[B! mixi][security] mosshmã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

mosshm id:mosshm

mixiã¨securityã«é–¢ã™ã‚‹mosshmã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

å¥³æ€§ã®ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ ãƒŸã‚¯ã‚·ã‚£ã§ç›—ã¾ã‚ŒãŸç†ç”±
ãƒŸã‚¯ã‚·ã‚£ã‚’ã‚ãã£ã¦ã€åˆã®é€®æ•è€…ãŒå‡ºãŸã€‚ä»¥å‰ã®äº¤éš›ç›¸æ‰‹ã®å¥³æ€§ã®IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’ä½¿ã£ã¦ã€å¥³æ€§ã®ãƒšãƒ¼ã‚¸ã‚’ä¸æ£ã«æ›¸ãæ›ãˆãŸã€ã¨ã„ã†å®¹ç–‘ã ã€‚ãªãœãã‚“ãªã“ã¨ãŒã§ããŸã®ã‹ã€‚ æ–°èžå„ç´™ã«ã‚ˆã‚‹ã¨ã€é€®æ•ã•ã‚ŒãŸã®ã¯åå¤å±‹å¸‚ã®é›»æ°—å·¥äº‹ã‚¢ãƒ«ãƒã‚¤ãƒˆã€‚ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ç¦æ¢æ³•é•åã®å®¹ç–‘ã ã€‚å®¹ç–‘è€…ã‚’2006å¹´12æœˆ4æ—¥ã«é€®æ•ã—ãŸæ„›çŸ¥çœŒè¦ã«ã‚ˆã‚‹ã¨ã€ãƒŸã‚¯ã‚·ã‚£ã‚’å¯¾è±¡ã¨ã—ãŸä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã®æ‘˜ç™ºã¯å…¨å›½ã§åˆã‚ã¦ã ã¨ã„ã†ã€‚ å¥³æ€§ã®ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã‚’ã‚ã„ã›ã¤ãªå†…å®¹ã«æ›¸ãæ›ãˆã‚‹ èª¿ã¹ã«ã‚ˆã‚‹ã¨ã€å®¹ç–‘è€…ã¯ã€ã‹ã¤ã¦äº¤éš›ã—ã¦ã„ãŸå¥³æ€§(22)ã®ãƒŸã‚¯ã‚·ã‚£ã®IDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’æ‰‹ã«å…¥ã‚Œã€8æœˆ12æ—¥ã‹ã‚‰27æ—¥ã«ã‹ã‘ã¦ã€è¨ˆ4å›žã«ã‚ãŸã£ã¦å¥³æ€§ã®ãƒšãƒ¼ã‚¸ã«ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã—ã€ãƒ—ãƒãƒ•ã‚£ãƒ¼ãƒ«ã®ãƒšãƒ¼ã‚¸ã‚„æ—¥è¨˜ã‚’å‹æ‰‹ã«ã‚ã„ã›ã¤ãªå†…å®¹ã«æ›¸ãæ›ãˆã‚‹ãªã©ã—ã¦ã„ãŸã€‚ ã©ã†ã—ã¦ã“ã‚“ãªã“ã¨ãŒå¯èƒ½ã ã£ãŸã®ã‹ã€‚å ±é“ã§ã¯ã€ã€ŒIDã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã‚’æ‰‹ã«å…¥ã‚Œã€ã¨ã‚ã‚‹ãŒã€ãƒŸã‚¯ã‚·ã‚£ã§ã¯ã€è‡ªåˆ†ã®ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼
mosshm 2006/12/06
security

