã®æ—¥è¨˜
å…¬å¼ãƒ–ãƒã‚°ã®ã‚¨ãƒ³ãƒˆãƒªã€ŒInstallations Identifying Appã€ã‚’ã¯ã¦ãƒ–ã®twitteré€£æºä½¿ã£ã¦æŠ•ã’ãŸã‚‰ã€ãªã‚“ã‹ã™ã”ã„å‹¢ã„ã§ã‚¯ãƒªãƒƒã‚¯ã•ã‚ŒãŸã¿ãŸã„ãªã®ã§è¨³ã—ã¦ã¿ãŸã€‚èª¤è¨³ã¨ã‹ã‚ã£ãŸã‚‰æ•™ãˆã¦ã€‚ ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ã‚’åŒºåˆ¥ã™ã‚‹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ Tim BrayãŒæŠ•ç¨¿ ã“ã®æŠ•ç¨¿ã®å†…å®¹ã¯ã€æœ¬ãƒ–ãƒã‚°ã®åŸ·ç†è€…ãŸã¡ãŒã„ã¤ã‚‚ä¸æ€è°ã«æ„Ÿã˜ã¦ã„ã‚‹ã“ã¨ã«ã¤ã„ã¦å†…éƒ¨ã§ã®è°è«–ã‹ã‚‰ç”Ÿã¾ã‚Œã¾ã—ãŸ Androidã®ã‚°ãƒ«ãƒ¼ãƒ—ã§ã¯ã€ä¿¡é ¼ã§ãå®‰å®šã—ãŸç«¯æœ«è˜åˆ¥åã‚’å–å¾—ã™ã‚‹ã®ã«å•é¡ŒãŒã‚ã‚‹ã¨ã„ã†ä¸æº€ã‚’é–‹ç™ºè€…ã‹ã‚‰æ™‚æŠ˜èžãã€‚ã“ã‚Œã¯ç§ãŸã¡ã‚’å°‘ã—ä¸å®‰ã«ã•ã›ã‚‹ã€‚ãªãœãªã‚‰ã€ãã®ã‚ˆã†ãªè˜åˆ¥åã‚’è¿½è·¡ã™ã‚‹ã“ã¨ã¯è‰¯ã„ã‚¢ã‚¤ãƒ‡ã‚£ã‚¢ã§ã¯ãªã„ã¨è€ƒãˆã‚‹ã—ã€é–‹ç™ºè€…ã®ç›®çš„ã‚’é”æˆã™ã‚‹ã®ã«ã‚ˆã‚Šè‰¯ã„æ–¹æ³•ãŒã‚ã‚‹ã‹ã‚‰ã ã€‚ ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ã‚’è¿½è·¡ é–‹ç™ºè€…ãŒã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ã‚’å€‹åˆ¥ã«è¿½è·¡ã—ãŸã„ã¨è€ƒãˆã‚‹ã®ã¯ä¸€èˆ¬çš„ã ã—ã€å®Œå…¨ã«ç†ã«ã‹ãªã£ã¦ã„ã‚‹ã€‚
doboccho 2012/04/19
android

Security
ãƒªãƒ³ã‚¯
1