[B! CSRF] itochanã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

itochan id:itochan

CSRFã«é–¢ã™ã‚‹itochanã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (11)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã‚¦ã‚¤ãƒ«ã‚¹ä½œæˆç½ªã§åˆã®é€®æ•è€…ãŒå‡ºã‚‹ | ã‚¹ãƒ©ãƒ‰ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ãƒ¼ã‚¦ã‚¤ãƒ«ã‚¹ã‚’ä½œæˆãƒ»é€ä¿¡ã—ãŸã¨ã—ã¦ã€å¤§é˜ªåºœåœ¨ä½ã®ç”·æ€§ãŒä¸æ£æŒ‡ä»¤é›»ç£çš„è¨˜éŒ²ä¾›ç”¨ã®ç–‘ã„ã§é€®æ•ã•ã‚Œã€ãã®å¾Œä¸æ£æŒ‡ä»¤é›»ç£çš„è¨˜éŒ²ä½œæˆå®¹ç–‘ã¨åˆã‚ã›ã¦é€æ¤œã•ã‚ŒãŸã€‚ä¸æ£æŒ‡ä»¤é›»ç£çš„è¨˜éŒ²ä½œæˆã¯ã€Œã‚¦ã‚¤ãƒ«ã‚¹ä½œæˆç½ªã€ã¨ã‚‚è¨€ã‚ã‚Œã¦ã„ã‚‹ãŒã€ã“ã®ç½ªçŠ¶ã®é©ç”¨ã¯åˆã‚ã¦ã¨ãªã‚‹ï¼ˆæ™‚äº‹é€šä¿¡ï¼‰ã€‚ èªå£²æ–°èžã«ã‚ˆã‚‹ã¨ã€å®¹ç–‘è€…ã¯åˆ¥ã®ç”·æ€§ã¨å…±åŒã§é‹å–¶ã—ã¦ã„ãŸã‚¢ãƒ‹ãƒ¡ã‚µã‚¤ãƒˆã®é‹å–¶æ–¹æ³•ã‚’å·¡ã£ã¦ãƒˆãƒ©ãƒ–ãƒ«ã¨ãªã£ã¦ã„ãŸã¨ã„ã†ã€‚å•é¡Œã¨ãªã‚‹ã‚¦ã‚¤ãƒ«ã‚¹ã¯Webã‚µã‚¤ãƒˆã«åŸ‹ã‚è¾¼ã‚€ã‚¿ã‚¤ãƒ—ã®ã‚‚ã®ã§ã€åŸ‹ã‚è¾¼ã¾ã‚ŒãŸWebã‚µã‚¤ãƒˆã«ã‚¢ã‚¯ã‚»ã‚¹ã™ã‚‹ã¨ã€Œå®¹ç–‘è€…ãŒé‹å–¶ã—ã¦ã„ãŸã‚µã‚¤ãƒˆã«æ›¸ãè¾¼ã¿ã‚’ã—ãŸã‚ˆã†ã«ç™ºä¿¡è¨˜éŒ²ã‚’å½è£…ã™ã‚‹ã€ã¨ã„ã†ã€‚ å®¹ç–‘è€…ã¯ç”·æ€§ã«å¯¾ã—ã‚¦ã‚¤ãƒ«ã‚¹ã‚’è¨ç½®ã—ãŸã‚µã‚¤ãƒˆã«èª˜å°Žã™ã‚‹ãƒ¡ãƒ¼ãƒ«ã‚’é€ä¿¡ã€ã‚¦ã‚¤ãƒ«ã‚¹ã‚’ä½¿ã£ã¦ã€Œã•ã£ã•ã¨é–‰éŽ–ã—ã‚ã€‚ã•ã‚‚ãªã„ã¨ã€ãŠå‰ã®ä¸¡è¦ªã‚’æ®ºã—ã¦å®¶ã‚’ç‡ƒã‚„ã™ã€ã¨ã®æ–‡è¨€ã‚’ç”·æ€§ãŒæ›¸ãè¾¼ã‚“ã ã‚ˆã†ã«å½è£…ã—ã€ã€Œç”·æ€§ã«è„…è¿«ã•ã‚ŒãŸã€ã¨å¤§é˜ªåºœè¦ã«ç›¸è«‡ã—ãŸã¨ã„ã†ã€‚
itochan 2012/05/19
ã“ã“ã‹ã‚‰ã€‚ã€€http://sankei.jp.msn.com/west/west_affairs/news/120513/waf12051312000005-n1.htm

