[B! WannaCry] hogetahogekoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

hogetahogeko id:hogetahogeko

WannaCryã«é–¢ã™ã‚‹hogetahogekoã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (12)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒœãƒ¼ã‚¤ãƒ³ã‚°ã«ã€ŒWannaCryã€ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢è¢«å®³ã¨å ±é“--å½±éŸ¿ã¯é™å®šçš„
The Seattle Timesã«ã‚ˆã‚‹ã¨ã€BoeingãŒç±³å›½æ™‚é–“3æœˆ28æ—¥ã€ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢ã€ŒWannaCryã€ã®è¢«å®³ã«éã„ã€è£½é€ ã¸ã®å½±éŸ¿ãŒä¸€æ™‚æ‡¸å¿µã•ã‚ŒãŸãŒã€åŒç¤¾ã¯å¾Œã«è£½é€ ã¸ã®å½±éŸ¿ã¯ãªã„ã¨ã®å£°æ˜Žã‚’å‡ºã—ãŸã€‚ The Seattle Timesã«ã‚ˆã‚‹ã¨ã€ä»Šå›žã®æ„ŸæŸ“ã¯ã€Boeing Commercial Airplaneã®è£½é€ ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒªãƒ³ã‚°éƒ¨é–€ã§ãƒãƒ¼ãƒ•ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã‚’å‹™ã‚ã‚‹Mike VanderWelæ°ãŒé€ä¿¡ã—ãŸãƒ¡ãƒ¢ã®ä¸ã§æ˜Žã‹ã•ã‚Œã€VanderWelæ°ã¯ã€Œå…¨å“¡ã®å”åŠ›ã€ã‚’æ±‚ã‚ãŸã¨ã„ã†ã€‚ VanderWelæ°ã¯ã€ã€Œãã‚Œã¯ãƒŽãƒ¼ã‚¹ãƒãƒ£ãƒ¼ãƒ«ã‚¹ãƒˆãƒ³ã‹ã‚‰æ€¥é€Ÿã«æ‹¡æ•£ã—ã¦ã„ã‚‹ã€‚ç§ã¯å…ˆã»ã©ã€ã€Ž777ã€ï¼ˆè‡ªå‹•åŒ–ã•ã‚ŒãŸæ¡çµ„ã¿ç«‹ã¦ãƒ„ãƒ¼ãƒ«ï¼‰ãŒåœæ¢ã—ãŸå¯èƒ½æ€§ãŒã‚ã‚‹ã¨ã„ã†è©±ã‚’è€³ã«ã—ãŸã€ã¨è¿°ã¹ã€ã“ã®ã‚¦ã‚¤ãƒ«ã‚¹ãŒé£›è¡Œæ©Ÿã®æ©Ÿèƒ½æ€§ãƒ†ã‚¹ãƒˆã§ä½¿ã‚ã‚Œã‚‹æ©Ÿå™¨ã«å½±éŸ¿ã‚’åŠã¼ã—ã€ã€Œé£›è¡Œæ©Ÿã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¾ã§åºƒã¾ã‚‹ã€å¯èƒ½æ€§ã‚’æ‡¸å¿µã—ã¦ã„ã‚‹ã¨ä¼ãˆãŸã€‚ Boei
hogetahogeko 2018/03/29
ã€Œã€Ž777ã€ï¼ˆè‡ªå‹•åŒ–ã•ã‚ŒãŸæ¡çµ„ã¿ç«‹ã¦ãƒ„ãƒ¼ãƒ«ï¼‰ãŒåœæ¢ã—ãŸå¯èƒ½æ€§ãŒã‚ã‚‹ã¨ã„ã†è©±ã‚’è€³ã«ã—ãŸã€

