[B! security] tanishiking24ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

tanishiking24 id:tanishiking24

securityã«é–¢ã™ã‚‹tanishiking24ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (8)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ä¸æ£ãƒã‚°ã‚¤ãƒ³é˜²æ¢å¯¾ç–ï½œmixié‹å–¶è€…ãƒ–ãƒã‚°ï½œmixi
ã“ã‚“ã«ã¡ã¯ã€mixiã‚¹ã‚¿ãƒƒãƒ•ã§ã™ã€‚ ç¬¬5å›žã¯ã€mixi å†…ã§éŽåŽ»ã«å®Ÿéš›ã«è¡Œã‚ã‚ŒãŸã‚¹ãƒ‘ãƒ è¡Œç‚ºã¨ã€ãã‚Œã‚’å«ã‚€ä¸æ£ãƒã‚°ã‚¤ãƒ³é˜²æ¢å¯¾ç–ã®ä¸€ç’°ã¨ã—ã¦ Google ç¤¾ã®ã€ŒreCAPTCHA (ãƒªã‚ãƒ£ãƒ—ãƒãƒ£)ã€ã‚’å°Žå…¥ã—ãŸå–ã‚Šçµ„ã¿ã«ã¤ã„ã¦ãŠè©±ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ mixi ã§è¡Œã‚ã‚ŒãŸã‚¹ãƒ‘ãƒ è¡Œç‚º Web ã‚µãƒ¼ãƒ“ã‚¹ã«ãŠã„ã¦ã€ãã®ã‚µãƒ¼ãƒ“ã‚¹ã‚’ä¸æ£ã«åˆ©ç”¨ã—ãŸã‚¹ãƒ‘ãƒ è¡Œç‚ºã‚„ã€ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã®ä¹—ã£å–ã‚Šãªã©ã€æ§˜ã€…ãªæ”»æ’ƒã«æ™’ã•ã‚Œã‚‹ã®ã¯çã—ã„ã“ã¨ã§ã¯ãªããªã£ã¦ã„ã¾ã™ã€‚ãã‚Œã¯ mixi ã«ãŠã„ã¦ã‚‚ä¾‹å¤–ã§ã¯ãªãã€å®‰å¿ƒãƒ»å®‰å…¨ã«ã”åˆ©ç”¨ã„ãŸã ã‘ã‚‹ã‚ˆã†ã«å¸¸ã«å¯¾ç–ã‚’æ–½ã—ã¦ãã¾ã—ãŸã€‚ ã“ã®ã‚ˆã†ãªä¸ã€æ˜¨å¹´ã®5æœˆã«å¤§è¦æ¨¡ãªã‚¹ãƒ‘ãƒ è¡Œç‚ºãŒç¢ºèªã•ã‚Œã¾ã—ãŸã€‚ ã€Œã‚¹ãƒ‘ãƒ æŠ•ç¨¿ã«ã”æ³¨æ„ãã ã•ã„ - é‹å–¶è€…ã‹ã‚‰ã®ãŠçŸ¥ã‚‰ã›ã€(2018å¹´05æœˆ11æ—¥) ã“ã‚Œã¯ä»–ã®ã‚µãƒ¼ãƒ“ã‚¹ã§ä¸æ£ã«å…¥æ‰‹ã—ãŸå¤§é‡ã®ã‚¢ã‚«ã‚¦ãƒ³ãƒˆæƒ…å ±ã‚’å…ƒã«ã€æ©Ÿæ¢°çš„ã«ãƒã‚°ã‚¤ãƒ³ã‚’è©¦ã¿ã¦ã‚¢ã‚«ã‚¦ãƒ³ãƒˆã‚’ä¹—ã£å–ã‚Šã€ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚„
tanishiking24 2019/03/25
security
ãƒªãƒ³ã‚¯
BCrypt(Blowfishæš—å·)ã«ã¤ã„ã¦èª¿ã¹ãŸã®ã§æ–‡æ›¸åŒ–ã—ã¦ã¿ã¾ã—ãŸ
èªè¨¼ã‚·ã‚¹ãƒ†ãƒ ã‚’ä½œã‚‹ã¨ãã«é »ç¹ã«ä½¿ç”¨ã™ã‚‹BCryptã§ã™ãŒã€ã‚ã¾ã‚Šä¸èº«ã‚’ã‚ˆãçŸ¥ã‚‰ãšã«ä½¿ã£ã¦ã„ãŸã®ã§èª¿ã¹ã¦ã¿ã¾ã—ãŸã€‚å‚™å¿˜éŒ²ã‚‚å…¼ãã¦å¦ã‚“ã ã“ã¨ã‚’æ–‡æ›¸åŒ–ã—ã¦ãŠã“ã†ã¨æ€ã„ã¾ã™ã€‚ æ„å¤–ã¨æ—¥æœ¬èªžã®æ–‡çŒ®ãŒå°‘ãªãã€è‹¦æ‰‹ãªè‹±èªžã‚’èªã¿ãªãŒã‚‰é ‘å¼µã£ãŸã®ã§é–“é•ãˆã¦ã„ã‚‹éƒ¨åˆ†ã‚‚ã‚ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ï¼å¤‰ãªã¨ã“ã‚ãŒã‚ã£ãŸã‚‰ã”æŒ‡æ‘˜ã„ãŸã ã‘ã¾ã™ã¨ã†ã‚Œã—ã„ã§ã™ã€‚
tanishiking24 2018/08/10
security
ãƒªãƒ³ã‚¯
Webã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã ã£ãŸã‚‰å½“ç„¶çŸ¥ã£ã¦ãŠããŸã„ã€Œ ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°å¯¾ç– ã€ã¨ã¯ï¼Ÿ | æ ªå¼ä¼šç¤¾ãƒŒãƒ¼ãƒ©ãƒœ(Nulab inc.)
