[B! æ”»æ’ƒ] kazkunã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kazkun id:kazkun

æ”»æ’ƒã«é–¢ã™ã‚‹kazkunã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (7)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

macOSã®æš—å·åŒ–zipãƒ•ã‚¡ã‚¤ãƒ«ã¯ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ç„¡ã—ã§è§£å‡ã§ãã‚‹ - NFLabs. ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãƒ–ãƒã‚°
ã¯ã˜ã‚ã« ã“ã‚“ã«ã¡ã¯ã€‚äº‹æ¥æŽ¨é€²éƒ¨ã§Offensive Teamã‚’æ‹…å½“ã™ã‚‹æ°¸äº•ã§ã™ã€‚ å…ˆæ—¥ã®Appleç™ºè¡¨ä¼šã§ã¯æ–°åž‹ã®iPhoneã‚„Apple Watchãªã©å¿ƒèºã‚‹è£½å“ãŒè‰²ã€…ã¨ç™ºè¡¨ã•ã‚Œã¾ã—ãŸãã€‚ç†è€…ã¯ç‰¹ã«æ–°åž‹iPad miniãŒå¿ƒã«åˆºã•ã£ã¦ã„ã¾ã™ã€‚ ã•ã¦ã€ä»Šå›žã¯Appleé–¢é€£ã®è©±ã¨ã—ã¦ã€ŒmacOSã®æš—å·åŒ–zipãƒ•ã‚¡ã‚¤ãƒ«ã¯ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ç„¡ã—ã§è§£å‡ã§ãã‚‹ã€ã¨ã„ã†ãƒã‚¿ã«ã¤ã„ã¦æ›¸ã„ã¦ã„ãã¾ã™ã€‚ è§£å‡ã§ãã‚‹æ¡ä»¶ ä½•ã‚’è¨€ã£ã¦ã„ã‚‹ã‚“ã ã¨æ€ã‚ã‚Œã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ãŒã€macOSã§ä½œã‚‰ã‚ŒãŸæš—å·åŒ–zipãƒ•ã‚¡ã‚¤ãƒ«ã¯ä»¥ä¸‹ã®2ã¤ã®æ¡ä»¶ã‚’æº€ãŸã™å ´åˆã«ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ç„¡ã—ã§å®¹æ˜“ã«è§£å‡ãŒå¯èƒ½ã§ã™ã€‚ zipã®æš—å·åŒ–æ–¹å¼ãŒzip cryptoã§ã‚ã‚‹ (é€šå¸¸ã®æš—å·åŒ–zipãƒ•ã‚¡ã‚¤ãƒ«ã¯åŸºæœ¬çš„ã«zip cryptoãŒåˆ©ç”¨ã•ã‚Œã¦ã„ã¾ã™) zipå†…ã®ã„ãšã‚Œã‹ã®ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªã®ä¸èº«ãŒ.DS_Storeãƒ•ã‚¡ã‚¤ãƒ«ãŠã‚ˆã³ä½•ã‚‰ã‹ã®ãƒ•ã‚¡ã‚¤ãƒ«1ã¤ã§ã‚ã‚‹ ã“ã®ã†ã¡1.ã¯åŸºæœ¬
kazkun 2021/10/06
ã‚ãƒ¼ã€ã“ã‚Œã€ç¢ºã‹ã«ãƒ€ãƒ¡ãªã‚„ã¤ã ãªã‚ã€‚æ°—ã¥ã‹ã‚“ã‹ã£ãŸã€‚æ¨ªå±•é–‹ã§thumbsdbã¨ã‹ã‚ã‚Šå¾—ã‚‹ï¼Ÿ/ã«ã—ã¦ã‚‚å‹˜é•ã„é‡ŽéƒŽãŒæ¹§ãã™ãŽã€‚appleã«ç½ªã¯ãªã„ã€‚Zipãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã«ã‚‚ç½ªã¯ãªã„ã€‚zipã®æš—å·åŒ–ãŒå¼±ã„è¨³ã˜ã‚ƒãªã„ã€‚

æš—å·åŒ–

æ”»æ’ƒ
ãƒªãƒ³ã‚¯
æ—¥æœ¬åœ°å›³ã‚»ãƒ³ã‚¿ãƒ¼ã®ã‚¦ã‚§ãƒ–ã‚µã‚¤ãƒˆãŒæ”¹ã–ã‚“ã€å†é–‹æ™‚æœŸã¯æœªå®šã€€è¢«å®³ã‚’å—ã‘ãŸã‚µãƒ¼ãƒãƒ¼ã‚’åœæ¢ã€11æ—¥åˆå‰ã”ã‚ã‹ã‚‰ã‚¢ã‚¯ã‚»ã‚¹ã§ããªã„çŠ¶æ…‹ã«
kazkun 2019/12/13
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

