[B! security] joker1007ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

joker1007 id:joker1007

securityã«é–¢ã™ã‚‹joker1007ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (86)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Let's EncryptãŒã¯ã¾ã£ãŸGolangã®è½ã¨ã—ç©´ - ã¼ã¡ã¼ã¡æ—¥è¨˜
0. çŸã„ã¾ã¨ã‚ 300ä¸‡ä»¥ä¸Šã®è¨¼æ˜Žæ›¸ã®å¤±åŠ¹ã‚’è¿«ã‚‰ã‚ŒãŸLet's Encryptã®ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆã¯ã€ŒGolangã§ã‚ˆãã‚ã‚‹é–“é•ã„ã€ã¨æ›¸ã‹ã‚Œã¦ã„ã‚‹ã‚ˆã†ãªãƒã‚°ãŒåŽŸå› ã§ã—ãŸã€‚ 1. ã¯ã˜ã‚ã«ã€ Let's Encryptã¯ã€ç„¡æ–™ã§ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã‚’è‡ªå‹•åŒ–ã—ã¦ç™ºè¡Œã™ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ã‚’è¡Œã†éžå–¶åˆ©å›£ä½“ã¨ã—ã¦2014å¹´ã«è¨ç«‹ã•ã‚Œã¾ã—ãŸã€‚ 2015å¹´ã«ã‚µãƒ¼ãƒ“ã‚¹é–‹å§‹ã•ã‚Œã‚‹ã¨è¨¼æ˜Žæ›¸ã®ç™ºè¡Œæ•°ã¯ãã‚“ãã‚“ä¼¸ã³ã€å…ˆæœˆæœ«ã®ãƒ—ãƒ¬ã‚¹ãƒªãƒªãƒ¼ã‚¹ã§ã¯ç´¯è¨ˆ10å„„æžšã®ã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã‚’ç™ºè¡Œã—ãŸã“ã¨ãŒã‚¢ãƒŠã‚¦ãƒ³ã‚¹ã•ã‚Œã¾ã—ãŸã€ŒLet's Encrypt Has Issued a Billion Certificatesã€ã€‚CTLogã®èª¿æŸ»ã‹ã‚‰ã€2020å¹´2æœˆæœ«ã®æ™‚ç‚¹ã§ã¯æœ‰åŠ¹ãªå…¨è¨¼æ˜Žæ›¸ã®38.4%ãŒLet's Encryptã®è¨¼æ˜Žæ›¸ã§ã‚ã‚‹ã¨ã¿ã‚‰ã‚Œã¦ã„ã¾ã™ã€ŒCertificate Validity Datesã€ã€‚ ç„¡æ–™ã®è¨¼æ˜Žæ›¸ã‚’æä¾›ã—ã¦ã‚‚ã‚‰ãˆã‚‹ã®ã¯éžå¸¸ã«å¬‰ã—
joker1007 2020/03/10
security

ssl
ãƒªãƒ³ã‚¯
AWS Certificate Manager Private Certificate Authority now supports root CA hierarchies
Certificate authority (CA) administrators can now create a private CA hierarchy, including root and subordinate CAs. A CA hierarchy is a way to organize CAs that provides strong security and restrictive access controls for the most-trusted root CA at the top of the hierarchy, while allowing more permissive access and bulk certificate issuance for subordinate CAs lower in the trust chain. This feat
joker1007 2019/07/24
ãŠãŠï¼

