[B! security] nubesã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

nubes id:nubes

securityã«é–¢ã™ã‚‹nubesã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (31)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ImageMagickã®è„†å¼±æ€§(CVE-2016-3714ä»–)ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸã€€2016-05-04 - piyolog
ç”»åƒå‡¦ç†ã‚½ãƒ•ãƒˆImageMagickã«è¤‡æ•°ã®è„†å¼±æ€§ãŒå˜åœ¨ã™ã‚‹ã¨ã—ã¦2016å¹´5æœˆ3æ—¥é ƒã€CVE-2016-3714ä»–ã®è„†å¼±æ€§æƒ…å ±ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ã“ã“ã§ã¯é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ ImageMagick é–‹ç™ºãƒãƒ¼ãƒ ã®æƒ…å ± 2016å¹´5æœˆ3æ—¥ ImageMagick Security Issue è„†å¼±æ€§æƒ…å ± å¯¾è±¡ ImageMagick CVE CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 å½±éŸ¿ RCE é‡è¦åº¦ CVE-2016-3714ï¼šImportant(Redhat)/ç·Šæ€¥(JPCERT/CC) PoC PoCå…¬é–‹ã‚ã‚Šã€‚ in the wildã¨ã®æƒ…å ±ã‚‚ã‚ã‚Šã€‚ CVSS(v2) CVE-2016-3714ï¼š6.8(Redhat)/9.3(CERT/CC) ç™ºè¦‹è€… Nikolay Ermishki
nubes 2016/05/07
imagemagick

security
ãƒªãƒ³ã‚¯
Security @Scale 2014 Recap
nubes 2015/05/29
#velocityconf

facebook

security
ãƒªãƒ³ã‚¯
osquery: approaching security the hacker way
osquery was released as an open source product by Facebook in October 2014. It is an instrumentation framework for Ubuntu, CentOS, and OS X. osquery makâ€¦
nubes 2015/05/29
facebook

security

velocity2015
ãƒªãƒ³ã‚¯
AWS æ¨©é™ç®¡ç†ã®ãƒ™ã‚¹ãƒˆãƒ—ãƒ©ã‚¯ãƒ†ã‚£ã‚¹ã«ã¤ã„ã¦è€ƒãˆã¦ã¿ãŸ | ã¯ã£ãŸã‚Šã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®å‚™å¿˜éŒ²
AWS ã¯ Management Console ã‚„ API ã§ã™ã¹ã¦æ“ä½œã§ãã¾ã™ï¼ˆDirect Connect ãªã©ä¸€éƒ¨ä¾‹å¤–ã‚‚ã‚ã‚Šã¾ã™ï¼‰ã€‚ãƒ‡ãƒ¼ã‚¿ã‚»ãƒ³ã‚¿ãƒ¼ã®ç‰©ç†çš„ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãªã©ã¯ AWS ãŒè²¬ä»»ã‚’è² ã†ã¨ã“ã‚ã§ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã¯ã¾ã£ãŸãæ„è˜ã™ã‚‹å¿…è¦ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ ãã®ä»£ã‚ã‚Šã€OS ã‚„ãƒŸãƒ‰ãƒ«ã‚¦ã‚§ã‚¢ã®ç®¡ç†ã€ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è¨è¨ˆã‚„å®Ÿè£…ã€é©åˆ‡ãªæ¨©é™ç®¡ç†ãªã©ã¯ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒè²¬ä»»ã‚’è² ã†ã¨ã“ã‚ã§ã™ã€‚ ä»Šå›žã¯ã‚ã¾ã‚Šå–ã‚Šä¸Šã’ã‚‰ã‚Œãªã„ã‘ã©ã€ã™ã”ãå¤§äº‹ãªæ¨©é™ç®¡ç†ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚è‡ªåˆ†ãŒä»•äº‹ã§é–¢ã‚ã£ã¦ã„ã‚‹ãƒ—ãƒãƒ€ã‚¯ãƒˆã§æ¨©é™ç®¡ç†ã‚’è¦‹ç›´ã™ã¨ãã«èª¿ã¹ãŸã“ã¨ã‚’ãƒ™ãƒ¼ã‚¹ã«ã—ã¦ã„ã¾ã™ãŒã€ã‚‚ã£ã¨è‰¯ã„ãƒ—ãƒ©ã‚¯ãƒ†ã‚£ã‚¹ãŒã‚ã‚Œã°ãœã²æ•™ãˆã¦ãã ã•ã„ã€‚ AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¯ä½¿ã‚ãªã„ æ™®æ®µã®é‹ç”¨ã§ AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¯ä½¿ã„ã¾ã›ã‚“ã€‚ AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¨ã¯ã€æœ€åˆã«ã‚µã‚¤ãƒ³ã‚¢ãƒƒãƒ—ã™ã‚‹ã¨ãã«ä½œã‚‰ã‚Œã‚‹ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã§ã™ã€‚ ã“ã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¯ Linux ã§è¨€ã†
nubes 2015/05/17
aws

