Upgrade to Pro — share decks privately, control downloads, hide ads and more …

第一フラグメント便乗攻撃 (IP フラグメンテーションアタック) / aikora attack

koyane
September 07, 2019

第一フラグメント便乗攻撃 (IP フラグメンテーションアタック) / aikora attack

koyane

September 07, 2019
Tweet

More Decks by koyane

Other Decks in Technology

Transcript

  1. ୈҰϑϥάϝϯτศ৐߈ܸ
    *1ϑϥάϝϯςʔγϣϯΞλοΫ

    !%/4Թઘ
    ͜΍Ͷ !YLPZBOF

    View full-size slide

  2. "HFOEB
    w֓ཁ
    w%/4Ԡ౴ͷϑϥάϝϯςʔγϣϯ
    wϑϥάϝϯτͷِ૷
    wΞλοΫϕΫλ
    wରࡦ
    w&%/4CV⒎FSTJ[F
    w·ͱΊ
    2

    View full-size slide

  3. ࣗݾ঺հ
    wଠా݈໵
    wதژେֶେֶӃ޻ֶݚڀՊ.
    w৘ใॲཧֶձୈճશࠃେձͰൃද
    ‣ ֶੜ঑ྭ৆ड৆
    wͦΖͦΖब׆
    ‣ ಺ఆ͍ͩ͘͞
    3

    View full-size slide

  4. ୈҰϑϥάϝϯτศ৐߈ܸ
    w*1ϑϥάϝϯςʔγϣϯͷϦΞηϯϒϧॲཧΛѱ༻ͨ͠߈ܸ
    w൪໨Ҏ߱ͷϑϥάϝϯτʹؚ·ΕΔԠ౴Λॻ͖׵ِ͑ͯ૷Ԡ౴Λੜ੒
    w")FS[CFSH )4IVMNBO͕೥ʹࢦఠ
    ‣ 'SBHNFOUBUJPO$POTJEFSFE1PJTPOPVT<>
    4
    <>IUUQTBSYJWPSHBCT
    <>IUUQTVDTCJVBDJMdIFS[CFBTFDVSJUZGSBHQEG
    <>IUUQTXXXSFTFBSDIHBUFOFUQSPpMF"NJS@)FS[CFSHQVCMJDBUJPO@'SBHNFOUBUJPO@$POTJEFSFE@1PJTPOPVT@PS@0OFEPNBJOUPSVMFUIFNBMMPSHMJOLT
    CCBFECBGFC'SBHNFOUBUJPO$POTJEFSFE1PJTPOPVTPS0OFEPNBJOUPSVMFUIFNBMMPSHQEG

    View full-size slide

  5. ୈҰϑϥάϝϯτศ৐߈ܸ
    wݺͼํ͸৭ʑ
    ‣ ୈҰϑϥάϝϯτศ৐߈ܸ TUGSBHNFOUQJHHZCBDLJOHBUUBDLT

    ‣ ϑϥάϝϯςʔγϣϯΞλοΫ
    ‣ ΞΠίϥ߈ܸ
    5

    View full-size slide

  6. Πϝʔδ
    6
    +————————————+
    | DNS Header Section |
    +————————————+
    | DNS Question Section |
    +————————————+
    | DNS Answer Section |
    +————————————+
    | DNS Authority Section |
    +————————————+
    | DNS Additional Section |
    +————————————+
    正規の応答
    +————————————+
    | DNS Header Section |
    +————————————+
    | DNS Question Section |
    +————————————+
    | DNS Answer Section |
    +————————————+
    | DNS Authority Section |
    +————————————+
    | DNS Additional Section |
    +————————————+
    偽装した応答
    第1フラグメント
    第2フラグメント
    別の内容に差し替え

    View full-size slide

  7. ߈ܸྫ
    7
    正規の応答 偽装した応答

    View full-size slide

  8. ͜Ε·ͰͷܦҢ
    w ೥")FS[CFSH )4IVMNBO͕߈ܸͷ֓ཁΛൃද
    w೥݄5)MBWBDFL͕*$.1UZQF DPEF EFTUVOSFBDI
    GSBHOFFEFE
    Λ༻͍ͨ߈ܸྫΛൃද
    ‣ *1GSBHNFOUBUJPOBUUBDLPO%/4<>
    w೥݄.#SBOEUΒ͕ϑϥάϝϯτΞλοΫΛ༻͍ͯ%7ূ໌
    ॻΛෆਖ਼ʹൃߦͤ͞Δख๏Λൃද
    ‣ %PNBJO7BMJEBUJPO'PS.JU.3FTJMJFOU1,*<>
    8
    <>IUUQTSJQFSJQFOFUQSFTFOUBUJPOTJQGSBHBUUBDLQEG
    <>IUUQTQLJDBETJUGSBVOIPGFSEFNFEJBEPD$$4QEG