aws

security
ãƒªãƒ³ã‚¯
HashDoSè„†å¼±æ€§ã¨ã®æˆ¦ã„ï¼ Rubyã‚³ãƒŸãƒƒã‚¿ãƒ¼ãƒ»åœéƒ¨æ˜Œå¹³ãŒæ˜Žã‹ã™ãƒ—ãƒã‚°ãƒ©ãƒ å …ç‰¢åŒ–ã®ãƒŽã‚¦ãƒã‚¦ - ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢Hubï½œè‹¥æ‰‹Webã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ã‚ãƒ£ãƒªã‚¢ã‚’è€ƒãˆã‚‹ï¼
HashDoSè„†å¼±æ€§ã¨ã®æˆ¦ã„ï¼Â Rubyã‚³ãƒŸãƒƒã‚¿ãƒ¼ãƒ»åœéƒ¨æ˜Œå¹³ãŒæ˜Žã‹ã™ãƒ—ãƒã‚°ãƒ©ãƒ å …ç‰¢åŒ–ã®ãƒŽã‚¦ãƒã‚¦ éŽåŽ»ã€HashDosã®å½±éŸ¿ã‚’å—ã‘ãŸRubyã€‚è¨€èªžé–‹ç™ºè€…ã¯ã„ã‹ã«ã—ã¦ã“ã†ã—ãŸå•é¡Œã«å¯¾å¿œã—ã¦ããŸã®ã§ã—ã‚‡ã†ã‹ã€‚ã‚³ãƒŸãƒƒã‚¿ãƒ¼ã§ã‚ã‚‹åœéƒ¨æ°ã®è²´é‡ãªè¨˜éŒ²ã‚’å…¬é–‹ã—ã¾ã™ã€‚ 2011å¹´ã®æœ«é ƒã€HashDoSã¨ã„ã†è„†å¼±æ€§ãŒå…¬è¡¨ã•ã‚Œã€Rubyã‚‚ã“ã®å½±éŸ¿ã‚’å—ã‘ãŸã€‚æœ¬ç¨¿ã®ç†è€…ã§ã‚ã‚‹åœéƒ¨æ˜Œå¹³ï¼ˆã†ã‚‰ã¹ãƒ»ã—ã‚‡ã†ã¸ã„ï¼@shyouheiï¼ä»¥ä¸‹ã€åœéƒ¨ï¼‰ã¯ã€å ±å‘Šå½“åˆã‹ã‚‰Rubyå´ã®ãƒãƒ¼ãƒ ãƒ¡ãƒ³ãƒãƒ¼ã¨ã—ã¦ãƒ—ãƒã‚°ãƒ©ãƒ æœ¬ä½“ã®ä¿®æ£ã‚’æ‹…å½“ã—ãŸã€‚ä»¥ä¸‹ã¯ãã®è¨˜éŒ²ã§ã‚ã‚‹ã€‚è¨€èªžé–‹ç™ºè€…ãŸã¡ãŒæ™®æ®µã©ã®ã‚ˆã†ãªã“ã¨ã‚’è€ƒãˆã€ã©ã†ã„ã£ãŸæŠ€è¡“ã‚’ç”¨ã„ã¦é–‹ç™ºã‚„ãƒã‚°ãƒ•ã‚£ãƒƒã‚¯ã‚¹ã‚’è¡Œã£ã¦ã„ã‚‹ã®ã‹ã€‚ãã®æ¦‚è¦ã‚’çŸ¥ã£ã¦ã‚‚ã‚‰ãˆã‚Œã°å¹¸ã„ã ã€‚ ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆæŒ‡å‘ã‚¹ã‚¯ãƒªãƒ—ãƒˆè¨€èªž Ruby HashDoSã®æ¦‚è¦ ãªãœç´„6å¹´å¾Œã®ä»Šã€ä¿®æ£å†…å®¹ã‚’å…¬é–‹ã™ã‚‹ã«è‡³ã£ãŸã‹ï¼Ÿ å‰å²ï¼šã™ã§ã«å†…åŒ…ã•ã‚Œã¦ã„ãŸãƒªã‚¹ã‚¯
joker1007 2018/01/11
ã™ã”ã„è©±ã ã£ãŸã€‚ãã—ã¦å”çªã«å‡ºã¦ãã‚‹akrã•ã‚“ã«ç¬‘ã£ã¦ã—ã¾ã£ãŸw

ruby

security
ãƒªãƒ³ã‚¯
Engadget | Technology News & Reviews
Research indicates that carbon dioxide removal plans will not be enough to meet Paris treaty goals
joker1007 2017/11/24
ã¾ãŸã€é¢å€’ãªè©±ãŒâ€¦â€¦ã€‚

security
ãƒªãƒ³ã‚¯
#faq
Key Reinstallation Attacks Breaking WPA2 by forcing nonce reuse Discovered by Mathy Vanhoef of imec-DistriNet, KU Leuven, 2017 Introduction We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack
joker1007 2017/10/16
è‡ªå®…ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã¨ã‹ãªã‚‰ä½•ã¨ã‹ãªã‚Šãã†ã ã—ã€ã¡ã‚ƒã‚“ã¨ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆé©ç”¨ã§ãã‚‹äººãªã‚‰è‰¯ã„ã‘ã©ã€ä¸–ã®ä¸ã®å¤§åŠã®ãƒ‡ãƒã‚¤ã‚¹ã§ãã‚“ãªã®æœŸå¾…ã§ããªã„ã—ã€ã‹ãªã‚Šãƒ¤ãƒã‚¤ã®ã§ã¯â€¦â€¦ã€‚

security
ãƒªãƒ³ã‚¯
Wi-Fiã‚’æš—å·åŒ–ã™ã‚‹WPA2ã«è„†å¼±æ€§ç™ºè¦‹ ï½žå¯¾å¿œã®ã‚ã‚‰ã‚†ã‚‹æ©Ÿå™¨ãŒå½±éŸ¿
joker1007 2017/10/16
å‰ææ¡ä»¶ã‚’æº€ãŸã™ã®ã‚‚å®¹æ˜“ã ã£ãŸã‚‰ã€å½“åˆ†ã®é–“WiFiã¯å…¬é–‹ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã¨åŒã˜æ‰±ã„ã«ãªã‚‹ã“ã¨ã«ãªã‚‹ãªâ€¦â€¦ã€‚åœ°ç„ãŒã‚„ã£ã¦ãã‚‹ãžâ€¦â€¦ã€‚

security
ãƒªãƒ³ã‚¯
Teleport
The Teleport Access PlatformThe easiest, most secure way to access and protect your infrastructure Teleport Access On-demand, least privileged access, on a foundation of cryptographic identity and zero trust
joker1007 2017/05/14
ãªã‚‹ã»ã©ã€ã“ã†ã„ã†ãƒ¢ãƒ€ãƒ³SSHã‚µãƒ¼ãƒãƒ¼ã¨ã„ã†ã‚‚ã®ãŒã‚ã‚‹ã®ã‹ã€‚Google IDã‚„ã‚‰OAuthã‚„ã‚‰2FAã‚„ã‚‰ä½¿ãˆã¦ã€ã‚¯ãƒ©ã‚¹ã‚¿åŒ–ã—ã¦é›†ä¸ç®¡ç†ã§ãã‚‹ã®ã‹ã€‚