æ”»æ’ƒ
ãƒªãƒ³ã‚¯
ã€æ¤œè¨¼ã€‘PHPã®ã‚³ãƒžãƒ³ãƒ‰å®Ÿè¡Œã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã™ã‚‹æ”»æ’ƒé€šä¿¡ã®æ¤œçŸ¥ (CVE-2019-11043)
2019å¹´10æœˆ25æ—¥(æ—¥æœ¬æ™‚é–“)ã€PHPé–‹ç™ºãƒãƒ¼ãƒ ã¯PHP 7.1ã€7.2ã€7.3 ã«ãŠã„ã¦è„†å¼±æ€§ (CVE-2019-11043) ã‚’ä¿®æ£ã—ãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’å…¬é–‹ã—ã¾ã—ãŸã€‚ æœ¬è„†å¼±æ€§ã¯ã€nginx ã¨ PHP-FPM ã‚’çµ„ã¿åˆã‚ã›ãŸç’°å¢ƒã«ãŠã„ã¦ä»¥ä¸‹ã®ã‚ˆã†ãªè¨å®šãŒã•ã‚Œã¦ã„ã‚‹å ´åˆã«ã€ãƒªãƒ¢ãƒ¼ãƒˆã‚³ãƒžãƒ³ãƒ‰å®Ÿè¡ŒãŒå¯èƒ½ã«ãªã‚‹ã¨ã„ã†ã‚‚ã®ã§ã™ã€‚ location ~ [^/]\.php(/|$) { fastcgi_split_path_info ^(.+?\.php)(/.*)$; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_pass php:9000; ... } nginxå´ã®å‡¦ç†ã«ã¦URLã«æ”¹è¡Œã‚³ãƒ¼ãƒ‰(%0a, %0d)ãŒå«ã¾ã‚Œã‚‹éš›ã®ä¸å‚™ã«èµ·å› ã—ã€æ”»æ’ƒè€…ã¯ç´°å·¥ã—ãŸæ‚ªæ„ã®ã‚ã‚‹ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’ã‚µãƒ¼ãƒã«é€ã‚‹ã“ã¨ã§ã€æœ¬è„†å¼±æ€§ã‚’æ‚ªç”¨ã—ã¦PHPã®ä»»æ„ã®è¨å®š
kazkun 2019/11/05
è„†å¼±æ€§

æ”»æ’ƒ
ãƒªãƒ³ã‚¯
Googleã¨MozillaãŒç‹¬è£å›½å®¶ã®èªè¨¼ã™ã‚‹ãƒ«ãƒ¼ãƒˆè¨¼æ˜Žæ›¸ã‚’ãƒ–ãƒãƒƒã‚¯ã™ã‚‹ã¨ç™ºè¡¨
ç‹¬è£æ”¿æ²»ãŒç¶šãã‚«ã‚¶ãƒ•ã‚¹ã‚¿ãƒ³ã§ã¯ã€æ”¿åºœãŒèªè¨¼ã—ãŸãƒ«ãƒ¼ãƒˆè¨¼æ˜Žæ›¸ã®ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ãŒå›½æ°‘ã«å¼·åˆ¶ã•ã‚Œã¦ã„ã¾ã™ã€‚ã“ã®ãƒ«ãƒ¼ãƒˆè¨¼æ˜Žæ›¸ã‚’å°Žå…¥ã—ã¦ã—ã¾ã†ã¨HTTPSãƒ—ãƒãƒˆã‚³ãƒ«ã®æš—å·åŒ–é€šä¿¡ãŒæ”¿åºœã«å‚å—ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€ã¨ã„ã†å¼·ã„æ‰¹åˆ¤ã‚’å—ã‘ã¦ã€Mozillaã¨GoogleãŒã‚«ã‚¶ãƒ•ã‚¹ã‚¿ãƒ³æ”¿åºœã«ã‚ˆã‚‹ãƒ«ãƒ¼ãƒˆè¨¼æ˜Žæ›¸ã‚’ãƒ–ãƒãƒƒã‚¯ã™ã‚‹ã“ã¨ã‚’è¡¨æ˜Žã—ã¾ã—ãŸã€‚ Google Online Security Blog: Protecting Chrome users in Kazakhstan https://security.google blog.com/2019/08/protecting-chrome-users-in-kazakhstan.html Mozilla takes action to protect users in Kazakhstan - The Mozilla Blog https://blog.mozill
kazkun 2019/09/04
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