WannaCry

ãƒœãƒ¼ã‚¤ãƒ³ã‚°
ãƒªãƒ³ã‚¯
ã©ã‚“ãªãƒ‘ã‚½ã‚³ãƒ³ãŒæ„ŸæŸ“ã—ãŸã®ã‹ã€WannaCryã‚’å†æ¤œè¨¼
2017å¹´5æœˆ12æ—¥ä»¥é™ã€ä¸–ç•Œä¸ã§å¤§è¦æ¨¡ãªæ„ŸæŸ“è¢«å®³ã‚’ã‚‚ãŸã‚‰ã—ãŸã¨ã„ã‚ã‚Œã‚‹ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚¨ã‚¢ã€ŒWannaCryã€ã€‚å½“åˆã®å ±é“ã§ã¯ã€Œä¸å¯©ãªãƒ¡ãƒ¼ãƒ«ã‚’é–‹ã‹ãªã„ã§ã€ã¨ã„ã£ãŸæ³¨æ„å–šèµ·ãªã©ãŒå‡ºã¾ã—ãŸãŒã€å®Ÿéš›ã®ã¨ã“ã‚ã¯é•ã£ãŸã‚ˆã†ã§ã™ã€‚ã¾ãŸæ„ŸæŸ“çµŒè·¯ã ã‘ã§ãªãã€æ„ŸæŸ“ã®ä»•çµ„ã¿ã«ã¤ã„ã¦ã‚‚æƒ…å ±ãŒæ–ç‰‡çš„ã«å…¬é–‹ã•ã‚Œã¦ã„ãŸã®ã§ã€å…¨ä½“åƒãŒè¦‹ãˆã¦ã„ãªã„äººã¯å¤šã„ã®ã§ã¯ãªã„ã§ã—ã‚‡ã†ã‹ã€‚ä»Šå›žã¯ã“ã®æ”»æ’ƒã‚’èª¿æŸ»ã—ã¾ã—ãŸã€‚ å¤šè¨€èªžå¯¾å¿œã«â€œé€²åŒ–â€ ã¾ãšã€WannaCryã®æ¦‚è¦ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ã‚ã¾ã‚ŠçŸ¥ã‚‰ã‚Œã¦ã„ã¾ã›ã‚“ãŒã€ä»Šå›žé¨’ãŽã«ãªã£ãŸã®ã¯WannaCryã®äºœç¨®ã§ã™ã€‚ã‚ªãƒªã‚¸ãƒŠãƒ«ã¯2017å¹´åˆé ã«ç¢ºèªã•ã‚Œã¦ã„ã¾ã™ã€‚ã‚ªãƒªã‚¸ãƒŠãƒ«ã¯ã€æ„ŸæŸ“æ™‚ã«è¡¨ç¤ºã™ã‚‹æ–‡ç« ã¯è‹±èªžã®ã¿ã§ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯çµŒç”±ã§æ„ŸæŸ“ã™ã‚‹æ©Ÿèƒ½ã¯ãªãã€å¤§ããªè„…å¨ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã§ã—ãŸã€‚ 5æœˆã«å‡ºç¾ã—ãŸäºœç¨®ã¯ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯æ©Ÿèƒ½ã‚’æŒã£ã¦ã„ãŸãŸã‚ã«ã€å¤§è¦æ¨¡ãªæ„ŸæŸ“è¢«å®³ã«ã¤ãªãŒã‚Šã¾ã—ãŸã€‚ã¾ãŸ27ã®è¨€èªžã«å¯¾å¿œã—
hogetahogeko 2017/06/26
WannaCry
ãƒªãƒ³ã‚¯
2017 å¹´ 6 æœˆ 14 æ—¥ - KB4022719 (ãƒžãƒ³ã‚¹ãƒªãƒ¼ ãƒãƒ¼ãƒ«ã‚¢ãƒƒãƒ—) - Microsoft ã‚µãƒãƒ¼ãƒˆ
æ©Ÿèƒ½è¿½åŠ ãŠã‚ˆã³ä¿®æ£ ã“ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ›´æ–°ãƒ—ãƒã‚°ãƒ©ãƒ ã«ã¯ã€æ›´æ–°ãƒ—ãƒã‚°ãƒ©ãƒ KB4019265 (2017 å¹´ 5 æœˆ 17 æ—¥ãƒªãƒªãƒ¼ã‚¹) ã«åŒæ¢±ã•ã‚Œã¦ã„ã‚‹å“è³ªã®å‘ä¸Šã¨ä¿®æ£ãƒ—ãƒã‚°ãƒ©ãƒ ãŒå«ã¾ã‚Œã¦ã„ã¾ã™ã€‚ã¾ãŸã€ä»¥ä¸‹ã®å•é¡Œã‚‚è§£æ±ºã—ã¾ã™ã€‚ KB3164035 ã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã—ãŸå¾Œã«ã€Bit MapSection(DIBSection) é–¢æ•°ã‚’ä½¿ç”¨ã—ã¦ç¯„å›²å¤–ã«æç”»ã•ã‚ŒãŸãƒ“ãƒƒãƒˆãƒžãƒƒãƒ—ãŒå«ã¾ã‚Œã‚‹ã‚¨ãƒ³ãƒãƒ³ã‚¹ ãƒ¡ã‚¿ãƒ•ã‚¡ã‚¤ãƒ« (EMF) ã‚„ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆã‚’å°åˆ·ã§ããªããªã‚‹å•é¡Œã‚’ä¿®æ£ã—ã¾ã—ãŸã€‚ æ›´æ–°ãƒ—ãƒã‚°ãƒ©ãƒ ã®ã™ã¹ã¦ã®ã‚³ãƒ³ãƒãƒ¼ãƒˆãŒæ£å¸¸ã«ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œãšã«ã€ãƒ–ãƒ¼ãƒˆãŒå¦¨ã’ã‚‰ã‚Œã‚‹å•é¡Œã‚’ä¿®æ£ã—ã¾ã—ãŸã€‚ AMD Carrizo DDR4 ãƒ—ãƒã‚»ãƒƒã‚µã‚’ä½¿ç”¨ã—ã¦ã„ã‚‹ã‚·ã‚¹ãƒ†ãƒ ã®å ´åˆã«ã€"ã‚µãƒãƒ¼ãƒˆã•ã‚Œã¦ã„ãªã„ãƒãƒ¼ãƒ‰ã‚¦ã‚§ã‚¢" ã¨ã„ã†é€šçŸ¥ãŒè¡¨ç¤ºã•ã‚Œã€Windows ã®æ›´æ–°ãƒ—ãƒã‚°ãƒ©ãƒ ãŒã‚¹ã‚ãƒ£ãƒ³ã•ã‚Œãªã„å•é¡Œã‚’ä¿®æ£ã—ã¾ã—ãŸã€‚ å½±éŸ¿ã‚’å—ã‘ãŸã‚·ã‚¹ãƒ†
hogetahogeko 2017/06/19
Windows7