mixi
ãƒªãƒ³ã‚¯
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ - ã¯ã¦ãªã®å‘ŠçŸ¥
ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®çµ‚äº†æ—¥ã‚’2020å¹´1æœˆ31æ—¥(é‡‘)ã«æ±ºå®šã—ã¾ã—ãŸ ä»¥ä¸‹ã®ã‚¨ãƒ³ãƒˆãƒªã®é€šã‚Šã€ä»Šå¹´æœ«ã‚’ç›®å‡¦ã«ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã‚’çµ‚äº†äºˆå®šã§ã‚ã‚‹æ—¨ã‚’ãŠçŸ¥ã‚‰ã›ã—ã¦ãŠã‚Šã¾ã—ãŸã€‚ 2019å¹´æœ«ã‚’ç›®å‡¦ã«ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®æä¾›ã‚’çµ‚äº†ã™ã‚‹äºˆå®šã§ã™ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã“ã®ãŸã³ã€æ£å¼ã«çµ‚äº†æ—¥ã‚’æ±ºå®šã„ãŸã—ã¾ã—ãŸã®ã§ã€ä»¥ä¸‹ã®é€šã‚Šã”ç¢ºèªãã ã•ã„ã€‚ çµ‚äº†æ—¥: 2020å¹´1æœˆ31æ—¥(é‡‘) ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆå¸Œæœ›ç”³è«‹æœŸé™:2020å¹´1æœˆ31æ—¥(é‡‘) çµ‚äº†æ—¥ä»¥é™ã¯ã€ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã®é–²è¦§ãŠã‚ˆã³æŠ•ç¨¿ã¯è¡Œãˆã¾ã›ã‚“ã€‚æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãŒå¿…è¦ãªæ–¹ã¯ä»¥ä¸‹ã®è¨˜äº‹ã«ã—ãŸãŒã£ã¦æ‰‹ç¶šãã‚’ã—ã¦ãã ã•ã„ã€‚ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—ã«æŠ•ç¨¿ã•ã‚ŒãŸæ—¥è¨˜ãƒ‡ãƒ¼ã‚¿ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆã«ã¤ã„ã¦ - ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ ã”åˆ©ç”¨ã®ã¿ãªã•ã¾ã«ã¯ã”è¿·æƒ‘ã‚’ãŠã‹ã‘ã„ãŸã—ã¾ã™ãŒã€ã©ã†ãžã‚ˆã‚ã—ããŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 2020-06-25 è¿½è¨˜ ã¯ã¦ãªã‚°ãƒ«ãƒ¼ãƒ—æ—¥è¨˜ã®ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆãƒ‡ãƒ¼ã‚¿ã¯2020å¹´2æœˆ28
mosshm 2006/09/06
security

mixi
ãƒªãƒ³ã‚¯
fladdict.net blog: MIXIã‚’ä½¿ã£ãŸã€ãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã®å€‹äººè¿½è·¡ã‚·ã‚¹ãƒ†ãƒ
ã¨ã„ã†ã®ãŒå¯èƒ½ã ã¨è€ƒãˆä»˜ã„ã¦ã€ã¡ã‚‡ã£ã¨æ„•ç„¶ã¨ã—ãŸã€‚ è‡ªåˆ†ã®ã‚µã‚¤ãƒˆã«ã€éš ã—iframeã§MIXIã®è‡ªãƒšãƒ¼ã‚¸ã‚’èªã¿è¾¼ã¾ã›ã¦ãŠãã®ã€‚ ãã†ã™ã‚‹ã¨ã€è‡ªåˆ†ã®ã‚µã‚¤ãƒˆã‚’è¨ªã‚ŒãŸãƒã‚°ã‚¤ãƒ³ä¸ã®MIXIä¼šå“¡ã¯ã€è¶³è·¡ãŒã¤ã„ã¡ã‚ƒã†ã®ã€‚ã‚ã¨ã¯å®šæœŸçš„ã«è¶³è·¡ã‚ãƒ£ãƒƒã‚·ãƒ¥ã™ã‚‹ã€‚èª°ãŒã‚¦ãƒã®ã‚µã‚¤ãƒˆã‚’è¦‹ã¦ã‚‹ã‹ãƒãƒ¬ãƒãƒ¬ï¼ˆæ³¨ï¼šå®Ÿè£…ã—ã¦ãªã„ã‚ˆï¼‰ã€‚ ä¸€è¦‹ã€ã‚¢ãƒ›ãƒã‚¿ã ã‘ã©ã€‚ã“ã‚Œå‡„ã„ã‚·ãƒªã‚¢ã‚¹ãªå•é¡Œã ã‚ˆãªã€‚ã ã£ã¦ã•ã€ã‚¨ãƒã‚µã‚¤ãƒˆã¨ã‹ã«ãã†ã„ã†ä»•çµ„ã¿ãŒã‚ã£ãŸã‚‰ã€æœ€æ‚ªã®å ´åˆä¸€çž¬ã§å€‹äººæƒ…å ±ç‰¹å®šã•ã‚Œã‚‹ãœï¼Ÿã‚µã‚¤ãƒˆã®ã‚¯ãƒƒã‚ãƒ¼ã¨ã€MIXIã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¨ã‹ãŒçµã³ã¤ã‘ã‚‰ã‚ŒãŸæ—¥ã«ã¯ã€ä½•ãŒãŠã“ã‚‹ã‹ã‚ã‹ã£ãŸã‚‚ã‚“ã˜ã‚ƒãªã„ã§ã™ã‚ˆã€‚ ï¼‘ï¼ï¼ä¸‡è¶…éŽã®å·¨å¤§ã‚³ãƒŸãƒ¥ãƒ‹ãƒ†ã‚£ã¨ãªã£ãŸä»Šã€MIXIã®æŒã£ã¦ã„ãŸçŸ¥ã‚Šåˆã„ã¨ã®äººé–“é–¢ä¿‚ã‚’æ‹…ä¿ã¨ã—ãŸå®‰å…¨æ€§ã£ã¦ã®ã¯ã€ã‚‚ã†ã¨ã£ãã«å´©å£Šã—ã¦ã‚‹ã€‚ã•ã‚‰ã«ã‚¶ãƒã‚µãƒ¼ãƒã®ã‚ˆã†ã«ãƒãƒƒãƒˆä¸Šã«åˆ†æ•£ã™ã‚‹æƒ…å ±ã‚’ã‹ãé›†ã‚ã‚Œã°ã€ã‹ãªã‚Šã®ç²¾åº¦ã§å€‹äººæƒ…å ±ãŒç’æŠœã‘ã«ãªã‚‹å±é™ºæ€§ã‚‚å¢—ã—ã¦
mosshm 2006/02/03
mixi