ssh

security
ãƒªãƒ³ã‚¯
ãƒãƒ¼ãƒˆãƒŽãƒƒã‚ãƒ³ã‚°ã§10ç§’é–“ã ã‘sshdã‚’å…¬é–‹ã™ã‚‹è¨å®š - hnwã®æ—¥è¨˜
å…ˆæ—¥Twitterã«æ¬¡ã®ã‚ˆã†ãªæ›¸ãè¾¼ã¿ã‚’ã—ãŸã¨ã“ã‚æ€ã£ãŸã‚ˆã‚Šåå¿œãŒè‰¯ã‹ã£ãŸã®ã§ã€è©³ç´°ã®è¨å®šã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ UDP53ç•ªã€TCP443ç•ªã€UDP123ç•ªã¨ãƒãƒ¼ãƒˆãƒŽãƒƒã‚ãƒ³ã‚°ã‚’ã™ã‚‹ã¨TCP443ç•ªã«10ç§’ã ã‘sshdãŒç¾ã‚Œã‚‹ã€ã¨ã„ã†ä¸äºŒç—…å…¨é–‹ã®è¨å®šã‚’ã—ãŸã€‚çš†æ§˜ã«ã‚‚ãŠå‹§ã‚ã—ãŸã„ã€‚â€” hnw (@hnw) 2017å¹´3æœˆ26æ—¥ ã¨ã„ã£ã¦ã‚‚ç‰¹æ®Šãªã“ã¨ã‚’ã—ãŸã‚ã‘ã§ã¯ãªãã€knockdã§ãƒãƒ¼ãƒˆãƒŽãƒƒã‚ãƒ³ã‚°ã®è¨å®šã‚’è¡Œã„ã€iptablesã¨çµ„ã¿åˆã‚ã›ã¦å®Ÿç¾ã—ã¾ã—ãŸã€‚ ãƒãƒ¼ãƒˆãƒŽãƒƒã‚ãƒ³ã‚°ã¨ã¯ ãƒãƒ¼ãƒˆãƒŽãƒƒã‚ãƒ³ã‚°ã¨ã„ã†ã®ã¯ã€æ±ºã‚ã‚‰ã‚ŒãŸãƒãƒ¼ãƒˆã‚’æ±ºã‚ã‚‰ã‚ŒãŸé †ç•ªã§å©ãã“ã¨ã§ãƒ•ã‚¡ã‚¤ã‚¢ãƒ¼ã‚¦ã‚©ãƒ¼ãƒ«ã«ç©´ã‚’ç©ºã‘ã‚‰ã‚Œã‚‹ã‚ˆã†ãªä»•çµ„ã¿ã®ã“ã¨ã§ã™ã€‚ãƒãƒ¼ãƒˆãƒŽãƒƒã‚ãƒ³ã‚°ã‚’ä½¿ãˆã°ã€TCPã®7000ç•ªã€8000ç•ªã€9000ç•ªã®3ãƒãƒ¼ãƒˆã«ãƒ‘ã‚±ãƒƒãƒˆã‚’é€ã‚Šã¤ã‘ã‚‹ã¨22ç•ªãƒãƒ¼ãƒˆ (SSH) ã¸ã®ã‚¢ã‚¯ã‚»ã‚¹ãŒè¨±å¯ã•ã‚Œã‚‹ã€ã¨ã„ã£ãŸè¨å®šãŒã§ãã¾ã™ã€‚ ãƒãƒ¼ãƒˆãƒŽãƒƒã‚ãƒ³ã‚°ã®
joker1007 2017/03/29
ãªã‚‹ã»ã©ã€ã“ã‚Œã¯ã¡ã‚‡ã£ã¨æ¥½ã—ã„w

linux

security
ãƒªãƒ³ã‚¯
ã€ã‚„ã˜ã†ã¾PC Watchã€‘ ã€Œä»®æƒ³ãƒžã‚·ãƒ³ã§Webã‚’è¦‹ã¦ã„ã‚‹ã‹ã‚‰ãƒ›ã‚¹ãƒˆOSã¯å®‰å…¨ã€ã¨ã„ã†å¸¸è˜ã‚’è¦†ã™ ã€œ100ä¸‡ãƒ‰ãƒ«ã‚’è³ã‘ãŸãƒãƒƒã‚ãƒ³ã‚°å¤§ä¼šã§è¨¼æ˜Žã•ã‚Œã‚‹
joker1007 2017/03/24
ãã‚“ãªå¸¸è˜ã¯ç‰¹ã«ç„¡ã„ã¨æ€ã†ãŒã€ä¸–ã®ä¸ã«ã¯æ˜ ç”»ã¿ãŸã„ãªãƒãƒƒã‚«ãƒ¼ãŒãƒžã‚¸ã§å±…ã‚‹ã‚“ã ã‚ˆãªã‚â€¦â€¦ã€‚åŠç«¯ãªã„ã€‚

security
ãƒªãƒ³ã‚¯
Announcing the first SHA1 collision
The latest news and insights from Google on security and safety on the Internet
joker1007 2017/02/24
ã¤ã„ã«SHA1ãŒç¾å®Ÿçš„ãªãƒ¬ãƒ™ãƒ«ã§è¡çªã•ã›ã‚‰ã‚Œã‚‹æ§˜ã«ãªã£ãŸã®ã‹