WannaCry
ãƒªãƒ³ã‚¯
SMB1.0ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚’ç„¡åŠ¹ã«ã™ã‚‹æ–¹æ³•
SMB1.0ã®è„†å¼±æ€§ã‚’ã¤ã„ãŸãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢ã€ŒWannaCryã€ãŒçŒ›å¨ã‚’ãµã‚‹ã£ãŸã“ã¨ã§ã€SMB1.0æ©Ÿèƒ½ã®åœæ¢ã‚’æ¤œè¨Žã—ã¦ã„ã‚‹äººãŒã„ã‚‹ã¨æ€ã„ã¾ã™ã®ã§ã€ãã®å¯¾å¿œæ–¹æ³•ã‚’è¨˜è¼‰ã—ã¾ã™ã€‚ ã“ã“ã§ã¯ã€SMB1.0ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚’ç„¡åŠ¹ã«ã™ã‚‹æ–¹æ³•ã‚’è¨˜è¼‰ã€‚ SMB1.0ã‚µãƒ¼ãƒã‚’ç„¡åŠ¹ã«ã™ã‚‹æ–¹æ³• SMB1.0ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚’æœ‰åŠ¹ã«ã™ã‚‹æ–¹æ³• SMB1.0ã‚µãƒ¼ãƒã‚’æœ‰åŠ¹ã«ã™ã‚‹æ–¹æ³• å°šã€å„ï¼¯ï¼³ã®SMBå¯¾å¿œåŒºåˆ†ã¯ä»¥ä¸‹ã¨ãªã‚‹ã€‚ SMB1.0ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚’æ¢ã‚ãŸå ´åˆã€SMB1.0ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆç«¯æœ«ã‹ã‚‰ã€XPã€2003ä»¥å‰ã®OSï¼ˆSMB1.0ã‚µãƒ¼ãƒã—ã‹æè¼‰ã—ã¦ã„ãŸã„OSï¼‰ã¸å…±æœ‰æŽ¥ç¶šã—ãŸéš›ã¯æŽ¥ç¶šã§ãã¾ã›ã‚“ã€‚ SMBã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚’ç„¡åŠ¹ã«ã™ã‚‹æ–¹æ³•ã§ã™ãŒã€å¤§ããï¼’ã¤ã«åˆ†ã‹ã‚Œã¾ã™ã€‚â€»XPï¼ˆ2003ï¼‰ä»¥å‰ã®ã‚‚ã®ã¯éžå¯¾è±¡ã«ã—ã¦ã„ã¾ã™ã€‚ Aã€Windows7ã€2008 R2ã€vistaã€2008ã€8ã€2012ã®å ´åˆ Bã€Windows8.1ã€2012
hogetahogeko 2017/06/16
â€œsc.exe qc lanmanworkstationâ€