    View full-size slide

  9. ೥ͷಈ͖
    w౻ݪ͕߈ܸͷରࡦʹ͍ͭͯ·ͱΊͨ
    *OUFSOFU%SBGUΛൃද<>

    wଠా͕%/4Թઘ൪֎ฤͰൃද<>

    wଠా͕৘ใॲཧֶձશࠃେձͰൃද<>

    w/4%͕ϦϦʔε
    w%/40"3$
    ‣ ౻ݪ͕ൃද<>
    ‣ ϕϯμͱΦϖϨʔλ͕%/4qBHEBZʹ͍ͭͯ
    ύωϧσΟεΧογϣϯ<>
    w3*1&Ͱ%/4qBHEBZΛΞ
    φ΢ϯε< >

    w,OPU%/4͕ϦϦʔε
    w1PXFS%/43FDVSTPS͕ϦϦʔε
    w౦͕ݖҖαʔόଆͷରࡦΛ·ͱΊͨϖʔ
    δΛެ։<>

    w1PXFS%/4͕ϦϦʔε
    w(JU)VCͰ%/4qBHEBZͰਪ঑͢
    ΔόοϑΝαΠζͷٞ࿦։࢝<>
    9
    <>IUUQTJOEJDPEOTPBSDOFUFWFOUDPOUSJCVUJPOT
    <>IUUQTSJQFSJQFOFUBSDIJWFTWJEFP
    <>IUUQTEOTqBHEBZOFU
    <>IUUQTHJTUHJUIVCDPNIEBJTFEGCBDFDFG
    <>IUUQTHJUIVCDPNEOTWJPMBUJPOTEOTqBHEBZJTTVFT
    <>IUUQTUPPMTJFUGPSHIUNMESBGUGVKJXBSBEOTPQGSBHNFOUBUUBDL
    <>IUUQXXXDPOWJWJBMOFKQEOTFYUSBBJLPSBQEG
    <>IUUQTJQTKJYTROJJBDKQFK BDUJPOSFQPTJUPSZ@VSJJUFN@JE
    <>IUUQTJOEJDPEOTPBSDOFUFWFOUDPOUSJCVUJPOT

    View full-size slide

  10. %/4Ԡ౴ͷϑϥάϝϯςʔγϣϯ

    View full-size slide

  11. 6%1Ͱ%/4Ԡ౴͕ϑϥάϝϯτ͢ΔཁҼ
    w&%/4
    ‣ 6%1ʹ͓͚ΔϝοηʔδαΠζͷ্ݶ؇࿨
    wԠ౴αΠζͷ૿େ
    ‣ 595Ϩίʔυ΍%/44&$
    ‣ େྔͷ/4"""""ϨίʔυΛؚΉԠ౴
    wϑϥάϝϯςʔγϣϯͷ༠ൃ
    ‣ 1BUI.56%JTDPWFSZ
    11

    View full-size slide

  12. &%/4
    w&YUFOTJPO.FDIBOJTNTGPS%/4 &%/4

    ‣ 3'$ˠ
    wݱࡏͷόʔδϣϯ͸
    w֦ு༻ʹ"EEJUJPOBMηΫγϣϯʹ015ٖࣅ33Λ௥Ճ
    w%/44&$΍*1WʹରԠ͢Δ࣮૷Ͱ͸&%/4΁ͷରԠ͕ඞਢ 3'$


    12

    View full-size slide

  13. &%/4CV⒎FSTJ[F
    w6%1ʹ͓͚ΔϝοηʔδαΠζͷ্ݶΛ؇࿨
    ‣ ΦΫςοτͷൣғͰઃఆՄೳ
    wσϑΥϧτͰΦΫςοτͷ࣮૷͕ଟ͍
    wਪ঑஋ʹ͸༷ʑͳҙݟ͕
    ‣ FUD
    13