security
ãƒªãƒ³ã‚¯
ã‚„ãã†ã‚‰ãŠâ€•ã‚ˆã£ã¡ã‚ƒã‚“ã‚¤ã‚«(ry - mixi hacks
è‡ªåˆ†ã®ãƒ›ãƒ¼ãƒ ãƒšãƒ¼ã‚¸ã« <img src="http://mixi.jp/show_friend.pl?id=XXXXXX" width=0 height=0> ã¨æ›¸ã„ãŸã‚Šã€CSSã« body { background: url(http://mixi.jp/show_friend.pl?id=XXXXXX); } ã¨æ›¸ã„ãŸã‚Šã™ã‚‹ã®ãŒæµè¡Œã£ã¦ã„ã‚‹ã€‚ ã“ã†ã™ã‚‹ã¨ã€ãã®ãƒšãƒ¼ã‚¸ã«ã‚¢ã‚¯ã‚»ã‚¹ã—ãŸäººã®mixiã®IDãŒã‚ã‹ã‚‹ã®ã§ã‚ã‚‹ã€‚mixiã§ã¯æœ¬åã‚’å…¥ã‚Œã¦ã„ãŸã‚Šã™ã‚‹ã“ã¨ãŒå¤šã„ã®ã§ã€ã©ã“ã®èª°ã®ã‚¢ã‚¯ã‚»ã‚¹ã ã‹ãƒãƒ¬ã¦ã—ã¾ã†ã€‚ ã“ã®ã‚ˆã†ã«ã€Œãƒ¦ãƒ¼ã‚¶ãƒ¼ã®æ„å›³ã—ãªã„ã¨ã“ã‚ã§å‹æ‰‹ã«ãƒ¦ãƒ¼ã‚¶ãƒ¼ã®æƒ…å ±ãŒé€ä¿¡ã•ã‚Œã¦ã—ã¾ã£ã¦æœ¬å½“ã«ã„ã„ã®ã‹ï¼Ÿã€ã¨æ€ã†ã®ã ãŒã€ã“ã®å•é¡Œã¯æ¡ˆå¤–æ ¹ãŒæ·±ãã†ã ã€‚
mosshm 2006/02/03
mixi

security
ãƒªãƒ³ã‚¯
ã„ã¬ãƒ“ãƒ¼ãƒ - mixiã‚¢ã‚«ã‚¦ãƒ³ãƒˆã ã ã‚‚ã‚Œä¸
http://hamachiya.com/junk/mixilog.htmlï¼ˆã¯ã¾ã¡ã‚„ï¼’ã•ã‚“ï¼‰ ã“ã‚Œmixiã¨ã—ã¦ã¯å¯¾å‡¦ã®ã—ã‚ˆã†ãŒãªã„ã‚ˆãã€‚è¶³ã‚ã¨æ©Ÿèƒ½ã«ç©´ã‚’é–‹ã‘ãªã„é™ã‚Šã€‚*1 ã‚„ã‚Šæ–¹ cgiã‚‚javascriptã‚‚é–¢ä¿‚ãªãã¦ã€ãƒšãƒ¼ã‚¸ã®ã©ã“ã‹ã« <img src="http://mixi.jp/show_friend.pl?id=è‡ªåˆ†ã®ID" width=1 height=1>ã€€ã¨æ›¸ãã ã‘ã§ã€è¨ªå•è€…ã®è¶³ã‚ã¨ãŒã¤ãã¾ã™ã€‚ ã¯ã¦ãªãƒ€ã‚¤ã‚¢ãƒªãƒ¼ã«ã‚‚åŸ‹ã‚è¾¼ã‚ã‚‹ã—ã€IEã§ã‚‚Firefoxã§ã‚‚å‹•ä½œã—ã¾ã™ã€‚ ç¾æ™‚ç‚¹ã§ã€Œè¨ªå•è€…ã®mixiã‚¢ã‚«ã‚¦ãƒ³ãƒˆã€ã¯ã€ã€Œè¨ªå•è€…ã®IPã‚¢ãƒ‰ãƒ¬ã‚¹ã€ã¨åŒã˜ã‹ã€ãã‚Œä»¥ä¸Šã«ç°¡å˜ã«åŽé›†å¯èƒ½ã§ã™ã€‚ é˜²ãŽæ–¹ mixiã‚’è¦‹ã‚‹ã¨ãã ã‘ãƒã‚°ã‚¤ãƒ³ï¼†è¦‹çµ‚ã‚ã£ãŸã‚‰ãƒã‚°ã‚¢ã‚¦ãƒˆã€‚ãƒã‚°ã‚¤ãƒ³ä¸ã¯ä»–ã®ã‚µã‚¤ãƒˆã‚’è¦‹ãªã„ã€‚ mixiã«ã¯æ™®æ®µã¨é•ã†ãƒ–ãƒ©ã‚¦ã‚¶ã‚’ä½¿ã†ã€‚ ã€Œè¦‹ã¦ã‚‹ã“ã¨ãŒãƒãƒ¬ãŸã‚‰å›°ã‚‹ã€ã‚ˆã†ãªã‚µã‚¤ãƒˆã‚’é–‹ã‹ãªã„ã€‚ *1
mosshm 2006/02/03
mixi