WannaCry
ãƒªãƒ³ã‚¯
not found
TheÂ Microsoft Security Response CenterÂ is part of the defender community and on the front line of security response evolution. For over twenty years, we have been engaged with security researchers working to protect customers and the broader ecosystem.
hogetahogeko 2017/06/16
WannaCry
ãƒªãƒ³ã‚¯
Windows ã¨ Windows Server ã§ SMBv1ã€SMBv2ã€SMBv3 ã‚’æœ‰åŠ¹ã¾ãŸã¯ç„¡åŠ¹ã«ã™ã‚‹æ–¹æ³•
ã“ã®è¨˜äº‹ã§ã¯ã€SMB ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆ ã‚³ãƒ³ãƒãƒ¼ãƒãƒ³ãƒˆã¨ã‚µãƒ¼ãƒãƒ¼ ã‚³ãƒ³ãƒãƒ¼ãƒãƒ³ãƒˆã§ã‚µãƒ¼ãƒãƒ¼ ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ ãƒ–ãƒãƒƒã‚¯ (SMB) ãƒãƒ¼ã‚¸ãƒ§ãƒ³ 1 (SMBv1)ã€SMB ãƒãƒ¼ã‚¸ãƒ§ãƒ³ 2 (SMBv2)ã€SMB ãƒãƒ¼ã‚¸ãƒ§ãƒ³ 3 (SMBv3) ã‚’æœ‰åŠ¹ã¾ãŸã¯ç„¡åŠ¹ã«ã™ã‚‹æ–¹æ³•ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ SMBv1 ã‚’ç„¡åŠ¹åŒ–ã¾ãŸã¯å‰Šé™¤ã™ã‚‹ã¨ã€å¤ã„ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ãƒ¼ã‚„ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã¨ã®äº’æ›æ€§ã®å•é¡ŒãŒç™ºç”Ÿã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã€SMBv1 ã«ã¯é‡å¤§ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®è„†å¼±æ€§ãŒã‚ã‚Šã¾ã™ã®ã§ã€ä½¿ç”¨ã—ãªã„ã“ã¨ã‚’å¼·ããŠå‹§ã‚ã—ã¾ã™ã€‚ Windows 11 ã¾ãŸã¯ Windows Server 2019 ä»¥é™ã®ã©ã®ã‚¨ãƒ‡ã‚£ã‚·ãƒ§ãƒ³ã«ã‚‚ã€SMB 1.0 ã¯æ—¢å®šã§ã¯ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã¾ã›ã‚“ã€‚ SMB 1.0 ã¯ã€Home ã‚¨ãƒ‡ã‚£ã‚·ãƒ§ãƒ³ã¨ Pro ã‚¨ãƒ‡ã‚£ã‚·ãƒ§ãƒ³ã‚’é™¤ãã€Windows 10 ã§ã‚‚æ—¢å®šã§ã¯ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã¾ã›ã‚“ã€‚ SMB 1.0 ã‚’å†ã‚¤
hogetahogeko 2017/06/16
â€œSet-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Forceâ€

