[B! ssl][security] totoadadã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

totoadad id:totoadad

sslã¨securityã«é–¢ã™ã‚‹totoadadã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒãƒƒã‚·ãƒ¥è¡çªã§TLSã‚’ç ´ã‚‹SLOTHæ”»æ’ƒ(CVE-2015-7575)ã¨ã¯ä½•ã‹ - ã¼ã¡ã¼ã¡æ—¥è¨˜
0. ç°¡å˜ãªSLOTHæ”»æ’ƒã®ã¾ã¨ã‚ æœ€åˆã«ç°¡å˜ãªã¾ã¨ã‚ã‚’æ›¸ã„ã¦ãŠãã¾ã™ã€‚é•·æ–‡ã«ãªã‚Šãã†ãªã®ã§ã€èªã‚€ã®ãŒå¤§å¤‰ãªæ–¹ã¯ã“ã“ã ã‘è¦‹ã¦ãŠã„ã¦ãã ã•ã„ã€‚ MD5ãƒãƒƒã‚·ãƒ¥ã¯æ—¢ã«å®‰å…¨ã§ã¯ãªãã€è¨¼æ˜Žæ›¸ã®ç½²åæ–¹å¼ã§ã®åˆ©ç”¨ã¯åœæ¢ã•ã‚Œã¦ã„ãŸãŒã€å¾Œæ–¹äº’æ›ã®ãŸã‚ãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ãƒ‡ãƒ¼ã‚¿ã®ç½²åæ–¹å¼ã«RSA-MD5ãŒä»Šã§ã‚‚åˆ©ç”¨ã§ãã‚‹TLSå®Ÿè£…ãŒå¹¾ã¤ã‹å˜åœ¨ã—ã¦ã„ãŸ(Firefox NSS, Javaç‰)ã€‚ å…ˆé€±ã€INRIAã‚°ãƒ«ãƒ¼ãƒ—ã‹ã‚‰ãƒãƒƒã‚·ãƒ¥è¡çªã‚’åˆ©ç”¨ã—ã¦å®Ÿéš›ã«TLSã‚’ç ´ã‚‹æ”»æ’ƒ(SLOTH)ãŒå…¬é–‹ã•ã‚ŒãŸã€‚ãã‚Œã‚’å—ã‘ã€ã„ãã¤ã‹ã®å®Ÿè£…ã§RSA-MD5ã‚’å®Œå…¨ã«åˆ©ç”¨ä¸èƒ½ã«ã™ã‚‹ä¿®æ£ãŒè¡Œã‚ã‚ŒãŸ(CVE-2015-7575)ã€‚ SLOTHã§ã¯ã€SHA1ã‚„TLSã€IKEã€SSHã«å¯¾ã™ã‚‹æ”»æ’ƒã«ã¤ã„ã¦ã‚‚è©•ä¾¡ã‚’è¡Œã„ã€å¹¾ã¤ã‹ã¯å…¨ãç¾å®Ÿçš„ã«ä¸å¯èƒ½ãªãƒ¬ãƒ™ãƒ«ã§ã¯ãªã„ã“ã¨ãŒç¤ºã•ã‚ŒãŸã€‚MD5ã¨SHA-1ã§TLSãƒãƒ³ãƒ‰ã‚·ã‚§ã‚¤ã‚¯ã®å®Œå…¨æ€§ã‚’æ‹…ä¿ã—ã¦ã„ã‚‹TLS1.0/
totoadad 2016/01/13
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