security
ãƒªãƒ³ã‚¯
Meldium vs Okta vs OneLogin | What are the differences?
nubes 2015/04/05
å„ç¨® Web ã‚µãƒ¼ãƒ“ã‚¹ã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆç®¡ç†ã€ã©ã®ã‚µãƒ¼ãƒ“ã‚¹ãŒã‚ˆã„ã®ã‹çŸ¥è¦‹ãŒæ¬²ã—ã„...ã€‚

security

SSO
ãƒªãƒ³ã‚¯
The Regrettable Reason Why SSO Users Have To Be Forcibly Signed-out on Mobile | The Official Slack Blog
The Regrettable Reason Why SSO Users Have To Be Forcibly Signed-out on Mobile The Regrettable Reason Why SSO Users Have To Be Forcibly Signed-out on Mobile You probably heard that we announced a security incident earlier today. If you didnâ€™t see the blog post, you will have seen the em ails. At the same time,â€¦ You probably heard that we announced a security incident earlier today. If you didnâ€™t see
nubes 2015/03/28
ãµãƒ¼ã‚€ã€‚

slack

security
ãƒªãƒ³ã‚¯
IAMã«ã‚ˆã‚‹AWSæ¨©é™ç®¡ç† â€“ ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆãƒ¡ãƒ³ãƒãƒ¼ã¸ã®æ¨©é™ä»˜ä¸Žæ–¹é‡ã«æ½œã‚€é—‡ | DevelopersIO
ã‚ˆãè¨“ç·´ã•ã‚ŒãŸã‚¢ãƒƒãƒ—ãƒ«ä¿¡è€…ã€éƒ½å…ƒã§ã™ã€‚ä»Šæ—¥ã‚‚IAMã§ã™ã€‚ å…ˆæ—¥ã®ã‚¨ãƒ³ãƒˆãƒªã§ã€ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆãƒ¡ãƒ³ãƒãƒ¼ã«ã¯IAMãƒ¦ãƒ¼ã‚¶ã‚’é…å¸ƒã—ã¾ã—ã‚‡ã†ã€ã¨ã„ã†ãƒ—ãƒ©ã‚¯ãƒ†ã‚£ã‚¹ã‚’ç¤ºã—ã¾ã—ãŸã€‚ã§ã¯ãã®IAMãƒ¦ãƒ¼ã‚¶ã®æ¨©é™ã¯ã©ã®ç¨‹åº¦ä¸Žãˆã‚Œã°è‰¯ã„ã®ã§ã—ã‚‡ã†ã‹ã€ã¨ã„ã†ã®ãŒä»Šæ—¥ã®ãƒ†ãƒ¼ãƒžã€‚å…ˆã«æ–ã£ã¦ãŠãã¾ã™ã¨ã€ã“ã®ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã¯çµè«–ãŒå‡ºã¾ã›ã‚“ã€‚éžå¸¸ã«é›£ã—ã„ã§ã™ã€‚ã§ã¯ã€ã„ãã¾ã—ã‚‡ã†ã€‚ AWSã¯ã€Œã‚ˆãã‚ã‚‹ãƒãƒªã‚·ãƒ¼ã€ã¨ã—ã¦ã„ãã¤ã‹ã®ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆã‚’æä¾›ã—ã¦ãã‚Œã¦ã„ã¾ã™ã€‚ Administrator Policy Read Only Access Policy Power User Policy ... ä¸Šè¨˜ã®ä»–ã«ã€UIä¸Šã§æ§˜ã€…ãªãƒãƒªã‚·ãƒ¼ãƒ†ãƒ³ãƒ—ãƒ¬ãƒ¼ãƒˆãŒåˆ©ç”¨ã§ãã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã¾ã™ã€‚ã“ã‚Œã‚‰ã®æ¨©é™ã‚’ã„ãã¤ã‹è¦‹ã¦ã„ãã¾ã—ã‚‡ã†ã€‚ ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆãƒ¡ãƒ³ãƒãƒ¼å…¨å“¡ã«AdministratorAccessæ¨©é™ã‚’ä¸Žãˆã‚‹ã¨â€¦ AdministratorAccessã¨
nubes 2015/01/22
AmazonIAM