security
ãƒªãƒ³ã‚¯
ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼ã‚«ãƒ¼ãƒ‰ã§SSHã™ã‚‹ - AAA Blog
ã¿ãªã•ã‚“ãƒžã‚¤ãƒŠãƒ³ãƒãƒ¼ã‚«ãƒ¼ãƒ‰ã¯ã‚‚ã†æ‰‹å…ƒã«å±Šãã¾ã—ãŸã‹? ç§ã®ä½ã‚€å¤§ç”°åŒºã¯ã¨ã¦ã‚‚æ··é›‘ã—ã¦ã„ã¦ç”³è«‹ã‹ã‚‰5ãƒ¶æœˆã‹ã‹ã£ã¦ä»Šæœˆã‚„ã£ã¨äº¤ä»˜ã—ã¦ã‚‚ã‚‰ã†ã“ã¨ãŒã§ãã¾ã—ãŸã€‚ ã“ã®ã‚«ãƒ¼ãƒ‰ã«å«ã¾ã‚Œã‚‹å…¬çš„å€‹äººèªè¨¼æ©Ÿèƒ½ã¯ä»¥å‰ã‹ã‚‰ä½åŸºã‚«ãƒ¼ãƒ‰ã«å…¥ã£ã¦ã„ãŸã‚‚ã®ã§ã™ãŒã€ä»Šå¹´ã‹ã‚‰æ°‘é–“åˆ©ç”¨ã‚‚ã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã—ãŸã€‚ ã—ã‹ã—ã€ã“ã®å…¬çš„å€‹äººèªè¨¼ã§ã™ãŒè©³ç´°ãªä»•æ§˜ãŒå…¬é–‹ã•ã‚Œã¦ã„ãªã„ãŸã‚ã€å•†ç”¨åˆ©ç”¨ã—ã‚ˆã†ã¨ã„ã†å‹•ãã¯ã¾ã èžãã¾ã›ã‚“ã—ã€æ—¢ã«å‹•ã„ã¦ã„ã‚‹è¡Œæ”¿ã‚µãƒ¼ãƒ“ã‚¹ã®e-govã‚„e-taxã¯IEé™å®šã§ã€ã„ã¾ã ã«Java AppletãŒä½¿ã‚ã‚Œã¦ã„ã‚‹ãªã©å¤§å¤‰æ®‹å¿µãªçŠ¶æ³ã§ã™ã€‚ ã‚«ãƒ¼ãƒ‰ã«å…¥ã£ã¦ã„ã‚‹é›»åè¨¼æ˜Žæ›¸ã¨2048bitã®RSAç§˜å¯†éµã¯æ§˜ã€…ãªç”¨é€”ã«æ´»ç”¨ã§ãã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã®ã«ã€ã›ã£ã‹ãç¨Žé‡‘ã‚’è²»ã‚„ã—ã¦ä½œã£ãŸã‚·ã‚¹ãƒ†ãƒ ãŒä½¿ã‚ã‚Œãªã„ã®ã¯ã‚‚ã£ãŸã„ãªã„ã§ã™ãã€‚ æ°‘é–“åˆ©ç”¨ã®ç¬¬ä¸€æ©ã¨ã—ã¦ã€ã‚«ãƒ¼ãƒ‰ã«å…¥ã£ã¦ã„ã‚‹RSAéµã‚’åˆ©ç”¨ã—ã¦è‡ªå®…ã‚µãƒ¼ãƒãƒ¼ã«SSHãƒã‚°ã‚¤ãƒ³ã—ã¦ã¿ã¾ã—ã‚‡ã†!
joker1007 2016/07/01
security

ssh
ãƒªãƒ³ã‚¯
1ä¸‡å°ã‚‚ã®ãƒ«ãƒ¼ã‚¿ãƒ¼ã‚’ä½•è€…ã‹ãŒå‹æ‰‹ã«ãƒãƒƒã‚¯ã—ã¦ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’é«˜ã‚ã¦ã„ãŸã“ã¨ãŒç™ºè¦š
by Peter Dahlgren ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã«ä¾µå…¥ã—ãŸãƒžãƒ«ã‚¦ã‚§ã‚¢ã¯ã€ä¾µå…¥ã—ãŸå¾Œã«ã•ã‚‰ãªã‚‹æ”»æ’ƒã‚’ä»•æŽ›ã‘ã‚‹ãŸã‚ã«ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®ãƒ«ãƒ¼ã‚¿ãƒ¼ã‚’åˆ©ç”¨ã™ã‚‹ã“ã¨ãŒå¤šã€…ã‚ã‚Šã¾ã™ã€‚ã—ã‹ã—ã€SymantecãŒç™ºè¦‹ã—ãŸLinux.Wifatchã¨ã„ã†ãƒžãƒ«ã‚¦ã‚§ã‚¢ã¯ã€Linuxã‚’æè¼‰ã™ã‚‹1ä¸‡å°ã‚‚ã®ãƒ«ãƒ¼ã‚¿ãƒ¼ã«æ„ŸæŸ“ã—ã¦ãŠããªãŒã‚‰ã€æ‚ªç”¨ã§ã¯ãªãã‚€ã—ã‚ã€Œãƒ‡ãƒã‚¤ã‚¹ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’é«˜ã‚ã‚‹å‹•ãã€ã‚’ã—ã¦ã„ãŸã“ã¨ãŒã‚ã‹ã‚Šã¾ã—ãŸã€‚ Is there an Internet-of-Things vigilante out there? | CommunautÃ© Symantec Connect http://www.symantec.com/connect/blogs/there-internet-things-vigilante-out-there Someone Has Hacked 10,000 Home Routers
joker1007 2015/10/02
ITããšã¿å°åƒ§ã ã€‚