ã‚¦ã‚¤ãƒ«ã‚¹

csrf
ãƒªãƒ³ã‚¯
ã€è¡æ’ƒäº‹ä»¶ã®æ ¸å¿ƒã€‘ã€Œã‚¦ã‚¤ãƒ«ã‚¹ä½œæˆç½ªã€åˆé©ç”¨ã€€å¤§é˜ªåºœè¦ã®â€œå¤§å‹è² â€ï¼ˆ1/6ãƒšãƒ¼ã‚¸ï¼‰ - MSNç”£çµŒwest
ã€Œãƒ–ãƒã‚°ã‚’é–‰éŽ–ã—ãªã‘ã‚Œã°ã€ä¸¡è¦ªã‚’æ®ºã™ã€ã€‚è‡ªåˆ†ã®ã‚µã‚¤ãƒˆã«ã“ã‚“ãªæ›¸ãè¾¼ã¿ãŒã‚ã£ãŸã¨ç”·ãŒå¤§é˜ªåºœè¦ã«è¢«å®³ã‚’å±Šã‘å‡ºãŸãŒã€å®Ÿã¯ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ãƒ¼ã‚¦ã‚¤ãƒ«ã‚¹ã‚’é§†ä½¿ã—ã¦ä»–äººã‹ã‚‰è„…ã•ã‚Œã¦ã„ã‚‹ã‚ˆã†ã«è¦‹ã›ã‹ã‘ãŸè‡ªä½œã€è‡ªæ¼”ã ã£ãŸã€‚åºœè¦ã¯ä»Šå¹´ï¼‘æœˆã€ã“ã®ç”·ã«ã¤ã„ã¦æ˜¨å¹´ï¼—æœˆã®æˆç«‹ä»¥æ¥ã€åˆã¨ãªã‚‹ä¸æ£æŒ‡ä»¤é›»ç£çš„è¨˜éŒ²ä½œæˆå®¹ç–‘ã€ã„ã‚ã‚†ã‚‹ã€Œã‚¦ã‚¤ãƒ«ã‚¹ä½œæˆç½ªã€ã‚’é©ç”¨ã—ãŸã€‚ã“ã‚Œã¾ã§ã€ã‚¦ã‚¤ãƒ«ã‚¹ä½œæˆãã®ã‚‚ã®ã‚’å–ã‚Šç· ã¾ã‚‹æ³•å¾‹ãŒãªã‹ã£ãŸãŸã‚ã€è‘—ä½œæ¨©æ³•é•åã‚„å™¨ç‰©æå£Šãªã©ã®ç½ªã«å•ã‚ã‚Œã‚‹ã“ã¨ãŒå¤šã‹ã£ãŸã‚µã‚¤ãƒãƒ¼çŠ¯ç½ªã€‚ä»Šå›žã®äº‹ä»¶ã‚’ã‚ãã‚‹è£åˆ¤ã¯ã™ã§ã«å§‹ã¾ã£ã¦ãŠã‚Šã€ä»Šå¾Œã®æˆã‚Šè¡ŒããŒæ³¨ç›®ã•ã‚Œã¦ã„ã‚‹ã€‚ã€€ç§ã¯è¢«å®³è€…ã€€ã‚¦ã‚¤ãƒ«ã‚¹ä½œæˆç½ªãªã©ã§èµ·è¨´ã•ã‚ŒãŸã®ã¯ã€å¤§é˜ªåºœæ¾åŽŸå¸‚å¤©ç¾Žå—ã®ç„¡è·ã€å°æž—æµ©å¿ è¢«å‘Šï¼ˆï¼’ï¼˜ï¼‰ã€‚å°æž—è¢«å‘Šã¯æ˜¨å¹´ï¼™æœˆã€ã€Œã€Žã•ã£ã•ã¨ãƒ–ãƒã‚°ã‚’é–‰éŽ–ã—ãªã‘ã‚Œã°ã€ä¸¡è¦ªã‚’æ®ºã—ã¦å®¶ã‚’ç‡ƒã‚„ã™ã€ã¨ã„ã†æ›¸ãè¾¼ã¿ãŒè‡ªåˆ†ã®ã‚µã‚¤ãƒˆã«ã‚ã£ãŸã€ã¨åºœè¦ã«è¨´ãˆå‡ºãŸã€‚ã€€åºœè¦ã¯ã“ã®è¨´ãˆã‚’å—ã‘ã€è„…è¿«æ–‡ã‚’æ›¸ã
itochan 2012/05/19
ã‚¦ã‚½æ®ºå®³äºˆå‘Šã€ã‚¦ã‚½çˆ†ç ´äºˆå‘Šã£ã¦ã€è¦å¯Ÿã¸ã®æ¥å‹™å¦¨å®³ç½ªã§ãƒ‹ãƒ¥ãƒ¼ã‚¹ã«ãªã£ã¦ãŸã“ã¨ãªã‹ã£ãŸã£ã‘ï¼Ÿã€€ï¼ã€€ã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯

ã‚¦ã‚¤ãƒ«ã‚¹

csrf
ãƒªãƒ³ã‚¯
ã€Žã€ç·Šæ€¥ã€‘ã‚¢ãƒ¡ãƒ¼ãƒãªã†åˆ©ç”¨ä¸ã®çš†ã•ã‚“ã¸ã€ã”æ³¨æ„ï¼ã€‘ã€
ãŠå‹é”ã®æ›¸ãè¾¼ã¿ã«ã€Œã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼ã€ã¨ã„ã†ã‚‚ã®ãŒã‚ã£ãŸã‚‰ çµ¶å¯¾ã«ã‚¯ãƒªãƒƒã‚¯ã—ãªã„ã§ãã ã•ã„ï¼ï¼ï¼ï¼ ã‚¢ãƒ¡ãƒ¼ãƒã‚¹ã‚¿ãƒƒãƒ•ã•ã‚“ã®è¨˜äº‹ã«ã‚ˆã‚‹ã¨ã€ ãã®æ›¸ãè¾¼ã¿ã‚’ã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨è‡ªåˆ†ã®æ—¥è¨˜ã«ã‚‚ è‡ªå‹•çš„ã«åŒã˜å†…å®¹ã®è¨˜äº‹ãŒæŠ•ç¨¿ã•ã‚Œã‚‹ãã†ã§ã™ï¼ ãã®çµæžœã€ãã‚Œã‚’è¦‹ãŸä»–ã®ã‚¢ãƒ¡ãƒ³ãƒãƒ¼ã•ã‚“ã«ã‚‚ã€ã©ã‚“ã©ã‚“æ„ŸæŸ“ã—ã¦ã„ãã¾ã™ï¼ ã“ã‚Œã¯ãƒ¯ãƒ¼ãƒ ã¨ã„ã†ã‚¦ã‚¤ãƒ«ã‚¹ã§ã€ ã¾ã‚‹ã§ãƒã‚§ãƒ¼ãƒ³ãƒ¡ãƒ¼ãƒ«ã®ã‚ˆã†ã«æ‚ªè³ªã§ã™ï¼ï¼ ãã®ä¸Šã€ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ãªã©ã®å€‹äººæƒ…å ±ãŒæ¼æ´©ã™ã‚‹å ´åˆãŒã‚ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ï¼ è©³ç´°ã¯ä¸æ˜Žã§ã™ãŒã€ã¨ã¦ã‚‚ä¸æ°—å‘³ã§ã™â€¦ï¼ ã€Œã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼ã€ã¨ã„ã†ã‚¿ã‚¤ãƒˆãƒ«ã®æ—¥è¨˜ãŒ ã„ã¤ã®ã¾ã«ã‹æŠ•ç¨¿ã•ã‚Œã¦ã„ãªã„ã‹ã€ è‡ªåˆ†ã®ã€Œãƒ–ãƒã‚°ã€ã¨ã€Œã‚¢ãƒ¡ãƒ¼ãƒãªã†ã€ã§ã€ã©ã†ã‹ã”ç¢ºèªã‚’ï¼ ã‚ã£ãŸã‚‰å³åˆ»å‰Šé™¤ã—ã¦ãã ã•ã„ï¼ï¼ï¼ï¼ï¼ï¼ (ï¼‘æ—¥ã®ã‚¿ã‚¤ãƒ ãƒ©ã‚°ã®å¾Œã«ã‚¦ã‚¤ãƒ«ã‚¹ç™ºå‹•ã™ã‚‹ã¨ã„ã†èª¬ã‚‚ã‚ã‚Šã¾ã™ï¼) ç¾åœ¨ã€amebaç®¡ç†è€…ã®æ–¹ã§ã‚‚å¯¾å¿œã§ããªã„ã»ã©ã®ã‚¹ãƒ”ãƒ¼ãƒ‰ã§
itochan 2009/12/11
ã“ã‚“ã«ã¡ã¯ã“ã‚“ã«ã¡ã¯ï¼ï¼