security
ãƒªãƒ³ã‚¯
(SEC305) IAM Best Practices | AWS re:Invent 2014
Ever wondered how to help secure your AWS environment? This session explains a series of best practices that help you do just that with AWS Identity and Access Management (IAM). We discuss how to create great access policies; manage security credentials (access keys, password, multi-factor authentication (MFA) devices, etc.); how to set up least privilege; how to minimize the use of your root acco
nubes 2014/11/25
aws

security

slide
ãƒªãƒ³ã‚¯
AWS ã§ä½œã‚‹ã‚·ã‚¹ãƒ†ãƒ ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è€ƒ - æ°´æ·±1024m
AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚’è¤‡æ•°äººã§ä½¿ã£ã¦ã‚·ã‚¹ãƒ†ãƒ ã‚’ä½œã£ã¦ã„ãæ™‚ã«ã€ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®é¢ã‹ã‚‰ã‚„ã‚‹ã¹ãã“ã¨ã«ã¤ã„ã¦ã€‚ ä¸»ã« Web ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’æƒ³å®šã—ãŸå†…å®¹ã§ã™ãŒã€ç‰¹ã«æ›¸ã„ã¦ã‚ã‚‹ã“ã¨ã¯ç‰¹æ®Šã§ã¯ãªã„ã¨æ€ã„ã¾ã™ã€‚ å„æ‰€ã® Blog ã«ã‚‚è¨˜äº‹æ›¸ã‹ã‚Œã¦ã¾ã™ãŒæ€ã£ã¦ã„ã‚‹ã“ã¨ã‚’ã¤ã‚‰ã¤ã‚‰ã¨æ›¸ã„ã¦ã¿ã¾ã™ã€‚ ãªã‚“ã‹å¤‰ãªã“ã¨è¨€ã£ã¦ãŸã‚‰ã”æŒ‡æ‘˜ãã ã•ã„ã€‚ å‚è€ƒ: AWSã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãŒæ°—ã«ãªã‚‹ãªã‚‰èªã‚“ã§ãŠãã¹ãAWS ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®ãƒ™ã‚¹ãƒˆãƒ—ãƒ©ã‚¯ãƒ†ã‚£ã‚¹ - yoshidashingo ã¯ã˜ã‚ã« (AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã¨ IAM ãƒ¦ãƒ¼ã‚¶) å‰æã¨ã„ã†ã‹ç”¨èªžã®è©±ã€‚ AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆ ã‚¢ã‚«ã‚¦ãƒ³ãƒˆä½œæˆæ™‚ã®ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã€ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã§ãƒã‚°ã‚¤ãƒ³ã—ã¦ä½¿ã†ãƒ¦ãƒ¼ã‚¶ IAM ãƒ¦ãƒ¼ã‚¶ AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‹ã‚‰ç™ºè¡Œã§ãã‚‹ã€ãƒ¦ãƒ¼ã‚¶åã¨ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã§ãƒã‚°ã‚¤ãƒ³ã—ã¦ä½¿ã†ãƒ¦ãƒ¼ã‚¶ AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆå‘¨ã‚Š AWS ã‚¢ã‚«ã‚¦ãƒ³ãƒˆ (ãƒ«ãƒ¼ãƒˆãƒ¦ãƒ¼ã‚¶) ã§ä½œæ¥ã§ããªã„ã‚ˆã†ã«
nubes 2014/09/16
aws