WannaCry
ãƒªãƒ³ã‚¯
æã‚Œã™ãŽã‚‹ã®ã¯æ„šã‹ã ã€ã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã¯ã‚¢ãƒ‹ãƒ¡ã®ã€Œé˜²å£è¿·è·¯ã€ã§å¯¾å‡¦
ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚¨ã‚¢ã€ŒWannaCryã€ã«Javaã®Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã€ŒStruts2ã€ã¨ã€2017å¹´å‰åŠã¯è„†å¼±æ€§ã«ã¾ã¤ã‚ã‚‹å¤§è¦æ¨¡ãªã‚µã‚¤ãƒãƒ¼æ”»æ’ƒãŒç™ºç”Ÿã—ã€æ—¥æœ¬ã§ã‚‚è¢«å®³ãŒç¶šå‡ºã—ãŸã€‚WannaCryã®æ”»æ’ƒã§ã¯é›»åãƒ¡ãƒ¼ãƒ«ã‚„å—ç™ºæ³¨ã®ã‚·ã‚¹ãƒ†ãƒ ãŒæ¢ã¾ã‚Šã€Struts2ã¸ã®æ”»æ’ƒã§ã¯ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ãŒæµå‡ºã—ã€ã¤ã„æ˜¨æ—¥ã‚‚å…¬è¡¨ãƒ™ãƒ¼ã‚¹ã§13ä»¶ç›®ã®è¢«å®³ãŒåˆ¤æ˜Žã—ãŸã€‚æ”»æ’ƒè€…ã®æ‚ªæ„ã¯é«˜ã¾ã‚‹ä¸€æ–¹ã ã€‚ ä¸€æ–¹ã€ä¸–ç•Œã«ç›®ã‚’ã‚„ã‚Œã°ç±³ãƒã€ä»ãƒã§ã¯å¤§çµ±é ˜é¸ã«ãƒã‚·ã‚¢ãŒã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã§ä»‹å…¥ã—ãŸã¨ã—ã¦æ”¿æ²»å•é¡Œã«ç™ºå±•ã—ã¦ã„ã‚‹ã€‚ç±³å›½é˜²ç·çœãŒã‚µã‚¤ãƒãƒ¼ç©ºé–“ã‚’é™¸ãƒ»æµ·ãƒ»ç©ºãƒ»å®‡å®™ã«ç¶šãã€Œç¬¬5ã®æˆ¦å ´ã€ã¨å®šç¾©ã—ã¦ä¹…ã—ãã€ç±³ä¸å¤®æƒ…å ±å±€ï¼ˆCIAï¼‰å…ƒè·å“¡ã®ã‚¨ãƒ‰ãƒ¯ãƒ¼ãƒ‰ãƒ»ã‚¹ãƒŽãƒ¼ãƒ‡ãƒ³æ°ã¯ç±³å›½å®¶å®‰å…¨ä¿éšœå±€ï¼ˆNSAï¼‰ãŒé–‹ç™ºã—ãŸãƒ¡ãƒ¼ãƒ«ã‚„ã‚½ãƒ¼ã‚·ãƒ£ãƒ«ãƒ¡ãƒ‡ã‚£ã‚¢ãªã©ã®ç›£è¦–ã‚·ã‚¹ãƒ†ãƒ ã‚’æ—¥æœ¬ã«æä¾›ã—ã¦ã„ãŸã¨æš´éœ²ã—ãŸã€‚ å›½å®¶ã‚’èƒŒæ™¯ã«ã—ãŸã‚µã‚¤ãƒãƒ¼è„…å¨ã¯é«˜ã¾ã‚‹ã°ã‹ã‚Šã€‚ã‚µã‚¤ãƒãƒ¼é˜²è¡›
hogetahogeko 2017/06/07
STARDUSTã€Žæ¼«ç”»/ã‚¢ãƒ‹ãƒ¡ã€Œæ”»æ®»æ©Ÿå‹•éšŠã€ã«å‡ºã¦ãã‚‹ã€ãƒãƒƒã‚ãƒ³ã‚°ã—ã¦ããŸæ•µã‚’èª˜ã„è¾¼ã‚“ã§é€†æŽ¢çŸ¥ã™ã‚‹ã€Œé˜²å£è¿·è·¯ã€ãŒç¾å®Ÿã¨ãªã£ãŸã‚‚ã®ã ã€