ã“ã‚“ã«ã¡ã¯ã€‚Typetalkãƒãƒ¼ãƒ ã®æ°¸æ±Ÿã§ã™ã€‚ä»Šå›žã¯4æœˆã«ãƒªãƒªãƒ¼ã‚¹ã—ãŸã€Backlogã¨Typetalkã®é€£æºæ©Ÿèƒ½ã§ã‚ã‚‹ã€ŒBacklogã‚«ãƒ¼ãƒ‰ã€ã®å®Ÿè£…ã®éš›ã«è¡Œã£ãŸ ã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°å¯¾ç– ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ Backlogã‚«ãƒ¼ãƒ‰ã¨ã¯ Backlogã‚«ãƒ¼ãƒ‰ã¯ã€Typetalkã®ãƒˆãƒ”ãƒƒã‚¯å†…ã«Backlogã®èª²é¡Œã‚„ã‚³ãƒ¡ãƒ³ãƒˆã‚’ã‚«ãƒ¼ãƒ‰å½¢å¼ã«ã—ã¦è¡¨ç¤ºã™ã‚‹æ©Ÿèƒ½ã§ã™ã€‚Backlogã®èª²é¡Œã‚ãƒ¼ã‚„èª²é¡Œã®URLã‚’è²¼ã‚Šä»˜ã‘ã‚‹ã ã‘ã§ã€ä»¥ä¸‹ã®ç”»åƒã®ã‚ˆã†ã«è¡¨ç¤ºã§ãã¾ã™ï¼ˆâ€»è©³ã—ã„ã”åˆ©ç”¨æ–¹æ³•ã«ã¤ã„ã¦ã¯ã“ã¡ã‚‰ã®ã€ŒTypetalkã®ãƒˆãƒ”ãƒƒã‚¯ä¸Šã§èª²é¡Œã®è©³ç´°ã‚’è¦‹ã‚‰ã‚Œã‚‹ Backlogã‚«ãƒ¼ãƒ‰ ã‚’ãƒªãƒªãƒ¼ã‚¹ã—ã¾ã—ãŸï¼ã€ã‚’ã”å‚ç…§ãã ã•ã„ï¼‰ã€‚ Backlogã‚«ãƒ¼ãƒ‰ã®å®Ÿè£…ã¯ã€Typetalkã‹ã‚‰Backlogã«ç”¨æ„ã—ãŸåŸ‹ã‚è¾¼ã¿ç”¨ã®èª²é¡Œãƒšãƒ¼ã‚¸ã‚’<iframe>ã§è¡¨ç¤ºã™ã‚‹ã¨ã„ã†ã‚‚ã®ã§ã™ã€‚ã“ã®ã‚ˆã†ãªå®Ÿè£…ã«ã—ãŸã®ã¯ã€ã‚‚ã¨ã‚‚ã¨Backlogã«<if
tanishiking24 2018/04/19
security

javascript
ãƒªãƒ³ã‚¯
ãƒªãƒ³ã‚¯ã®ã¸ã® rel=noopener ä»˜ä¸Žã«ã‚ˆã‚‹ Tabnabbing å¯¾ç– | blog.jxck.io
ãªãŠ IE ã¯(security zone setting ã‚’ã„ã˜ã‚‰ãªã„é™ã‚Š)ã“ã®å•é¡ŒãŒç™ºç”Ÿã—ãªã„ã‚ˆã†ã ã€‚ å¼•ç”¨å…ƒ: blankshield demo | Reverse tabnabber phishing tabnabbing ä¸Šè¨˜ã®æŒ™å‹•ã‚’ã€ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°è©æ¬ºã«åˆ©ç”¨ã§ãã‚‹ã“ã¨ãŒæ—¢ã«æŒ‡æ‘˜ã•ã‚Œã¦ã„ã‚‹ã€‚ ã“ã®æ‰‹æ³•ã¯ Tabnabbing ã¨å‘¼ã°ã‚Œã¦ã„ã‚‹ã€‚ Tabnabbing: A New Type of Phishing Attack Aza on Design Target="_blank" - the most underestimated vulnerability ever ã“ã®æ”»æ’ƒæ–¹æ³•ã‚’è§£èª¬ã™ã‚‹ã€‚ æ”»æ’ƒã®æ¦‚è¦ https://cgm.example.com (å·¦ä¸Š) ã¨ã„ã†ã‚µãƒ¼ãƒ“ã‚¹ãŒã‚ã‚‹ã¨ã—ã€ã“ã‚Œã¯ SNS ã‚„ãƒãƒ¼ãƒ ã‚³ãƒ©ãƒœãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ç³»ã‚µãƒ¼ãƒ“ã‚¹ã‚’æƒ³å®šã™ã‚‹ã€‚ æ”»æ’ƒè€…ã¯ã€ã“ã®ã‚µãƒ¼ãƒ“ã‚¹ã®ä¸
tanishiking24 2017/11/16
javascript

security
ãƒªãƒ³ã‚¯