security
ãƒªãƒ³ã‚¯
The JSON SQL Injection Vulnerability
tl;dr Many SQL query builders written in Perl do not provide mitigation against JSON SQL injection vulnerability. Developers should not forget to either type-check the input values taken from JSON (or any other hierarchical data structure) before passing them to the query builders, or should better consider migrating to query builders that provide API immune to such vulnerability. Note: å•é¡Œã®ç™ºè¦‹è€…ã«ã‚ˆã‚‹æ—¥
nubes 2014/07/01
â€œthe issue was originally reported by Mr. Toshiharu Sugiyama, my colleague working at DeNA Co., Ltd.â€

security

sql
ãƒªãƒ³ã‚¯
The Art and Science of SSL Configuration
OWASP APAC 2014 Tokyo Japan
nubes 2014/06/14
ssl

slide

security
ãƒªãƒ³ã‚¯
Rails SQL Injection Examples
Overview The Ruby on Rails web framework provides a library called ActiveRecord which provides an abstraction for accessing databases. This page lists many query methods and options in ActiveRecord which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input. Careless use of these methods can open up code to SQL Injection exploits. The examples here do not inclu
nubes 2014/06/14
sql

rails

security
ãƒªãƒ³ã‚¯
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã€ç’°å¢ƒå¤‰æ•°ã€ãã—ã¦
5/20 é ƒã« å…¬é–‹ã—ãŸ envchain ã¨ã„ã†ãƒ„ãƒ¼ãƒ«ã®ç´¹ä»‹è¨˜äº‹ã‚’ã€ä¼šç¤¾ã®æŠ€è¡“ãƒ–ãƒã‚°ã«æ›¸ã„ãŸã€‚ OS X ã‚ãƒ¼ãƒã‚§ãƒ¼ãƒ³ã‹ã‚‰ç’°å¢ƒå¤‰æ•°ã‚’ã‚»ãƒƒãƒˆã™ã‚‹ãƒ„ãƒ¼ãƒ«ã‚’ä½œã‚Šã¾ã—ãŸ - ã‚¯ãƒƒã‚¯ãƒ‘ãƒƒãƒ‰é–‹ç™ºè€…ãƒ–ãƒã‚° æŠ•ä¸‹æ™‚é–“ã®é–¢ä¿‚ã‚‚ã‚ã‚‹ã¨æ€ã†ã‘ã©ã€æ€ã„ã®ä»–çµæ§‹æ‹¡æ•£ã—ã¦ã³ã£ãã‚Šã—ãŸã€‚ã¾ã‚ã€ãã‚Œã¯ç½®ã„ã¦ãŠã„ã¦ã€æœ¬é¡Œã€‚ ãŠã‚‚ã—ã‚ã„ã€‚ãŒã€ps -Eã§ä»–ãƒ—ãƒã‚»ã‚¹ã§ç’°å¢ƒå¤‰æ•°ãŒè¦‹ãˆã‚‹ã“ã¨ã‚’è€ƒãˆã‚‹ã¨ã€ãã‚‚ãã‚‚ç’°å¢ƒå¤‰æ•°ã«èªè¨¼æƒ…å ±ã‚’å…¥ã‚Œã¦ã‚‹æ™‚ç‚¹ã§â€¦ / â€œOS X ã‚ãƒ¼ãƒã‚§ãƒ¼ãƒ³ã‹ã‚‰ç’°å¢ƒå¤‰æ•°ã‚’ã‚»ãƒƒãƒˆã™ã‚‹ãƒ„ãƒ¼ãƒ«ã‚’ä½œã‚Šã¾ã—ãŸ - ã‚¯ãƒƒã‚¯ãƒ‘ãƒƒãƒ‰é–‹ç™ºè€…ãƒ–ãƒã‚°â€ http://t.co/n1quG3C4Tx â€” Kazuho Oku (@kazuho) June 4, 2014 ã”ã‚‚ã£ã¨ã‚‚ã ã¨æ€ã„ã¾ã™ã€‚ å®Ÿéš›ã®ã¨ã“ã‚ã€ã‚ãŸã—ã¯ãªã‚“ã‹ã€Œç’°å¢ƒå¤‰æ•°ã‚„ã‚ã‚ bot ã‹ã‚ˆã€ã¨è¨€ã‚ã‚Œã‚‹ãƒ¬ãƒ™ãƒ«ã§ã‚ã¾ã‚Šç’°å¢ƒå¤‰æ•°ã«æ©Ÿå¯†æƒ…å ±ã‚’å…¥ã‚Œã‚‹äº‹ã‚’å¥½ã‚“ã§ãªã„ã§ã™ã€‚ ãªã®ã«ã“
nubes 2014/06/08
security