security
ãƒªãƒ³ã‚¯
hxxk.jp - mixi ã®æƒ…å ±ã‚’å¸¸ã«æŒã¡æ©ã„ã¦ã„ã‚‹ã¨ã€ã†ã£ã‹ã‚Šè¦‹ã‚‰ã‚ŒãŸã‚Šç›—ã¾ã‚ŒãŸã‚Šè½ã¨ã—ãŸã‚Šã™ã‚‹ã¨ã„ã†è©±
è¨˜äº‹ãƒ‡ãƒ¼ã‚¿ æŠ•ç¨¿è€… æœ›æœˆçœŸç´ æŠ•ç¨¿æ—¥æ™‚ 2006-02-03T00:07+09:00 ã‚¿ã‚° CSRF mixi ã¾ã¨ã‚ ã‚¢ã‚¯ã‚»ã‚¹ãƒã‚° ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ æ¦‚è¦ æœ¬äººã®æ„å›³ã—ãªã„ã¨ã“ã‚ã§ mixi ã®è¶³ã‚ã¨ã‚’å–å¾—ã•ã‚Œã¦ã—ã¾ã†â€¦â€¦ã¨ã„ã†è©±ã§ã™ãŒã€ mixi ã®ä¸ã®ãŸã‚ã®æƒ…å ±ã‚’æŒã£ãŸã¾ã¾å¤–å‡ºã—ãªã‘ã‚Œã°æ¸ˆã‚€ã ã‘ã§ã¯ã¨ã„ã†è©±ã€‚ ãƒªãƒ—ãƒ©ã‚¤ 2 ä»¶ã®ãƒªãƒ—ãƒ©ã‚¤ãŒã‚ã‚Šã¾ã™ã€‚ mixi ã®è¶³è·¡ã‚’æœ¬äººã«æ‚Ÿã‚‰ã‚Œãšã«å–å¾—ã™ã‚‹ãƒã‚¿ ã‚„ãã†ã‚‰ãŠï¼ã‚ˆã£ã¡ã‚ƒã‚“ã‚¤ã‚«ã‚’è²·ã„ã«è¡Œã£ãŸã¤ã„ã§ã«å®¶ã‚’è²·ã†ç”· - mixi hacks ã§ã€æœ¬äººã®æ„å›³ã—ãªã„ã¨ã“ã‚ã§è¶³ã‚ã¨ã‚’å–å¾—ã§ãã‚‹æ‰‹æ®µãŒç´¹ä»‹ã•ã‚Œã¦ã„ã¾ã™ãŒã€å®šæœŸçš„ã«ã“ã†ã„ã£ãŸè©±ã¯æµ®ä¸Šã—ã¾ã™ãã€‚ ç§ãŒçŸ¥ã‚‹é™ã‚Šã§ mixi é–¢é€£ã®ã‚‚ã®ã‚’ç°¡å˜ã«ç¾…åˆ—ã—ã¦ã¿ã¾ã—ã‚‡ã†ã€‚ ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæ®ºäººäº‹ä»¶ : æ—¥è¨˜ : 2005-02 ã«ã¦ä»Šå›žã®ã‚‚ã®ã¨åŒæ§˜ã®ç™ºæƒ³ãŒæå”±ã•ã‚Œã¾ã—ãŸã€‚æ—¢å˜ã®ã‚¢ã‚¯ã‚»ã‚¹ãƒã‚°ã‚ˆã‚Šå¤šãã®æƒ…å ±ãŒå–ã‚Œ
mosshm 2006/02/03
mixi

security
ãƒªãƒ³ã‚¯
1