IPA ISECã€€ã‚»ã‚ãƒ¥ã‚¢ãƒ»ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¬›åº§ï¼šWebã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ç·¨ã€€ç¬¬8ç« ãƒžãƒƒã‚·ãƒ¥ã‚¢ãƒƒãƒ—ï¼šã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ãƒžãƒƒã‚·ãƒ¥ã‚¢ãƒƒãƒ—: #4 å¯¾ç–ã«åˆ©ç”¨ã§ãã‚‹æŠ€è¡“
ç¬¬8ç« ãƒžãƒƒã‚·ãƒ¥ã‚¢ãƒƒãƒ— ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ãƒžãƒƒã‚·ãƒ¥ã‚¢ãƒƒãƒ—: #5 å¯¾ç–ã«åˆ©ç”¨ã§ãã‚‹æŠ€è¡“ Webã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–å¯¾è±¡ãƒ¬ã‚¤ãƒ¤ ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã‚µã‚¤ãƒ‰ãƒžãƒƒã‚·ãƒ¥ã‚¢ãƒƒãƒ—ã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç¢ºä¿ã«ã¤ã„ã¦ã¯ã€ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚³ãƒ¼ãƒ‰ãƒ¬ãƒ™ãƒ«ã€ãƒ©ã‚¤ãƒ–ãƒ©ãƒªãƒ¬ãƒ™ãƒ«ã€ãƒ–ãƒ©ã‚¦ã‚¶ï¼ˆJavaScriptã‚¨ãƒ³ã‚¸ãƒ³ï¼‰ãƒ¬ãƒ™ãƒ«ã®å„éšŽå±¤ã«åˆ†ã‘ã¦èª¬æ˜Žã™ã‚‹ã€‚ ç‰¹ã«ã€ãƒ–ãƒ©ã‚¦ã‚¶ãƒ¬ãƒ™ãƒ«ã®å¯¾ç–ãŒå……å®Ÿã™ã‚‹ã¨ã€é–‹ç™ºè€…ã®è² æ‹…ã¯è»½ããªã‚‹ã“ã¨ãŒæœŸå¾…ã•ã‚Œã‚‹ã€‚ ã‚µãƒ¼ãƒã‹ã‚‰ãƒ–ãƒ©ã‚¦ã‚¶å®›ã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€å†…ã«ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®ãµã‚‹ã¾ã„ã‚’æŒ‡å®šã™ã‚‹ä»•æ§˜ãŒè¤‡æ•°ã€å˜åœ¨ã—ã¦ã„ã‚‹ã€‚ (1) ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–æ©Ÿèƒ½ã‚’ã‚ªãƒ³ã«ã™ã‚‹ãŸã‚ã®ãƒ˜ãƒƒãƒ€ ã‚µãƒ¼ãƒã‹ã‚‰ãƒãƒ¼ãƒ‰ã•ã‚Œã‚‹ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã«æ·»ãˆã‚‰ã‚Œã‚‹ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã«ã€ä½•ã‚‰ã‹ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒãƒªã‚·ãƒ¼ã®åŸ·è¡Œã‚’ãƒ–ãƒ©ã‚¦ã‚¶ã¸è¦è«‹ã™ã‚‹ç”¨é€”ã®ã‚‚ã®ãŒå¢—ãˆã¦ããŸã€‚ä¾‹ãˆã°ã€æ¬¡ã®ãƒ¬ã‚¹ãƒãƒ³ã‚¹ãƒ˜ãƒƒãƒ€ã§ã‚ã‚‹ã€‚ X-XSS-ProtectionXSSãƒ•ã‚£ãƒ«
tanishiking24 2017/04/07
security
ãƒªãƒ³ã‚¯
X-SendFileã€X-Accel-Redirectã®ä½¿ã„æ–¹ | ãªã†ã³ã‚‹ã©ã„ã‚“ã