ã“ã‚Œã¯ã²ã©ã„

security

csrf
ãƒªãƒ³ã‚¯
Google (finally) adds protection for common Web 2.0 attack
itochan 2009/10/03
csrf
ãƒªãƒ³ã‚¯
Pwning Opera Unite with Infernoâ€™s Eleven
Opera Unite, the upcoming version of theÂ OperaÂ browser has a strong vision to change how we look at the web. For those who are unknown to this radical techno logy, it extends your browser into a full-blown collaboration suite where you canÂ chat with people,Â leave notes,Â share files,Â play media,Â host your sites, etc. (Wow!!). Opera Unite comes bundled with a bunch of standard services such as Fridge
itochan 2009/09/25
csrf

xss

opera unite

security
ãƒªãƒ³ã‚¯
ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼
ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ (ãƒ¡ã‚¤ãƒ³ãƒ–ãƒã‚°ã§ã™ï¼) â†’ ã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ï¼ (Hatena) ã¯ã¾ã¡ã‚„ï¼’ã®ãƒ„ã‚¤ãƒƒã‚¿ãƒ¼ã§ã™ï¼ æ°—è»½ã«ãƒ•ã‚©ãƒãƒ¼ã—ã¦ã¿ã¦ãã ã•ã„ãï¼ â†’ Twitter / ã¯ã¾ã¡ã‚„ï¼’ ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ â†’ Hamachiya2ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ ã‚¿ãƒ³ãƒ–ãƒ©ãƒ¼ã§ã™ï¼ ã‹ã‚ã„ã„çµµã‚’ã‚ã¤ã‚ãŸã‚Šã—ã¦ã„ã¾ã™ï¼ â†’ [tumblr] hmcy ã‚²ãƒ¼ãƒ ã®å‹•ç”»ã‚’ã‚ã’ã¦ã€ã¼ãã‚‚ãƒ¢ãƒ†ãƒ¢ãƒ†ãƒ¦ãƒ¼ãƒãƒ¥ãƒ¼ãƒãƒ¼ã«ãªã‚‹ã¤ã‚‚ã‚Šã§ã™ï¼ â†’ ã¯ã¾ã¡ã‚„ï¼’(Hamachiya2)ã®YouTube (ä»¥ä¸‹ã¯éŽåŽ»ã®è¨˜äº‹ãªã©) ãã¿ã®ãƒ©ã‚¤ãƒ•ã‚’å¯è¦–åŒ–ã™ã‚‹ã‚ˆï¼ â†’ [JavaScript] ãƒ©ã‚¤ãƒ•ã‚«ã‚¦ãƒ³ã‚¿ãƒ¼ ç©ºã‹ã‚‰å¥³ã®åãŒâ€¦ï¼ â†’ ç©ºã‹ã‚‰å¥³ã®åãŒé™ã£ã¦ãã‚‹ AIRã‚¢ãƒ—ãƒªã®ç°¡å˜ãªä½œã‚Šæ–¹ â†’ [AIR][JavaScript] JavaScriptã§ã‹ã‚“ãŸã‚“AIRã‚¢ãƒ—ãƒªã«æŒ‘æˆ¦ ã¤ãã£ã¦ã¿ã¾ã—ãŸï¼ â†’ ãƒ‰ãƒªãƒ¼ãƒ ãƒ¡ãƒ¼ã‚«ãƒ¼ : ãƒ–ãƒ©ã‚¦ã‚¶ã§ç°¡å˜ã«ãƒŽãƒ™ãƒ«ã‚²
itochan 2008/12/09
ã“ã‚“ã«ã¡ã¯ï¼ã“ã‚“ã«ã¡ã¯ï¼ã€€ã§ãŠãªã˜ã¿ã€ã‚¦ã‚§ãƒ–ã‚¢ã‚¤ãƒ‰ãƒ«ã¯ã¾ã¡ã¡ã‚ƒã‚“