security
ãƒªãƒ³ã‚¯
Linuxã§è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸå ´åˆã®å¯¾å¿œæ–¹æ³• ã¾ã¨ã‚ | DevelopersIO
ã¯ã˜ã‚ã« å…ˆæ—¥ã€Amazon Linuxã§è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸéš›ã«å¼Šç¤¾ã®AWSãƒãƒ¼ãƒ ã®ãƒ¡ãƒ³ãƒãƒ¼ãŒä»¥ä¸‹ã®è¨˜äº‹ã‚’å…¬é–‹ã—ã¦ã„ã¾ã—ãŸã€‚ç§ã¯æœ€è¿‘ã¾ã§ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ã®é–‹ç™ºæ¡ˆä»¶ã‚’ä¸»ã«æ‹…å½“ã—ã¦ã„ãŸã®ã§è‡ªåˆ†ã®æ¥å‹™ã«ã¯ã‚ã¾ã‚Šé–¢ã‚ã‚Šã¯ãªã„ã®ã§ã™ãŒã€ã©ã®ã‚ˆã†ãªæ‰‹é †ã§Linuxã®è„†å¼±æ€§ã«å¯¾å¿œã—ã¦ã„ã‚‹ã®ã‹èˆˆå‘³ãŒã‚ã£ãŸã®ã§ç¤¾å†…ã®äººã«èžã„ãŸã‚Šèª¿ã¹ã¦ã¿ãŸã“ã¨ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ [Amazon Linux] OpenSSLã®è„†å¼±æ€§(CVE-2015-1793)ã«ã¤ã„ã¦ 1.è„†å¼±æ€§ã®æƒ…å ±ã‚’å¾—ã‚‹ ã¾ãšã¯è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸæƒ…å ±ã¯ã©ã“ã‹ã‚‰å¾—ã‚‹ã®ã§ã—ã‚‡ã†ã‹ï¼Ÿè„†å¼±æ€§ã«é–¢ã™ã‚‹æƒ…å ±ã¯ä»¥å‰ã‹ã‚‰ä»¥ä¸‹ã®ã‚µã‚¤ãƒˆã®RSSãªã©ã‹ã‚‰æƒ…å ±ã‚’å¾—ã‚‹ã“ã¨ãŒã§ãã¾ã™ãŒæœ€è¿‘ã¯Twitterè¦‹ã¦ãŸã‚‰çŸ¥ã£ãŸã€ãªã‚“ã¦ã“ã¨ã‚‚ã‚ã‚‹ãã†ã§ã™ã€‚ Japan Vulnerability Notes JPCERT ã‚³ãƒ¼ãƒ‡ã‚£ãƒãƒ¼ã‚·ãƒ§ãƒ³ã‚»ãƒ³ã‚¿ãƒ¼ ä»¥ä¸‹ã¯Twitterã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã§ã™ã€‚ JVN
joker1007 2015/07/28
security
ãƒªãƒ³ã‚¯
æœ€æ–°ã®OS Xï¼†iOSã®Keychainã«ä»–ã®ã‚¢ãƒ—ãƒªã‚’çµŒç”±ã—ã¦ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’å–å¾—ã§ãã¦ã—ã¾ã†è„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚Œã€ã“ã®è„†å¼±æ€§ã‚’åˆ©ç”¨ã§ãã‚‹ã‚¢ãƒ—ãƒªãŒAppStoreã®å¯©æŸ»ã‚’é€šéŽã—ãŸã‚‚ã‚ˆã†ã€‚
The Registerã«ã‚ˆã‚‹ã¨ã“ã®è„†å¼±æ€§ã¯ã‚¢ãƒ¡ãƒªã‚«ã®ã‚¤ãƒ³ãƒ‡ã‚£ã‚¢ãƒŠå¤§å¦ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…Luyi Xingã•ã‚“ãªã©6äººã«ã‚ˆã£ã¦2014å¹´10æœˆã«ç™ºè¦‹ã€ç›´ã¡ã«Appleã«å ±å‘Šã•ã‚Œã€Appleã‚‚ã“ã®è„†å¼±æ€§ã®é‡å¤§æ€§ã«æ°—ã¥ã6ãƒ¶æœˆé–“ å…¬è¡¨ã‚’å·®ã—æŽ§ãˆã‚‹ã‚ˆã†è¦æœ›ã—ãŸãã†ã§ã™ãŒã€ç¾åœ¨ã«è‡³ã£ã¦ã‚‚ä½•ã®é€£çµ¡ã‚‚ãªãã€æœ€æ–°ã®OS X 10.10.3ãªã©ã§ã‚‚ä¿®æ£ã•ã‚Œã¦ã„ãªã„ã“ã¨ã‹ã‚‰å…¬é–‹ã«è¸ã¿åˆ‡ã£ãŸãã†ã§ã€ Lead researcher Luyi Xing told El Reg he and his team complied with Appleâ€™s request to withhold publication of the research for six months, but had not heard back as of the time of writing. [..] Xing says he
joker1007 2015/06/19
security