æ™®é€šã®ç”¨é€”ã§PHPãªã©ã®ã‚µãƒ¼ãƒã‚µã‚¤ãƒ‰ã®ãƒ—ãƒã‚°ãƒ©ãƒ ã‹ã‚‰å·¨å¤§ãªãƒ•ã‚¡ã‚¤ãƒ«ã‚’é€ã‚Šå‡ºãã†ã¨è¨€ã†ã®ã¯ãƒã‚«(è‡ªç²›)ä»¥å¤–ã®ä½•ç‰©ã§ã‚‚ãªã„ã¨ã—ã¦â€¦â€¦(æ™®é€šã«Webã‚µãƒ¼ãƒã«ã‚„ã‚‰ã›ã‚Œã°è‰¯ã„ã‹ã‚‰) ã‚„ã¯ã‚Šã€ãƒ¦ãƒ¼ã‚¶ã‚’èªè¨¼ã—ã¦ã‹ã‚‰ãƒ•ã‚¡ã‚¤ãƒ«ã‚’é€ä¿¡ã—ãŸã„(ä¾‹ãˆã°æœ‰æ–™ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã¨ã‹)ã€ãªã‚“ã¦ç”¨é€”ã¯ç„¡ãã«ã—ã‚‚éžãšã§ã‚ã£ã¦ã€Apacheã‚„nginxã«ã¯ãã†è¨€ã†æ™‚ã®ãŸã‚ã®ã€ŒX-SendFileã€ã‚„ã€ŒX-Accel-Redirectã€ãŒã‚ã‚‹ã®ã§ä½¿ã„æ–¹ã‚’ç´¹ä»‹ã—ã‚ˆã†ã¨æ€ã„ã¾ã™ã€‚ å·¨å¤§ãªãƒ•ã‚¡ã‚¤ãƒ«ã‚’é€ã‚ŠãŸã„ã‚¾ å…ˆã®é€šã‚Šã€ãŸã å˜ã«ã€Œãƒ•ã‚¡ã‚¤ãƒ«ã‚’ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã•ã›ãŸã„ã€ã ã‘ãªã‚‰ã‚ãªãŸã¯ãƒ–ãƒ©ã‚¦ã‚¶ã®æˆ»ã‚‹ãƒœã‚¿ãƒ³ã‚’æŠ¼ã™ã¹ãã§ã™ã€‚ ãªãœã£ã¦ï¼ŸãŸã å˜ã«ãã®ãƒ•ã‚¡ã‚¤ãƒ«ã‚’ã‚µãƒ¼ãƒã«ç½®ã„ã¦ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã•ã›ã‚Œã°è‰¯ã„ã ã‘ã ã‹ã‚‰ã€‚ æ—©ã„è©±ã€ã‚µãƒ¼ãƒä¸Šã«ç½®ã„ãŸzipã‚„exeã«å¯¾ã—ã¦ã€Œ<a href="/ãªã‚“ã¨ã‹.zip">æŠ¼ã™ãªã‚ˆï¼ï¼çµ¶å¯¾æŠ¼ã™ãªã‚ˆï¼ï¼</a>ã€ã¿ãŸã„ã«ã™ã‚Œã°è‰¯ã„è¨³
tanishiking24 2017/04/06
security
ãƒªãƒ³ã‚¯
Clever attack exploits fully-patched Linux kernel
A recently published attack exploiting newer versions of the Linux kernel is getting plenty of notice because it works even when security enhancements are running and the bug is virtually impossible to detect in source code reviews. The exploit code was released Friday by Brad Spengler of grsecurity, a developer of applications that enhance the security of the open-source OS. While it targets Linu
tanishiking24 2017/02/04
security
ãƒªãƒ³ã‚¯
The Importance of Using HTTPS All The Way
A few weeks ago, I was sitting next to my girlfriend while she was browsing the Internet. When she went to her bankâ€™s homepage to log into her bank account, I noticed something missing: the famous â€œLockâ€ icon next to the URL! I refreshed the page several times to verify it wasnâ€™t a mistake. Typical Woof-in-the-Middle attackEven though it is only the bankâ€™s homepage thatâ€™s served over non-secure co
tanishiking24 2016/12/19
security
ãƒªãƒ³ã‚¯
1