æ”¿åºœ

æ”»æ’ƒ

Chrome

Firefox
ãƒªãƒ³ã‚¯
ä¸–ç•Œä¸ã§æ”»æ’ƒã‚’å—ã‘ã‚‹Microsoft SQL Serverã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®è¦‹ç›´ã—ã‚’
Kaspersky Labã¯8æœˆ22æ—¥(ç±³å›½æ™‚é–“)ã€ã€ŒAgent 1433: remote attack on Microsoft SQL Serverï½œSecurelistã€ã«ãŠã„ã¦ã€Microsoft SQL ServerãŒä¸–ç•Œä¸ã§ã‚µã‚¤ãƒãƒ¼æ”»æ’ƒã®ã‚¿ãƒ¼ã‚²ãƒƒãƒˆã«ãªã£ã¦ã„ã‚‹ã¨ä¼ãˆãŸã€‚èª¿æŸ»çµæžœã«ã‚ˆã‚‹ã¨ã€ãã®å¤šãã¯ãƒ™ãƒˆãƒŠãƒ ã«å˜åœ¨ã—ã¦ãŠã‚Šã€ã“ã‚Œã«ãƒã‚·ã‚¢ã€ã‚¤ãƒ³ãƒ‰ã€ä¸å›½ã€ãƒˆãƒ«ã‚³ã€ãƒ–ãƒ©ã‚¸ãƒ«ãŒç¶šãã¨ã—ã¦ã„ã‚‹ã€‚ ãƒ™ãƒˆãƒŠãƒ (16%) ãƒã‚·ã‚¢ (12%) ã‚¤ãƒ³ãƒ‰ (7%) ä¸å›½ (5%) ãƒˆãƒ«ã‚³ (5%) ãƒ–ãƒ©ã‚¸ãƒ« (5%) 2019å¹´1æœˆã€œ2019å¹´7æœˆ Microsoft SQL Serverã¸ã®æ”»æ’ƒé »åº¦ã‚’å¯è¦–åŒ–ã—ãŸãƒžãƒƒãƒ— - è³‡æ–™: Kaspersky Lab ä¸»ãªæ”»æ’ƒæ–¹æ³•ã¯ãƒ–ãƒ«ãƒ¼ãƒˆãƒ•ã‚©ãƒ¼ã‚¹æ”»æ’ƒï¼ˆç·å½“ã‚Šæ”»æ’ƒï¼‰ã¨ã®ã“ã¨ã€‚æ”»æ’ƒè€…ã¯ã¾ãšMicrosoft SQL ServerãŒã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚ŒãŸã‚µãƒ¼ãƒã§ã‚ã‚‹ã‹
kazkun 2019/08/26
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

æ”»æ’ƒ
ãƒªãƒ³ã‚¯
NTT Security
kazkun 2019/07/26
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

æ”»æ’ƒ

è£½å“
ãƒªãƒ³ã‚¯
ã€å®ŸéŒ²ã€‘ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼æµå‡ºã€æ”»æ’ƒè€…ã®ã¨ã£ãŸè¡Œå‹•ã¨ãã®å¯¾ç– | DevelopersIO
ãã‚Œãžã‚Œã®ãƒ•ã‚§ãƒ¼ã‚ºã®è©³ç´°ã¯ä»¥ä¸‹ã®ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ å½“è©²ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚’åˆ©ç”¨ã—ãŸä¸æ£ãªæ“ä½œãŒè¡Œã‚ã‚Œã‚‹ æµå‡ºã—ãŸã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚’åˆ©ç”¨ã—ä»¥ä¸‹ã®æ“ä½œãŒè¡Œã‚ã‚Œã¾ã—ãŸã€‚APIãƒ¬ãƒ™ãƒ«ã®æ“ä½œã§ã™ã€‚ä¸€é€£ã®æ“ä½œã¯ã‚¹ã‚¯ãƒªãƒ—ãƒˆåŒ–ã•ã‚Œã¦ã„ã‚‹ã‚ˆã†ã«è¦‹å—ã‘ã‚‰ã‚Œã¾ã™ã€‚ CreateAccessKey æµå‡ºã—ãŸã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚’åˆ©ç”¨ã—æ–°è¦ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚’ä½œæˆ DeleteAccessKey æµå‡ºã—ãŸã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚’å‰Šé™¤ CreateUser IAMãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’ä½œæˆï¼ˆæ¨©é™ä¸è¶³ã«ã‚ˆã‚Šå¤±æ•—ï¼‰ CreateKeyPair æ–°è¦ã®ã‚¢ã‚¯ã‚»ã‚¹ã‚ãƒ¼ã‚’åˆ©ç”¨ã—ã‚ãƒ¼ãƒšã‚¢ã‚’ä½œæˆ RunInstances å…¨ãƒªãƒ¼ã‚¸ãƒ§ãƒ³ã§ã‚¤ãƒ³ã‚¹ã‚¿ãƒ³ã‚¹ã‚’èµ·å‹• å„ãƒªãƒ¼ã‚¸ãƒ§ãƒ³ã§20ã®ã‚¤ãƒ³ã‚¹ã‚¿ãƒ³ã‚¹ãŒç«‹ã¡ã‚ãŒã‚‹ï¼ˆèµ·å‹•ä¸Šé™ã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã®ã¾ã¾ï¼‰ m5.24xlargeãªã©ã‚¤ãƒ³ã‚¹ã‚¿ãƒ³ã‚¹ã‚µã‚¤ã‚ºãŒå¤§ãã„ã‚‚ã®ãŒå„ªå…ˆã•ã‚Œã‚‹ ãã®å¾Œã€èµ·å‹•ã—ãŸã‚¤ãƒ³ã‚¹ã‚¿ãƒ³ã‚¹ã«ã¦ä»®æƒ³é€šè²¨Moneroã®ãƒžã‚¤ãƒ‹ãƒ³ã‚°ãŒè¡Œã‚ã‚Œã¾ã—ãŸ
kazkun 2019/07/24
aws

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

æ”»æ’ƒ
ãƒªãƒ³ã‚¯
1