CSRF

web

ã¯ã¾ã¡ã¡ã‚ƒã‚“
ãƒªãƒ³ã‚¯
Domain hijack fears over Gmail exploit
itochan 2008/11/25
ç‰¹å®šã®ãƒ¡ãƒ¼ãƒ«ãŒç¬¬ä¸‰è€…ã«è»¢é€ã•ã‚Œã‚‹ã‚ˆã†ãªãƒ•ã‚£ãƒ«ã‚¿ã‚’ä½œæˆã•ã‚Œã¦ã—ã¾ã„ã€ãã®ç‰¹å®šã®ãƒ¡ãƒ¼ãƒ«ã«ã‚ˆã£ã¦ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ãªã©ã®é‡è¦æƒ…å ±ãŒæ¼æ´©

security

CSRF
ãƒªãƒ³ã‚¯
ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°(XSS)ã¨CSRFã®é•ã„æ—©åˆ†ã‹ã‚Š - ockeghem(å¾³ä¸¸æµ©)ã®æ—¥è¨˜
æ˜¨æ—¥ã®æ—¥è¨˜ã§ã€DKç¥ã‚Šã§ä½¿ã‚ã‚Œã¦ã„ã‚‹è„†å¼±æ€§ãŒXSSã‹CSRFã‹ã¨ã„ã†å•é¡Œã«ãªã£ãŸã€‚ã©ã†ã‚‚ã€XSSã¨CSRFãŒã”ã£ã¡ã‚ƒã«ãªã£ã¦ã„ã‚‹äººã‚‚ã„ã‚‹ã‚ˆã†ã«è¦‹å—ã‘ã‚‹ã®ã§ã€ç°¡å˜ãªæ•´ç†ã‚’è©¦ã¿ãŸã„ã€‚ XSSã¨CSRFã«ã¯ä¼¼ãŸç‚¹ãŒã‚ã‚‹ã€‚ ã©ã¡ã‚‰ã‚‚ã€Œã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã€ã¨ã„ã†è¨€è‘‰ãŒå…ˆé ã«ã¤ã ãªã‚Šã™ã¾ã—ã®ã‚ˆã†ãªã“ã¨ãŒçµæžœã¨ã—ã¦ã§ãã‚‹ ã©ã¡ã‚‰ã‚‚å—å‹•åž‹æ”»æ’ƒã§ã‚ã‚‹ ãã‚Œã«å¯¾ã—ã¦ã€ã‚‚ã¡ã‚ã‚“é•ã†ç‚¹ã‚‚ã‚ã‚‹ã€‚å°‚é–€å®¶ã‹ã‚‰è¦‹ã‚Œã°ã€Œä¼¼ã¦ã‚‹ã‚‚ä½•ã‚‚ã€ãã‚‚ãã‚‚å…¨ç„¶é•ã†ã‚‚ã®ã§ã™ã‚ˆã€ã¨ãªã‚‹ã®ã ã‚ã†ãŒã€ç¾ã«æ··åŒã—ã¦ã„ã‚‹äººãŒã„ã‚‹ã®ã ã‹ã‚‰ç´›ã‚‰ã‚ã—ã„ç‚¹ã‚‚ã‚ã‚‹ã®ã ã‚ã†ã€‚ ç§æ€ã†ã«ã€XSSã¨CSRFã®æ±ºå®šçš„ãªé•ã„ã¯ã€ä»¥ä¸‹ã®ç‚¹ã§ã¯ãªã„ã ã‚ã†ã‹ã€‚ XSSã¯æ”»æ’ƒã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§å‹•ããŒã€CSRFã¯ã‚µãƒ¼ãƒãƒ¼ä¸Šã§å‹•ã ã“ã®ãŸã‚ã€XSSã§ã§ãã‚‹æ‚ªã„ã“ã¨ã¯ã€ã™ãªã‚ã¡JavaScriptã§ã§ãã‚‹ã“ã¨ã§ã‚ã£ã¦ã€æ”»æ’ƒå¯¾è±¡ã®Cookieã‚’ç›—ã¿å‡ºã™ã“ã¨ãŒå…¸åž‹ä¾‹ã¨ãªã‚‹ã€‚ä¸€æ–¹ã€CS
itochan 2008/03/25
ã¨ã‚Šã‚ãˆãšãƒ–ã‚¯ãƒžã€€ã€Œã‚µãƒ¼ãƒãƒ¼ä¸Šã§ã€Žã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒã€å‹•ãã€ã£ã¦ã„ã†è¨€ã„å›žã—ãŒã„ã¾ã„ã¡ç´å¾—ã§ããªã„ã‚“ã ã‘ã©â€¦