mac
ãƒªãƒ³ã‚¯
ã‚¯ãƒ©ã‚¦ãƒ‰åž‹Webè„†å¼±æ€§è¨ºæ–ãƒ„ãƒ¼ãƒ«ã€ŒVAddyã€
ä»Šæ—¥ã‹ã‚‰ä½¿ãˆã‚‹ã‚¯ãƒ©ã‚¦ãƒ‰åž‹ Webè„†å¼±æ€§è¨ºæ–ãƒ„ãƒ¼ãƒ« Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§è¨ºæ–ã‚’ ç¤¾å†…ã§å®Ÿæ–½ã—ã¾ã›ã‚“ã‹ï¼Ÿ VAddyãªã‚‰ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å°‚é–€å®¶ä»¥å¤–ã®æ–¹ã‚‚ è„†å¼±æ€§è¨ºæ–ãŒã§ãã¾ã™ã€‚ 1é€±é–“ç„¡æ–™ãƒˆãƒ©ã‚¤ã‚¢ãƒ«ã§ã¯ã˜ã‚ã‚‹ ã‚ªãƒ³ãƒ©ã‚¤ãƒ³å€‹åˆ¥ç›¸è«‡ä¼š å®Ÿæ–½ä¸ï¼
joker1007 2015/05/25
ä¸€åº¦è©¦ã—ã¦ã¿ãŸã„ã€‚

security

ci
ãƒªãƒ³ã‚¯
Logjam Attackã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
Diffie-Hellmanï¼ˆDHï¼‰éµäº¤æ›ã®è„†å¼±æ€§ã‚’ä½¿ã£ãŸTLSãƒ—ãƒãƒˆã‚³ãƒ«ã«å¯¾ã™ã‚‹æ”»æ’ƒã€ŒLogjam Attackã€ã«é–¢ã™ã‚‹æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ è„†å¼±æ€§æ¦‚è¦ è„†å¼±æ€§ã®æ¦‚è¦æƒ…å ±ã¯æ¬¡ã®é€šã‚Šã€‚ æ„›ç§° Logjam Attack (æ”»æ’ƒæ‰‹æ³•ã®æ„›ç§°) Webã‚µã‚¤ãƒˆ https://weakdh.org/ ã‚¢ã‚¤ã‚³ãƒ³ ç„¡ã— CVE CVE-2015-1716(Microsoft) ç™ºè¦‹è€…å æ¬¡ã®åˆåŒãƒãƒ¼ãƒ ã«ã‚ˆã‚Šç™ºè¦‹ ãƒ•ãƒ©ãƒ³ã‚¹å›½ç«‹ç§‘å¦ç ”ç©¶ã‚»ãƒ³ã‚¿ãƒ¼(CNRS) ãƒ•ãƒ©ãƒ³ã‚¹å›½ç«‹æƒ…å ±å¦è‡ªå‹•åˆ¶å¾¡ç ”ç©¶æ‰€(INRIA) Microsoft Research ã‚¸ãƒ§ãƒ³ã‚ºãƒ›ãƒ—ã‚ãƒ³ã‚¹å¤§å¦ ãƒŸã‚·ã‚¬ãƒ³å¤§å¦ ãƒšãƒ³ã‚·ãƒ«ãƒãƒ‹ã‚¢å¤§å¦ Logjam Attackã®æ¦‚è¦ Diffie-Hellmanï¼ˆDHï¼‰éµäº¤æ›ã®è„†å¼±æ€§ã€‚ã“ã®è„†å¼±æ€§ã‚’ç”¨ã„ã¦ä¸é–“è€…æ”»æ’ƒãŒè¡Œã‚ã‚Œã¦ã„ã‚‹ç’°å¢ƒã«ãŠã„ã¦ã€TLSæŽ¥ç¶šã‚’512bitã®è¼¸å‡ºã‚°ãƒ¬ãƒ¼ãƒ‰æš—å·ã«ãƒ€ã‚¦ãƒ³ã‚°ãƒ¬ãƒ¼ãƒ‰ã—ã€é€šä¿¡çµŒ
joker1007 2015/05/24
security
ãƒªãƒ³ã‚¯
æ–°ç¨®ã‚¦ã‚¤ãƒ«ã‚¹:ãƒ¯ãƒ³ã‚¿ã‚¤ãƒ ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ç„¡åŠ¹åŒ–â€¦ï¼˜ä¸‡å°è¶…æ„ŸæŸ“ - æ¯Žæ—¥æ–°èž
joker1007 2015/04/10
è‡ªå‹•æ“ä½œã•ã‚Œã¦ã‚‚ç‰©ç†ã‚«ãƒ¼ãƒ‰ã®ãƒ©ãƒ³ãƒ€ãƒ ãªç•ªå·å°‹ãã‚‰ã‚Œã‚‹ã‹æŒ¯ã‚Šè¾¼ã¿æ™‚ã«äºŒæ®µéšŽèªè¨¼ã‚ã‚‹ã®ãŒæ™®é€šãªã®ã§å¤§ä½“å¤§ä¸ˆå¤«ã ã¨æ€ã†ã‚“ã ãŒã€‚ãã‚‚ãã‚‚æ–°ç¨®ã˜ã‚ƒãªã„ãã€‚