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯

WannaCry
ãƒªãƒ³ã‚¯
ã€Windows 10å¯¾å¿œã€‘scã‚³ãƒžãƒ³ãƒ‰ã§Windows OSã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ç¢ºèªï¼ä¸€è¦§ï¼é–‹å§‹ï¼åœæ¢ã™ã‚‹
Windows OSã®ã€Œã‚µãƒ¼ãƒ“ã‚¹ã€ã¨ã¯ï¼Ÿ Windows OSã®ã€Œã‚µãƒ¼ãƒ“ã‚¹ã€ã¨ã¯ã€ã‚·ã‚¹ãƒ†ãƒ ã®ãƒãƒƒã‚¯ã‚°ãƒ©ã‚¦ãƒ³ãƒ‰ã§å‹•ä½œã—ã¦ã„ã‚‹ç‰¹åˆ¥ãªãƒ—ãƒã‚»ã‚¹ã®ã“ã¨ã§ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‹ã‚‰ã®è¦æ±‚ã ã‘ã§ãªãã€ã‚·ã‚¹ãƒ†ãƒ å†…ã®å„ã‚³ãƒ³ãƒãƒ¼ãƒãƒ³ãƒˆã‹ã‚‰ã®è¦æ±‚ã«å¿œã˜ã¦ç¨¼åƒã™ã‚‹ã€‚ã‚·ã‚¹ãƒ†ãƒ ã«ã‚‚ã‚ˆã‚‹ãŒã€Windows OSã®å ´åˆã¯å¸¸ã«æ•°åã‹ã‚‰æ•°ç™¾ã®ã‚µãƒ¼ãƒ“ã‚¹ãŒå‹•ä½œã—ã¦ã„ã‚‹ï¼ˆã‚µãƒ¼ãƒ“ã‚¹ã«ã¤ã„ã¦ã¯TIPSã€Œsvchost.exeãƒ—ãƒã‚»ã‚¹ã¨ã¯ä½•ã‹ï¼Ÿã€ã‚‚å‚ç…§ï¼‰ã€‚ ã‚µãƒ¼ãƒ“ã‚¹ã®çŠ¶æ…‹ã‚’èª¿ã¹ãŸã‚Šã€è¨å®šã‚’ç¢ºèªã—ãŸã‚Šã™ã‚‹ã«ã¯ã€ç®¡ç†ãƒ„ãƒ¼ãƒ«ã‚°ãƒ«ãƒ¼ãƒ—ã«ç”¨æ„ã•ã‚Œã¦ã„ã‚‹ã€Œã‚µãƒ¼ãƒ“ã‚¹ã€ã¨ã„ã†ãƒ„ãƒ¼ãƒ«ã‚’ä½¿ã†ã‹ã€ã‚¿ã‚¹ã‚¯ãƒžãƒãƒ¼ã‚¸ãƒ£ãƒ¼ã®ã€Œã‚µãƒ¼ãƒ“ã‚¹ã€ã‚¿ãƒ–ã‚’åˆ©ç”¨ã™ã‚‹ã®ãŒä¸€èˆ¬çš„ã§ã‚ã‚‹ã€‚ ã ãŒGUIãŒä½¿ãˆãªã„å ´åˆã‚„ã€ã‚µãƒ¼ãƒ“ã‚¹ã®çŠ¶æ…‹ã‚„è¨å®šã‚’ãƒªã‚¹ãƒˆã«ã—ã¦ãŠããŸã„å ´åˆã¯ã€ã‚³ãƒžãƒ³ãƒ‰ãƒ©ã‚¤ãƒ³ã§åˆ©ç”¨ã§ãã‚‹CUIã®ãƒ„ãƒ¼ãƒ«ãŒä¾¿åˆ©ã§ã‚ã‚‹ã€‚ Windows OSã«ã¯ã€Œsc.exeã€ã¨ã„ã†ã‚µãƒ¼ãƒ“ã‚¹ã‚’åˆ¶å¾¡ã™ã‚‹ãŸã‚ã®ã‚³ãƒžãƒ³
hogetahogeko 2017/05/24
Windows