csrf

xss
ãƒªãƒ³ã‚¯
crossdomain.xmlã®è„†å¼±æ€§ã®è©±ãŒäººæ°—ã ã‘ã©ã€ç°¡å˜ã«è§£èª¬ã™ã‚‹ã‚ˆï¼:ã—ã£ã½ã®ãƒ–ãƒã‚°
ã¤ã„ã£ãŸãƒ¼è¶³ã‚ã¨å¸³ ã“ã®ã‚µã‚¤ãƒˆã‚’ä¸€æ˜¨æ—¥ã¨ã‹ã«è¦‹ã¦ã³ã£ãã‚Šã—ãŸäººã‚‚å¤šã„ã¨æ€ã†ã‚“ã ã‘ã©crossdomain.xmlã®è¨å®šã‚’ã‚ã‚„ãµã‚„ã«ã—ã¦ãŠãã¨ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚‚ã‚ã‚„ãµã‚„ã«ãªã£ã¡ã‚ƒã†ã‚“ã§ã€ãã“ã¯Webã‚µãƒ¼ãƒ“ã‚¹ã¨ã—ã¦ã¯ã¾ãšã„ã‚ˆãï¼Ÿã£ã¦ã„ã†è©±ãŒè©±é¡Œã€‚ Twitter ã® crossdomain.xml å•é¡Œã«ã¤ã„ã¦ã€‚ - ã¦ã£ãç…®ãƒ–ãƒã‚° crossdomain.xml ã¨ CSRF è„†å¼±æ€§ã«ã¤ã„ã¦ - å·oãƒ»-ãƒ»ï¼‰ï¼œ2nd life ã ã‘ã©ã‚‚ã€ã¦ã£ãç…®ã®ä¸ã®äººãŒè¨€ã†ã‚ˆã†ã« ã“ã®ã‚ˆã†ãªã€Œå–å¾—ã€ã®ã‚†ã‚‹ã•ãŒç†ç”±ã§ã€Twitter API ã‚’æ´»ç”¨ã—ãŸã‚µãƒ¼ãƒ“ã‚¹ã‚’ä½œã‚‹äººãŒå¤šç™ºã—ã¦ã€ãã‚ŒãŒã¾ãŸ Twitter ã®äººæ°—ã‚’æŠ¼ã—ä¸Šã’ãŸã®ã¯äº‹å®Ÿã€‚ ã¨ã„ã†å…·åˆã«ã€Webã‚µãƒ¼ãƒ“ã‚¹ã®crossdomain.xmlã‚’å…¨éƒ¨åŽ³ã—ãï¼ˆã‚‚ã—ãã¯ãã‚‚ãã‚‚ç½®ã‹ãªã„ï¼‰ã™ã‚Œã°ãã‚Œã§ã„ã„ã‹ã£ã¦ã„ã†ã¨ã€ãã‚Œã ã¨ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®è‡ªç™ºçš„ãªã‚µãƒ¼ãƒ“ã‚¹ã‚’
itochan 2008/03/23
ã¸ã‡