TLS

SSL

security

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
OpenSSLã®è„†å¼±æ€§(CVE-2015-1793)ã«ã‚ˆã‚‹Altãƒã‚§ãƒ¼ãƒ³è¨¼æ˜Žæ›¸å½é€ ã®ä»•çµ„ã¿ - ã¼ã¡ã¼ã¡æ—¥è¨˜
TL;DR ã‚„ã£ã±ã‚Šæ›¸ã„ã¦ã„ãŸã‚‰é•·æ–‡ã«ãªã£ã¦ã—ã¾ã„ã¾ã—ãŸã€‚ã‚ã¾ã‚Šã¡ã‚ƒã‚“ã¨æŽ¨æ•²ã™ã‚‹æ°—åŠ›ãŒãªã„ã®ã§ã€å¤‰ãªæ–‡ç« ã«ãªã£ã¦ã„ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ã”äº†æ‰¿ã„ãŸã ã‘ã‚‹æ–¹ã®ã¿ãŠèªã¿ãã ã•ã„ã€‚ 1. ã¯ã˜ã‚ã« æ˜¨æ™©æœªæ˜Žã«OpenSSL-1.0.2d, 1.0.1pãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚äº‹å‰ã«äºˆå‘Šã•ã‚Œã¦ã„ãŸé€šã‚Šæ·±åˆ»åº¦é«˜ã®è„†å¼±æ€§CVE-2015-1793ãŒä¿®æ£ã•ã‚Œã¦ã„ã¾ã™ã€‚Advisoryã‚’è¦‹ã‚‹ã¨ã€ã“ã®è„†å¼±æ€§ãŒiojs/Nodeã«å½±éŸ¿ãŒã‚ã‚‹ã¨ã„ã†ã“ã¨ãŒåˆ¤æ˜Žã—ãŸã®ã§ç›´ã¡ã«iojs/Nodeã®ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã‚’è¡Œã„ã€ä»Šæœæœªæ˜Žã«ç„¡äº‹è„†å¼±æ€§å¯¾å¿œç‰ˆã‚’ãƒªãƒªãƒ¼ã‚¹ã—ã¾ã—ãŸã€‚ ä»Šå›žãŒåˆã‚ã¦ã§ã¯ã‚ã‚Šã¾ã›ã‚“ãŒã€æ·±å¤œã«æ—¥æ¬§ç±³ã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒgithubä¸Šã§äº’ã„ã«é€£æºã—ãªãŒã‚‰é€Ÿã‚„ã‹ã«ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®ãƒªãƒªãƒ¼ã‚¹ä½œæ¥ã‚’è¡Œã†ã“ã¨ã¯ä½•å›žã‚„ã£ã¦ã‚‚ãªã‹ãªã‹ã—ã³ã‚Œã‚‹çµŒé¨“ã§ã™ã€‚æ™‚å·®ã‚‚ã‚ã‚Šãªã‹ãªã‹ä½“åŠ›çš„ã«ã¯è¾›ã„ã‚‚ã®ãŒã‚ã‚Šã¾ã™ãŒã€ä¸–ç•Œã®è¶…ä¸€æµã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¨å…±åŒã§ãƒªã‚¢
totoadad 2015/07/12
openssl

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

è„†å¼±æ€§

web

ssl
ãƒªãƒ³ã‚¯
#mailerstudy 02 ãƒ¡ãƒ¼ãƒ«ã¨æš—å· - SSL/TLS -
2. 2 ç§ã¯èª° â€¢ æ°å: æ»æ¾¤ éš†å² @ttkzw â€¢ æ‰€å±ž: æ ªå¼ä¼šç¤¾ãƒãƒ¼ãƒˆãƒ“ãƒ¼ãƒ„ â€¢ ä½•ã‚„ã£ã¦ã„ã‚‹äºº â–« ãƒ¡ãƒ¼ãƒ©Muttã®å›½éš›åŒ–ã‚„æ—¥æœ¬èªžå¯¾å¿œãƒ‘ãƒƒãƒä½œè€… â–« SpamAssassinã®æ—¥æœ¬èªžå¯¾å¿œãƒ‘ãƒƒãƒä½œè€… â€¢ ãƒ¡ãƒ¼ãƒ«ã‚·ã‚¹ãƒ†ãƒ ã¨ã®é–¢ã‚ã‚Š â–« ã‚·ã‚¹ãƒ†ãƒ ç®¡ç†è€…ã¨ã—ã¦1997å¹´ã‹ã‚‰2006å¹´ã¾ã§ãƒ¡ãƒ¼ãƒ«ã‚µãƒ¼ ãƒã®ç®¡ç† â–« æ˜”ã€qmailé–¢é€£ã§è‰²ã€…ã‚„ã£ã¦ã„ãŸã€‚2006å¹´ã«qmailæ¨ã¦æ¨ ã¦ã€‚Postfix/Dovecoté£ã„ã«ã‚¯ãƒ©ã‚¹ãƒã‚§ãƒ³ã‚¸ â–« ç¾åœ¨ã¯å€‹äººã‚µãƒ¼ãƒã§ãƒ¡ãƒ¼ãƒ«ã‚µãƒ¼ãƒã‚’é‹ç”¨ ï‚– Postfix + Dovecot + Sieve(dovecot-pigeonhole) + ClamAV + SpamAssassin + spamass-milter + Roundcube
totoadad 2015/03/20
SSL