WannaCry
ãƒªãƒ³ã‚¯
ãƒ•ã‚¡ã‚¤ãƒ«å…±æœ‰ã§åˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹ SMB ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’ç¢ºèªã™ã‚‹æ–¹æ³•
å…ˆæ—¥ã®ã€ŒMS16-110 é©ç”¨å¾Œ NAS ãªã©ã®å…±æœ‰ãƒ•ã‚©ãƒ«ãƒ€ãƒ¼ã«æŽ¥ç¶šã§ããªã„å•é¡Œã€ã®è¨˜äº‹ã®èª¿ã¹ç‰©ã‚’ã—ã¦ã„ã‚‹éš›ã«è¦‹ã¤ã‘ãŸ Tips ã«ã¤ã„ã¦ãƒ¡ãƒ¢ä»£ã‚ã‚Šã«æŠ•ç¨¿ã—ã¦ãŠãã¾ã™ã€‚ Windows ã§ã®ãƒ•ã‚¡ã‚¤ãƒ«å…±æœ‰ã«ã¯ SMB ãƒ—ãƒãƒˆã‚³ãƒ«ãŒåˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹ã“ã¨ã¯è‰¯ãçŸ¥ã‚‰ã‚Œã¦ã„ã¾ã™ãŒã€SMB ã¯ Windows è£½å“ã§é•·ãä½¿ã‚ã‚Œæ©Ÿèƒ½ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãŒå¼·åŒ–ã•ã‚Œã¦ããŸãŸã‚ã€SMBv1ã€SMBv2ã€SMBv3 ã¨ã„ã£ãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚„ã•ã‚‰ã«ç´°ã‹ãªãƒ€ã‚¤ã‚¢ãƒ¬ã‚¯ãƒˆ ãŒå˜åœ¨ã—ã¦ã„ã¾ã™ã€‚é€šå¸¸ã¯ã‚µãƒ¼ãƒãƒ¼ â€“ ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆé–“ã§è‡ªå‹•çš„ã«ãƒã‚´ã‚·ã‚¨ãƒ¼ã‚·ãƒ§ãƒ³ãŒè¡Œã‚ã‚Œé©åˆ‡ãªãƒãƒ¼ã‚¸ãƒ§ãƒ³ãƒ»ãƒ€ã‚¤ã‚¢ãƒ¬ã‚¯ãƒˆãŒåˆ©ç”¨ã•ã‚Œã‚‹ãŸã‚ã€ã“ã†ã—ãŸé•ã„ã‚’æ„è˜ã™ã‚‹å¿…è¦ã¯ãªã„ã®ã§ã™ãŒã€Windows è£½å“ä»¥å¤– (Linux ä¸Šã® Samba ã‚„ OS â…©ã€NAS ãªã©) ã¨æŽ¥ç¶šã™ã‚‹å ´åˆã‚„ã€Windows é–“ã§ã‚‚ãƒˆãƒ©ãƒ–ãƒ«ã‚·ãƒ¥ãƒ¼ãƒˆã‚’ã™ã‚‹å ´åˆãªã©ã€ã©ã®ã‚ˆã†ãªãƒãƒ¼ã‚¸ãƒ§ãƒ³ãƒ»ãƒ€ã‚¤ã‚¢
hogetahogeko 2017/05/24
sc.exe qc lanmanworkstation