Mac
ãƒªãƒ³ã‚¯
CCS Injectionè„†å¼±æ€§(CVE-2014-0224)ç™ºè¦‹ã®çµŒç·¯ã«ã¤ã„ã¦ã®ç´¹ä»‹ - OpenSSL #ccsinjection Vulnerability
èŠæ± ã§ã™ã€‚CCS Injectionè„†å¼±æ€§(CVE-2014-0224)ç™ºè¦‹ã®çµŒç·¯ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ ãƒã‚°ã®ç°¡å˜ãªè§£èª¬ OpenSSLãŒãƒãƒ³ãƒ‰ã‚·ã‚§ãƒ¼ã‚¯ä¸ã«ä¸é©åˆ‡ãªçŠ¶æ…‹ã§ChangeCipherSpecã‚’å—ç†ã—ã¦ã—ã¾ã†ã®ãŒä»Šå›žã®ãƒã‚°ã§ã™ã€‚ ã“ã®ãƒã‚°ã¯OpenSSLã®æœ€åˆã®ãƒªãƒªãƒ¼ã‚¹ã‹ã‚‰å˜åœ¨ã—ã¦ã„ã¾ã—ãŸã€‚ é€šå¸¸ã®ãƒãƒ³ãƒ‰ã‚·ã‚§ãƒ¼ã‚¯ã§ã¯ã€å³ã®å›³ã®ã‚ˆã†ãªé †åºã§ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’äº¤æ›ã—ã¾ã™(RFC5246 The Transport Layer Security (TLS) Protocol Version 1.2 Â§7.3ã‚ˆã‚Šä½œæˆ)ã€‚ ChangeCipherSpecã¯å¿…ãšã“ã®ä½ç½®ã§è¡Œã†ã“ã¨ã«ãªã£ã¦ã„ã¾ã™ã€‚OpenSSLã‚‚ChangeCipherSpecã‚’ã“ã®ã‚¿ã‚¤ãƒŸãƒ³ã‚°ã§é€ä¿¡ã—ã¾ã™ãŒã€å—ä¿¡ã¯ä»–ã®ã‚¿ã‚¤ãƒŸãƒ³ã‚°ã§ã‚‚è¡Œã†ã‚ˆã†ã«ãªã£ã¦ã„ã¾ã—ãŸã€‚ã“ã‚Œã‚’æ‚ªç”¨ã™ã‚‹ã“ã¨ã§ã€æ”»æ’ƒè€…ãŒé€šä¿¡ã‚’è§£èªãƒ»æ”¹ã–ã‚“å¯èƒ½ã§ã™ã€‚ ç™ºè¦‹ã®å›°é›£ã•
nubes 2014/06/08
security
ãƒªãƒ³ã‚¯
[AWS][CLI] EC2ã«SSHã™ã‚‹ã¨ãã ã‘ã€security groupã«è‡ªåˆ†ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’è¿½åŠ ã™ã‚‹ | DevelopersIO
[AWS][CLI] EC2ã«SSHã™ã‚‹ã¨ãã ã‘ã€security groupã«è‡ªåˆ†ã®ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’è¿½åŠ ã™ã‚‹ ã¯ã˜ã‚ã« AWSã®EC2ã«ã¯SecurityGroupã¨å‘¼ã°ã‚Œã‚‹ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«ãŒã‚ã‚Šã¾ã™ã€‚"æŒ‡å®šã—ãŸIPã‚¢ãƒ‰ãƒ¬ã‚¹ã‹ã‚‰ã€ç‰¹å®šã®ãƒãƒ¼ãƒˆã®ã¿ã‚¢ã‚¯ã‚»ã‚¹ãŒå¯èƒ½"ã¨ã„ã£ãŸæŒ‡å®šã‚’ã™ã‚‹ã“ã¨ã§ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’ä¸Šã’ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ ãŸã ã€ä¼šç¤¾ã®ã‚ˆã†ãªå›ºå®šIPã‚’æŒã£ãŸå ´æ‰€ã‹ã‚‰ã®ã‚¢ã‚¯ã‚»ã‚¹ã§ã¯ã‚ˆã„ã®ã§ã™ãŒã€ãƒ¢ãƒã‚¤ãƒ«æ©Ÿå™¨ãªã©ã‚’ç”¨ã„ã‚‹å ´åˆã¯æ¯Žå›žIPã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’æŒ‡å®šã™ã‚‹ã¨ã„ã†ã®ã¯éžç¾å®Ÿçš„ã§ã™ã€‚ã¨ã„ã†ã‚ã‘ã§ã€ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’ã¤ãã£ã¦çœåŠ›åŒ–ã—ã¦ã¿ã¾ã—ãŸã€‚ sshã‚’ã™ã‚‹å‰ã«SecurityGroupã«è‡ªåˆ†ã®åˆ©ç”¨ã—ã¦ã„ã‚‹IPã«ã‚ˆã‚‹SSHã‚’è¨±å¯ã—ã¦ã€sshçµ‚äº†å¾Œã«è¿½åŠ ã—ãŸãƒ«ãƒ¼ãƒ«ã‚’å‰Šé™¤ã™ã‚‹ã¨ã„ã†ã‚¹ã‚¯ãƒªãƒ—ãƒˆã§ã™ VPNã‚’ä½¿ã†ã®ãŒæœ¬ç‹ã ã¨ã¯ãŠã‚‚ã„ã¾ã™ãŒã€ã„ã¤ã‚‚ã§ãã‚‹ã¨ã„ã†ã‚ã‘ã§ã¯ãªã„ã®ã§ã€å½¹ã«ç«‹ã¤å ´åˆã‚‚ã‚ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ ã‚¹ã‚¯ãƒªãƒ—ãƒˆã®
nubes 2014/05/14
ec2