security
ãƒªãƒ³ã‚¯
ã€ŒLINEã€ã«æ·±åˆ»ãªè„†å¼±æ€§ã€€å¤–éƒ¨ã‹ã‚‰å…¨ãƒˆãƒ¼ã‚¯å±¥æ´ã‚’æŠœãå‡ºã•ã‚Œã‚‹å±é™ºæ€§ã‚ã‚Š - THE ZERO/ONE
å…¨ä¸–ç•Œã§5å„„äººä»¥ä¸ŠãŒåˆ©ç”¨ã—ã¦ã„ã‚‹ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ãƒ»ã‚¢ãƒ—ãƒªã€ŒLINEã€ã«æ·±åˆ»ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è„†å¼±æ€§ãŒå˜åœ¨ã—ã¦ã„ãŸã“ã¨ãŒåˆ¤ã£ãŸã€‚ã“ã®è„†å¼±æ€§ã‚’æ‚ªæ„ã‚ã‚‹æ”»æ’ƒè€…ã«çªã‹ã‚Œã‚‹ã¨ã€åˆ©ç”¨è€…ã®ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã«ä¿å˜ã•ã‚Œã¦ã„ã‚‹LINEå†…ã®ãƒˆãƒ¼ã‚¯å±¥æ´ã‚„å†™çœŸã€å‹é”ãƒªã‚¹ãƒˆãªã©ã‚’å¤–éƒ¨ã‹ã‚‰ä¸æ£ã«æŠœãå‡ºã•ã‚ŒãŸã‚Šã€æ”¹ç«„ã•ã‚Œã‚‹æã‚ŒãŒã‚ã‚‹ã€‚LINEã¯3æœˆ4æ—¥ã«ã€ã“ã®è„†å¼±æ€§ã‚’ä¿®æ£ã—ãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’ç·Šæ€¥ãƒªãƒªãƒ¼ã‚¹ã—ã¦ã„ã‚‹ã€‚åˆ©ç”¨è€…ã¯è‡ªèº«ã®ã‚¢ãƒ—ãƒªãŒæœ€æ–°ç‰ˆã«ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã•ã‚Œã¦ã„ã‚‹ã‹ã©ã†ã‹ã‚’è‡³æ€¥ç¢ºèªã—ãŸã»ã†ãŒã„ã„ã ã‚ã†ã€‚ ã“ã®è„†å¼±æ€§ã¯ã‚µã‚¤ãƒãƒ¼ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ»ãƒ©ãƒœã®ã‚¹ãƒ—ãƒ©ã‚¦ãƒˆï¼ˆæœ¬è¨˜äº‹æŽ²è¼‰ã®ã€Žã‚µã‚¤ãƒãƒ¼ã‚¤ãƒ³ã‚·ãƒ‡ãƒ³ãƒˆãƒ»ãƒ¬ãƒãƒ¼ãƒˆã€ç™ºè¡Œå…ƒï¼‰ãŒç™ºè¦‹ã—ã€1æœˆ30æ—¥ã«ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ç‰ã®è„†å¼±æ€§æƒ…å ±ã‚’å–ã‚Šæ‰±ã†IPAï¼ˆç‹¬ç«‹è¡Œæ”¿æ³•äººæƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼‰ã«å ±å‘Šã—ãŸã‚‚ã®ã ã€‚IPAã‹ã‚‰2æœˆ2æ—¥ã«è„†å¼±æ€§ã®é€šçŸ¥ã‚’å—ã‘ãŸLINEã¯ã€2æœˆ12æ—¥ã«è„†å¼±æ€§ã®ä¸€éƒ¨ã«ã¤ã„ã¦ã‚µãƒ¼ãƒãƒ¼å´ã§å¯¾ç–ã€‚3æœˆ4æ—¥ã®ã‚¢ãƒƒãƒ—
joker1007 2015/03/16
åå‰ã§XSSèµ·ãã‚‹ã®æµçŸ³ã«æœæ’°ã ãªâ€¦â€¦ã€‚