Windows

å…±æœ‰ãƒ•ã‚©ãƒ«ãƒ€

WannaCry
ãƒªãƒ³ã‚¯
ä¸–ç•Œå„åœ°ã§ç™ºç”Ÿã—ãŸãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢ WannaCry ã®æ„ŸæŸ“äº‹æ¡ˆã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
2017å¹´5æœˆ12æ—¥é ƒã‹ã‚‰ã€ä¸–ç•Œå„åœ°ã§ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢ã«æ„ŸæŸ“ã™ã‚‹è¢«å®³ãŒç›¸æ¬¡ã„ã§å ±å‘Šã•ã‚Œã¦ã„ã¾ã™ã€‚ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢ã¯WannaCryç‰ã¨åå‰ãŒä»˜ã‘ã‚‰ã‚Œã¦ã„ã‚‹ã‚‚ã®ã§ã€ã“ã‚Œã«æ„ŸæŸ“ã™ã‚‹åŽŸå› ã¨ã—ã¦ã€Windowsã®è„†å¼±æ€§ã€åŠã³ãã®è„†å¼±æ€§ã‚’ç”¨ã„ãŸNSAãŒé–‹ç™ºã—ãŸãƒ„ãƒ¼ãƒ«ãŒé–¢ä¿‚ã—ã¦ã„ã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã¨å„å›½ã®CSIRTã‚„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ™ãƒ³ãƒ€ãŒæ³¨æ„å–šèµ·ç‰ã‚’å…¬é–‹ã—ã¦ã„ã¾ã™ã€‚Microsoftã¯ä»Šå›žã®æ„ŸæŸ“äº‹æ¡ˆã‚’å—ã‘ã€WindowsXPãªã©ã®ã‚µãƒãƒ¼ãƒˆãŒåˆ‡ã‚ŒãŸOSã‚’å¯¾è±¡ã¨ã—ãŸç·Šæ€¥ã®æ›´æ–°ãƒ—ãƒã‚°ãƒ©ãƒ ã‚‚å…¬é–‹ã—ã¾ã—ãŸã€‚ ã“ã“ã§ã¯ã“ã®ä¸–ç•Œä¸ã§ç™ºç”Ÿã—ãŸãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢ WannaCry ã®æ„ŸæŸ“è¢«å®³ãªã©ã«ã¤ã„ã¦ã¾ã¨ã‚ã¾ã™ã€‚ ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆã‚¿ã‚¤ãƒ ãƒ©ã‚¤ãƒ³ ä»¥ä¸‹ã¯ä¸»ã«å›½å†…ã®é–¢é€£äº‹è±¡ã‚’æ•´ç†ã—ãŸã‚‚ã®ã€‚ æ—¥æ™‚ å‡ºæ¥äº‹ 2016å¹´9æœˆ16æ—¥ MicrosoftãŒSMBv1ã®ä½¿ç”¨åœæ¢ã‚’å¼·ãæŽ¨å¥¨ã™ã‚‹è¨˜äº‹ã‚’å…¬é–‹ã€‚ 2017å¹´1æœˆ16æ—¥ US-CERTãŒSMBv1
hogetahogeko 2017/05/15
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

WannaCry
ãƒªãƒ³ã‚¯
IPAä¼šè¦‹ã®æ–‡å—èµ·ã“ã—ï¼ˆWannaCryï¼‰
NHKãƒ‹ãƒ¥ãƒ¼ã‚¹ @nhk_news ã€å¤§è¦æ¨¡ã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã§ä¼šè¦‹ã€‘å¤§è¦æ¨¡ãªã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã«ã‚ˆã‚‹è¢«å®³ãŒä¸–ç•Œå„åœ°ã«åºƒãŒã£ã¦ã„ã‚‹ã“ã¨ã‚’å—ã‘ã¦ã€ã€Œæƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ã€ãŒè¨˜è€…ä¼šè¦‹ã‚’é–‹ãã¾ã™ã€‚ãã®æ¨¡æ§˜ã‚’ãƒ©ã‚¤ãƒ–æ˜ åƒã§ãŠä¼ãˆã—ã¾ã™ã€‚ã€Œï¼®ï¼¨ï¼«ãƒ‹ãƒ¥ãƒ¼ã‚¹ãƒ»é˜²ç½ã‚¢ãƒ—ãƒªã€ã§ã‚‚ã”è¦§ã„ãŸã ã‘ã¾ã™ã€‚www3.nhk.or.jp/news/realtime-â€¦ 2017-05-14 16:42:29
hogetahogeko 2017/05/15
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

WannaCry
ãƒªãƒ³ã‚¯
ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢ WannaCrypt æ”»æ’ƒã«é–¢ã™ã‚‹ãŠå®¢æ§˜ã‚¬ã‚¤ãƒ€ãƒ³ã‚¹ â€“ æ—¥æœ¬ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒ¼ãƒ | ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆ
hogetahogeko 2017/05/15
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

WannaCry
ãƒªãƒ³ã‚¯
1