csrf

flash

security
ãƒªãƒ³ã‚¯
é«˜æœ¨æµ©å…‰ï¼ è‡ªå®…ã®æ—¥è¨˜ - æš—é»™çš„ã«å½¢æˆã™ã‚‹äº‹å®Ÿæ¨™æº–ã®è©±ã¨å›žé¿ç–ã®è©±ã‚’æ··åŒã—ã¦ã¯ã„ã‘ãªã„
â– æš—é»™çš„ã«å½¢æˆã™ã‚‹äº‹å®Ÿæ¨™æº–ã®è©±ã¨å›žé¿ç–ã®è©±ã‚’æ··åŒã—ã¦ã¯ã„ã‘ãªã„ ã€Œã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ã€ â€•â€•çŸ¥ã‚‰ã‚Œã–ã‚‹CSRFæ”»æ’ƒ, ä¸Šé‡Žå®£, @IT, 2005æœˆ4æœˆ27æ—¥åˆç‰ˆã€2006å¹´11æœˆ8æ—¥ä¿®æ£ç‰ˆ â—ãƒªãƒ•ã‚¡ãƒ©ãƒ¼ã§ç™ºä¿¡å…ƒã‚’ãƒã‚§ãƒƒã‚¯ HTTPãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’å—ã‘ãŸã¨ãã€ãã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆãŒã©ã“ã®Webãƒšãƒ¼ã‚¸ã‹ã‚‰ç™ºè¡Œã•ã‚ŒãŸã‚‚ã®ã‹ã‚’ç¤ºã™ãƒªãƒ•ã‚¡ãƒ©ãƒ¼ï¼ˆREFERERï¼‰ã¨å‘¼ã°ã‚Œã‚‹æƒ…å ±ã‚’å¾—ã‚‹ã“ã¨ãŒã§ãã‚‹ã€‚ã“ã®æƒ…å ±ã‚’æ´»ç”¨ã—ã€æœ¬æ¥æ„å›³ã—ãŸWebãƒšãƒ¼ã‚¸ä»¥å¤–ã‹ã‚‰ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’æ‹’å¦ã™ã‚‹ã“ã¨ã§ã€CSRFã«ã‚ˆã‚‹å¤–éƒ¨ã‹ã‚‰ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’é˜²ãã“ã¨ãŒã§ãã‚‹ã€‚ ãŸã ã—ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒãƒªãƒ•ã‚¡ãƒ©ãƒ¼æƒ…å ±ã‚’å‡ºåŠ›ã—ãªã„ãƒ–ãƒ©ã‚¦ã‚¶ã‚’ä½¿ã£ã¦ã„ã‚‹å ´åˆã€ã“ã®ãƒã‚§ãƒƒã‚¯ã‚’å°Žå…¥ã™ã‚‹ã¨æ£å½“ãªæ“ä½œã§ã‚‚å—ã‘ä»˜ã‘ãªããªã£ã¦ã—ã¾ã†ã€‚ æ‡¸å¿µã•ã‚Œã‚‹ãƒªãƒ•ã‚¡ãƒ©ãƒ¼æƒ…å ±å½è£…ã«å¯¾ã™ã‚‹å•é¡Œã ãŒã€ä»¥å‰ã¯ãƒªãƒ•ã‚¡ãƒ©ãƒ¼æƒ…å ±ã‚’ç™ºè¡Œã™ã‚‹ã®ã¯æ”»æ’ƒã‚’è¸ã‚“ã§ã—ã¾ã£ãŸè‡ªåˆ†è‡ªèº«ãªã®ã§ã€ãƒªãƒ•ã‚¡ãƒ©ãƒ¼æƒ…å ±ã‚’å½è£…ã™ã‚‹å‹•æ©ŸãŒãªã
itochan 2008/02/09
security