security
ãƒªãƒ³ã‚¯
ä¸–ç•Œã®ãƒ¡ãƒ¼ãƒ«ã®æš—å·åŒ–ã¯ãŸã£ãŸä¸€äººã®ç”·ã«ä¾å˜ã—ã¦ãŠã‚Šã€é–‹ç™ºè³‡é‡‘ã¯ã‚¼ãƒã«ãªã£ã¦ã—ã¾ã£ã¦ã„ã‚‹ã¨ã„ã†è¡æ’ƒã®äº‹å®ŸãŒåˆ¤æ˜Ž
ä¸–ç•Œä¸ã®ã‚¸ãƒ£ãƒ¼ãƒŠãƒªã‚¹ãƒˆã‚„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é–¢é€£ã«æ•æ„Ÿãªäººã€ã•ã‚‰ã«ã¯ã‚¨ãƒ‰ãƒ¯ãƒ¼ãƒ‰ãƒ»ã‚¹ãƒŽãƒ¼ãƒ‡ãƒ³æ°ã®ã‚ˆã†ãªå†…éƒ¨å‘Šç™ºè€…ã¾ã§ã‚‚ãŒä½¿ç”¨ã—ã¦ã„ã‚‹ã€ç„¡æ–™ã®ãƒ¡ãƒ¼ãƒ«æš—å·åŒ–ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ãŒã€ŒGNU Privacy Guard(GPG)ã€ã§ã™ã€‚ã“ã®æš—å·åŒ–ã‚½ãƒ•ãƒˆã‚’1997å¹´ã‹ã‚‰ãŸã£ãŸä¸€äººã§é–‹ç™ºã—ã¦ããŸã®ãŒãƒ´ã‚§ãƒ«ãƒŠãƒ¼ãƒ»ã‚³ãƒƒãƒ›æ°ã§ã€å½¼ãŒç½®ã‹ã‚Œã¦ã„ã‚‹åŽ³ã—ã„ç¾çŠ¶ã‚’ProPublicaãŒæ˜Žã‹ã—ã¦ã„ã¾ã™ã€‚ The Worldâ€™s Em ail Encryption Software Relies on One Guy, Who is Going Broke - ProPublica http://www.propublica.org/article/the-worlds-em ail-encryption-software-relies-on-one-guy-who-is-going-broke ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ã‚³ãƒƒãƒ›æ°ãŒGPGã®é–‹
joker1007 2015/02/06
ã“ã†ã„ã†äº‹ã«å¤§ä¼æ¥ãŒå‡ºè³‡ã—ãŸã‚Šç¨Žé‡‘ä½¿ã£ãŸã‚Šã™ã‚Œã°ã„ã„ã®ã«â€¦ã€‚2000ä¸‡ãã‚‰ã„å¤§ä¼æ¥ã®æŽ¡ç”¨è³‡é‡‘ã‹ã‚‰è€ƒãˆãŸã‚‰å¤§ã—ãŸé¡ã˜ã‚ƒãªã„ã€‚

security
ãƒªãƒ³ã‚¯
ãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§Markdownã‚’å®‰å…¨ã«å±•é–‹ã™ã‚‹ - è‘‰ã£ã±æ—¥è¨˜
ä¸ç‰¹å®šã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒå…¥åŠ›ã—ãŸMarkdownã‚’ãƒ–ãƒ©ã‚¦ã‚¶ä¸Šã§JavaScriptã‚’ä½¿ã£ã¦HTMLã«å¤‰æ›ã™ã‚‹ã¨ã„ã†å ´é¢ã«ãŠã„ã¦ã¯ã€JavaScriptã§å¤‰æ›ã—ã¦HTMLã‚’ç”Ÿæˆã™ã‚‹ã¨ã„ã†å‡¦ç†ã®éƒ½åˆä¸Šã©ã†ã—ã¦ã‚‚DOM-based XSSã®ç™ºç”Ÿã‚’è€ƒãˆãªã„ã‚ã‘ã«ã¯ã„ã‹ãªã„ã€‚ã‹ã¨ã„ã£ã¦ã€Markdownã‚’ãƒ‘ãƒ¼ã‚¹ã—HTMLã‚’ç”Ÿæˆã™ã‚‹ã¨ã„ã†å‡¦ç†ã™ã¹ã¦ã‚’XSSãŒå˜åœ¨ã—ãªã„ã‚ˆã†ã«æ³¨æ„ã—ãªãŒã‚‰è‡ªåˆ†ã§æ›¸ãã®ã‚‚å¤§å¤‰ã ã—ã€markedã‚„markdown-jsãªã©ã®æ—¢å˜ã®å¤‰æ›ç”¨ã®JSã‚’æŒã£ã¦ãã¦ã‚‚ãã‚Œã‚‰ãŒXSSã—ãªã„ã‹ã‚’ç¢ºèªã™ã‚‹ã®ã¯çµæ§‹å¤§å¤‰ã ã£ãŸã‚Šã™ã‚‹ã€‚ ãã†ã„ã£ãŸå ´åˆã«ã¯ã€Markdownã‹ã‚‰ç”Ÿæˆã•ã‚ŒãŸHTMLã‚’RickDOMã‚’é€šã™ã“ã¨ã§ã€ä¸‡ãŒä¸€HTMLå†…ã«JavaScriptãŒå«ã¾ã‚Œã¦ã„ãŸã¨ã—ã¦ã‚‚ãã‚Œã‚‰ã‚’é™¤å¤–ã—ã€è¨±å¯ã•ã‚ŒãŸè¦ç´ ã€è¨±å¯ã•ã‚ŒãŸå±žæ€§ã ã‘ã§æ§‹ç¯‰ã•ã‚ŒãŸå®‰å…¨ãªHTMLã«å†æ§‹ç¯‰ã™ã‚‹ã“ã¨ãŒã§ãã‚‹ã€‚ã•ã‚‰ã«ã€ãã†ã‚„ã£ã¦ç”Ÿæˆ
joker1007 2015/02/02
ãƒªãƒƒã‚¯ãƒ‰ãƒ ã¨ã„ã†ãƒãƒ¼ãƒŸãƒ³ã‚°ãŒè‰¯ã„

javascript

security
ãƒªãƒ³ã‚¯
1 2 3 4 5 æ¬¡ã®ãƒšãƒ¼ã‚¸