security
ãƒªãƒ³ã‚¯
Heart Bleedã‚’èªã‚“ã - The first cry of Atom
int dtls1_process_heartbeat(SSL *s) { unsigned char *p = &s->s3->rrec.data[0], *pl; unsigned short hbtype; unsigned int payload; unsigned int padding = 16; /* Use minimum padding */ heartbeatã¨ã„ã†æ©Ÿèƒ½ã®è©³ã—ã„ã“ã¨ã¯èª¿ã¹ã‚‰ã‚Œã¦ã„ãªã„ã‘ã‚Œã©ã©ã†ã‚„ã‚‰ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆãƒ¼ã‚µãƒ¼ãƒåž‹ã®æ©Ÿèƒ½ã‚’æä¾›ã™ã‚‹ã‚‚ã®ã‚‰ã—ã„ã€‚ ã¤ã¾ã‚Šä½•ã‚‰ã‹ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆã‚’å—ã‘å–ã£ã¦ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚’è¿”ã™ã‚ˆã†ãªã‚µãƒ¼ãƒ“ã‚¹ã‚’æä¾›ã™ã‚‹ã‚‚ã®ã‚‰ã—ã„ã€‚dtls1_process_heartbeatã§å¤§äº‹ãªã®ã¯ ãƒã‚¤ãƒ³ã‚¿pã ã€‚ã“ã‚Œã¯ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ã‚’å—ã‘å–ã£ã¦æ ¼ç´ã—ã¦ã„ã‚‹ã€‚ã“ã®ãƒªã‚¯ã‚¨ã‚¹ãƒˆãƒ‡ãƒ¼ã‚¿ã¯æ§‹é€ ä½“ã«ãªã£ã¦ã„ã¦ã€ä»¥ä¸‹ã®ã‚ˆã†ã«è¨˜è¿°ã•ã‚Œã¦ã„ã‚‹ã€‚ typedef struct
nubes 2014/04/11
ssl