TLS

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

mail

æš—å·åŒ–
ãƒªãƒ³ã‚¯
Tracking the FREAK Attack
On Tuesday, March 3, 2015, researchers announced a new SSL/TLS vulnerability called the FREAK attack. It allows an attacker to intercept HTTPS connections between vulnerable clients and servers and force them to use weakened encryption, which the attacker can break to steal or manipulate sensitive data. This site is dedicated to tracking the impact of the attack and helping users test whether they
totoadad 2015/03/06
freak

TLS

è„†å¼±æ€§

ssl

security
ãƒªãƒ³ã‚¯
ç„¡æ–™ã§SSLä½¿ãˆã‚‹æ™‚ä»£ãã¦ãŸï¼CloudFlareæœ€é«˜ï¼ï¼ï¼ï¼ˆï¼Ÿï¼‰ - uzullaãŒãƒ–ãƒã‚°
ã—ã‚‡ã†ã‚‚ãªã„æ—¥è¨˜ YAPCè¡Œè„šã€ç¦å²¡ç·¨ - uzullaãŒãƒ–ãƒã‚° ã¨ã‹ã‹ã„ãŸå¾Œã«ãªã‚“ã¨ãªããƒ„ã‚¤ãƒƒã‚¿ãƒ¼ã‚’ã¿ã¦ã„ãŸã‚‰ã€ã‚ã‚‹ãƒ„ã‚¤ãƒ¼ãƒˆã‚’ã¿ã¾ã—ã¦ã€‚ packagist.jpã‚’cloudflareå¯¾å¿œã—ãŸã‚‰ã€è‡ªå‹•çš„ã«HTTPSå¯¾å¿œã§ããŸã§ã”ã–ã‚‹ã€‚ã™ã”ã„ã€‚ä¸€å††ã‚‚æ‰•ã£ã¦ãªã„ã®ã« https://t.co/moCiiSwb44â€” Hiraku (@Hiraku) 2015å¹´2æœˆ24æ—¥ ãã‚Œã§CloudFlare(http://cloudflare.com/)ãŒã‚¿ãƒ€ã§SSLè¨¼æ˜Žæ›¸ã‚’ç”¨æ„ã—ã¦ãã‚Œã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ãŸã®ã‚’çŸ¥ã‚Šã¾ã—ãŸã€‚ Cloudflare Free SSL/TLS | Get SSL Certificates | Cloudflare ã‚¿ãƒ€ï¼ãªã‚“ã¨ç”˜ç¾ŽãªéŸ¿ãï¼ ã‚ªãƒ SNIã§ã‹ã¾ã‚ãªã„ãªã‚‰ã€CloudFlareã‚’ã¤ã‹ãˆã°ValidãªSSLãŒã‚¿ãƒ€ã§åˆ©ç”¨ã§ãã‚‹ã€‚ SNIã¨ã¯ï¼Ÿ NameBaseã®Vir
totoadad 2015/02/25
SSL

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

security

https
ãƒªãƒ³ã‚¯
Superfish/eDellRootãŒå±é™ºãªç†ç”± - ã‚ã‚‚ãŠãã°
Lenovoè£½ã®PCã®ä¸€éƒ¨ã«Superfishã¨ã„ã†ãƒžãƒ«ã‚¦ã‚§ã‚¢ãŒæ¨™æº–ã§ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã‚‹ã“ã¨ãŒç¢ºèªã•ã‚Œã€å¤§ããªå•é¡Œã¨ãªã£ã¦ã„ã¾ã™ã€‚ [2015-11-24è¿½è¨˜] DELLè£½ã®PCã«ã‚‚ã€ã€ŒeDellRootã€ã¨ã•ã‚Œã‚‹Superfishã¨åŒæ§˜ã®å•é¡Œã‚’æŒã¤ãƒ«ãƒ¼ãƒˆè¨¼æ˜Žæ›¸ãŒå°Žå…¥ã•ã‚Œã¦ã„ã‚‹ã‚ˆã†ã§ã™ã€‚ Dellã®PCã«ä¸å¯©ãªãƒ«ãƒ¼ãƒˆè¨¼æ˜Žæ›¸ã€Lenovoã®Superfishã¨åŒã˜å•é¡Œã‹ - ITmedia ã‚¨ãƒ³ã‚¿ãƒ¼ãƒ—ãƒ©ã‚¤ã‚º Dude, You Got Dellâ€™d: Publishing Your Privates - Blog - Duo Security Joe Nord personal blog: New Dell computer comes with a eDellRoot trusted root certificate https://t.co/chURwV7eNE eDellRootã§
totoadad 2015/02/20
è¨¼æ˜Žæ›¸

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

SSL

ãƒ–ãƒ©ã‚¦ã‚¶

security
ãƒªãƒ³ã‚¯
1