javascript

XSSè„†å¼±æ€§

CSRF
ãƒªãƒ³ã‚¯
@IT: ã€Œã¼ãã¯ã¾ã¡ã¡ã‚ƒã‚“ã€ â€•â€•çŸ¥ã‚‰ã‚Œã–ã‚‹CSRFæ”»æ’ƒ
ã‚ã‚‹æ—¥ã€å¤§æ‰‹SNSï¼ˆSocial Networking Siteï¼‰ã®mixiã®æ—¥è¨˜ã«ã“ã®ã‚ˆã†ãªæ›¸ãè¾¼ã¿ãŒã‚ã£ãŸã€‚ãã‚Œã‚‚1äººã ã‘ã§ãªãã€åŒæ—¥ã«æ•°å¤šãã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®æ—¥è¨˜ã«åŒã˜æ–‡é¢ãŒæŽ²è¼‰ã•ã‚Œã¦ã„ãŸã€‚ ã“ã‚Œã¯ã€å˜ã«ã“ã®ã‚ˆã†ãªæ–‡ç« ãŒã¯ã‚„ã‚Šã€ãƒ¦ãƒ¼ã‚¶ãƒ¼è‡ªèº«ãŒæ„å›³ã—ã¦æŽ²è¼‰ã—ãŸã®ã§ã¯ãªãã€ã‚ã‚‹ä»•æŽ›ã‘ã«ã‚ˆã£ã¦ãƒ¦ãƒ¼ã‚¶ãƒ¼è‡ªèº«ãŒæ°—ä»˜ã‹ãªã„ã†ã¡ã«å¼•ãèµ·ã“ã•ã‚ŒãŸç¾è±¡ãªã®ã§ã‚ã‚‹ã€‚ãã®ä»•æŽ›ã‘ã¨ã¯ã€CSRFï¼ˆCross-Site Request Forgeriesï¼‰ã¨å‘¼ã°ã‚Œã‚‹æ”»æ’ƒæ‰‹æ³•ã®ä¸€ç¨®ã ã€‚ ç·¨é›†éƒ¨æ³¨ï¼š ç¾åœ¨ã€ã€Œã¯ã¾ã¡ã¡ã‚ƒã‚“ã€ãƒˆãƒ©ãƒƒãƒ—ã¯ã€mixié‹å–¶è€…ã«ã‚ˆã‚Šå¯¾ç–ã•ã‚Œã¦ã„ã¾ã™ã€‚ä¸Šè¨˜ã®ã‚µãƒ³ãƒ—ãƒ«ã¯ã€mixié¢¨ã«å†æ§‹æˆã—ãŸã‚‚ã®ã§ã™ã€‚ æœ¬ç¨¿ã®å†…å®¹ã‚’æ¤œè¨¼ã™ã‚‹å ´åˆã¯ã€å¿…ãšå½±éŸ¿ã‚’åŠã¼ã•ãªã„é™ã‚‰ã‚ŒãŸç’°å¢ƒä¸‹ã§è¡Œã£ã¦ä¸‹ã•ã„ã€‚ã¾ãŸã€æœ¬ç¨¿ã‚’åˆ©ç”¨ã—ãŸè¡Œç‚ºã«ã‚ˆã‚‹å•é¡Œã«é–¢ã—ã¾ã—ã¦ã¯ã€ç†è€…ãŠã‚ˆã³ã‚¢ã‚¤ãƒ†ã‚£ãƒ¡ãƒ‡ã‚£ã‚¢æ ªå¼ä¼šç¤¾ã¯ä¸€åˆ‡è²¬ä»»ã‚’è² ã„ã‹ãã¾ã™ã€‚ã”äº†æ‰¿ãã ã•ã„
itochan 2007/12/21
security

ã¯ã¾ã¡ã¡ã‚ƒã‚“

csrf
ãƒªãƒ³ã‚¯
1