security
ãƒªãƒ³ã‚¯
AWS ã‹ã‚‰ OpenSSL ã®è„†å¼±æ€§ã«ã¤ã„ã¦ AWS ã®ã‚µãƒ¼ãƒ“ã‚¹ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆ | ã‚¢ãƒžã‚¾ãƒ³ ã‚¦ã‚§ãƒ– ã‚µãƒ¼ãƒ“ã‚¹ï¼ˆAWS æ—¥æœ¬èªžï¼‰
2014 å¹´ 4 æœˆ 8 æ—¥ CVE-2014-0160 ã§èª¬æ˜Žã•ã‚Œã¦ã„ã‚‹å•é¡Œ (Heartbleed ãƒã‚°ã¨ã‚‚å‘¼ã°ã‚Œã¾ã™) ã®å½±éŸ¿ã«ã¤ã„ã¦ã€ã™ã¹ã¦ã® AWS ã‚µãƒ¼ãƒ“ã‚¹ã‚’ç¢ºèªã—ã¾ã—ãŸã€‚ä»¥ä¸‹ã«ãƒªã‚¹ãƒˆã•ã‚Œã¦ã„ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ã‚’é™¤ãã€ã‚µãƒ¼ãƒ“ã‚¹ãŒå½±éŸ¿ã‚’å—ã‘ã¦ã„ãªã„ã¨åˆ¤æ–ã—ãŸã‹ã€é¡§å®¢ã®ã‚¢ã‚¯ã‚·ãƒ§ãƒ³ã‚’å¿…è¦ã¨ã—ãªã„ç·©å’Œç–ã‚’é©ç”¨ã§ãã¾ã—ãŸã€‚ Elastic Load Balancing: CVE-2014-0160 ã§èª¬æ˜Žã•ã‚Œã¦ã„ã‚‹å•é¡Œã®å½±éŸ¿ã‚’å—ã‘ã‚‹ã™ã¹ã¦ã®ãƒãƒ¼ãƒ‰ãƒãƒ©ãƒ³ã‚µãƒ¼ãŒã€ã™ã¹ã¦ã®ãƒªãƒ¼ã‚¸ãƒ§ãƒ³ã§æ›´æ–°ã•ã‚ŒãŸã“ã¨ã‚’ç¢ºèªã§ãã¾ã™ã€‚Elastic Load Balancing ã§ SSL æŽ¥ç¶šã‚’çµ‚äº†ã™ã‚‹å ´åˆã€Heartbleed ãƒã‚°ã®å½±éŸ¿ã‚’å—ã‘ãªããªã‚Šã¾ã™ã€‚è¿½åŠ ã®äºˆé˜²ç–ã¨ã—ã¦ã€Elastic Load Balancing ãƒ‰ã‚ãƒ¥ãƒ¡ãƒ³ãƒˆ (http://docs.aws.amazon.com/ElasticLoadBa
nubes 2014/04/09
aws

security
ãƒªãƒ³ã‚¯
Norikra+Fluentdã§DoSæ”»æ’ƒã‚’ãƒ–ãƒãƒƒã‚¯ã™ã‚‹ä»•çµ„ã¿ã‚’ä½œã£ã¦ã¿ãŸ ï½œ Developers.IO
Norikraã¨ã¯ Norikraã¨ã¯ãƒªã‚¢ãƒ«ã‚¿ã‚¤ãƒ é›†è¨ˆãƒ—ãƒãƒ€ã‚¯ãƒˆã§ã™ã€‚ã‚¤ãƒ™ãƒ³ãƒˆã‚¹ãƒˆãƒªãƒ¼ãƒ ã«å¯¾ã—ã¦SQLãƒ©ã‚¤ã‚¯ãªè¨€èªžã§å‡¦ç†ã‚’æ›¸ãã“ã¨ãŒå‡ºæ¥ã¾ã™ã€‚ ä¾‹ãˆã°ã€Apacheã®ã‚¢ã‚¯ã‚»ã‚¹ãƒã‚°ã‚’Norikraã«æµã—è¾¼ã¿ã€1åˆ†ã‚ãŸã‚Šã®ã‚¢ã‚¯ã‚»ã‚¹æ•°ã‚„ãƒ¬ã‚¹ãƒãƒ³ã‚¹ã‚¿ã‚¤ãƒ ã®æœ€å¤§å€¤ã‚’ãƒªã‚¢ãƒ«ã‚¿ã‚¤ãƒ ã«é›†è¨ˆã™ã‚‹ã“ã¨ãŒå‡ºæ¥ã¾ã™ã€‚ Norikraã®åˆ©ç”¨ä¾‹ã¯ä½œè€…ã§ã‚ã‚‹tagomorisã•ã‚“ã®ãƒ–ãƒã‚°ã§ç´¹ä»‹ãŒã‚ã‚Šã¾ã™ã€‚ ä»Šå›žã¯ã€Norikraã‚’ä½¿ã£ã¦DoSæ”»æ’ƒã‚’ãƒ–ãƒãƒƒã‚¯ã™ã‚‹ä»•çµ„ã¿ã‚’ä½œã£ã¦ã¿ã¾ã—ãŸã€‚ DoSæ”»æ’ƒãƒ–ãƒãƒƒã‚¯ã®ä»•çµ„ã¿ ã‚¢ã‚¯ã‚»ã‚¹å…ƒã¯Apacheã®ã‚¢ã‚¯ã‚»ã‚¹ãƒã‚°ã‹ã‚‰å–å¾—ã—ã€ãƒã‚°ã®å—ã‘æ¸¡ã—ã«ã¯Fluentdã‚’åˆ©ç”¨ã—ã¾ã—ãŸã€‚ ãƒ–ãƒãƒƒã‚¯ã®æ‰‹é †ã¯ä»¥ä¸‹ã®ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ ã‚¢ã‚¯ã‚»ã‚¹ãƒã‚°ã‚’Fluentdã®in_tailãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã§å–å¾—ã€‚ Fluentdã®out_norikraãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã§ã€ã‚¢ã‚¯ã‚»ã‚¹ãƒã‚°ã‚’Norikraã«æµã—è¾¼ã¿ã€‚ Norikra
nubes 2014/04/05
fluentd

norikra

security
ãƒªãƒ³ã‚¯
Two Factor Auth | BrainStationÂ®
Full-Time or Part-Time Bootcamps Our award-winning bootcamps will help you launch a new career in tech in-person or online. You can attend our bootcamps full-time or part-time.
nubes 2014/03/24
security
ãƒªãƒ³ã‚¯
httpsã ã‹ã‚‰ã¨ã„ã†ã ã‘ã§å®‰å…¨ï¼Ÿèª¿ã¹ãŸã‚‰æ€–ããªã£ã¦ããŸSSLã®è©±!ï¼Ÿ - Qiita
Deleted articles cannot be recovered. Draft of this article would be also deleted. Are you sure you want to delete this article?
nubes 2014/03/21
ssl

security
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