    View full-size slide

  14. %/44&$
    w%/44FDVSJUZ&YUFOTJPOT
    ‣ 3'$
    w33TFUʹରͯ͠ެ։伴҉߸ํࣜʹΑΔిࢠॺ໊
    wԠ౴ͷग़ࣗͱ׬શੑΛݕূՄೳ
    wॺ໊͸334*(33
    w൱ఆԠ౴ʹ͸/4&$/4&$33͕ՃΘΔ
    14

    View full-size slide

  15. %0Ϗοτ
    w%0 %/44&$0,
    Ϗοτ
    ‣ 015ٖࣅ33ʹؚ·ΕΔ
    ‣ ΦϯͰ%/44&$ؔ࿈ϨίʔυΛཁٻ
    ‣ σϑΥϧτͰΦϯʹͳ͍ͬͯΔϑϧϦκϧό͕ଟ͍
    wॺ໊ݕূΛ͠ͳ͍৔߹%/44&$ؔ࿈Ϩίʔυ͸ෆཁ
    ‣ Φϑʹ͢Δ͜ͱͰϝοηʔδαΠζΛ࡟ݮͰ͖Δ
    15

    View full-size slide

  16. %0Ϗοτͱ3'$
    w6OCPVOEͷΑ͏ʹ%0ϏοτΛΦϑʹ͢ΔΦϓγϣϯ͕ଘࡏ͠ͳ͍࣮૷
    ΋ଘࡏ
    wࠜڌ͸ ͓ͦΒ͘
    3'$TFDUJPO
    ‣ "The resolver side of a security-aware recursive name server MUST set the DO
    bit when sending requests, regardless of the state of the DO bit in the initiating
    request received by the name server side."
    16

    View full-size slide

  17. ϑϥάϝϯςʔγϣϯͷ༠ൃ
    w࣮ࡍʹϑϥάϝϯτ͢ΔαΠζͷԠ౴Λฦ͢͜ͱ͸গͳ͍
    ‣ Ұൠతͳ؀ڥͰ͸.56͸ΦΫςοτ
    ‣ ϝοηʔδѹॖ΋͋Δ
    wΑΓখ͍͞Ԡ౴αΠζͰ΋ϑϥάϝϯτ͍ͤͨ͞
    ‎ 1BUI.56%JTDPWFSZͷِ૷ʹΑΓ֎෦͔Β.56Λૢ࡞
    17

    View full-size slide

  18. 1BUI.56%JTDPWFSZ 1.56%

    wϗετؒͷܦ࿏ͷ.56Λ͋Β͔͡Ί୳ࡧ͠ɺܦ࿏్தͰͷϑϥάϝϯςʔ
    γϣϯΛ཈੍
    ‣ ୳ࡧ݁Ռʹج͍ͮͯૹ৴ݩͰϑϥάϝϯςʔγϣϯ
    ‣ *1WͰ͸ૹ৴ݩͰϑϥάϝϯτͤ͞Δ͜ͱʹͳ͍ͬͯΔ
    w*1WͰ͸*$.1UZQF DPEFϝοηʔδΛ༻͍Δ
    ‣ 1BDLFU5PP#JH 15#
    ͱΑ͹ΕΔ͜ͱ΋
    ‣ /FYU)PQ.56ͷ஋ʹ߹Θͤͯϑϥάϝϯτ
    18

    View full-size slide

  19. 1.56%Πϝʔδ
    19
    MTU: 1454 MTU: 768 MTU: 1500 MTU: 1500
    ①1280バイトのパケットを送信
    ②ICMP type3, code4メッセージ
    (Next-Hop MTU: 768 バイト)
    ③1280バイトのパケットを
    768バイトで分割して送信

    View full-size slide

  20. 1BUI.56࠮শ߈ܸ
    w1.56%Λِ૷ͯ͠֎෦͔Β.56Λૢ࡞
    w߈ܸʹར༻͢ΔݖҖαʔόʹର͠ɺϦκϧό·Ͱͷ1.56Λখ͘͞ݟͤ
    ͔͚Δ
    ‣ *$.1FDIPϦϓϥΠ΍%/4Ԡ౴ʹର͢Δ15#Λِ૷ͯ͠ૹ৴
    w-JOVY,FSOFMͷσϑΥϧτͰ͸όΠτ·ͰมߋՄೳ
    ‣ ݁ՌΛ෼ؒΩϟογϡ
    20

    View full-size slide

  21. 1.56࠮শ߈ܸΠϝʔδ
    21
    リゾルバ 権威サーバ 攻撃者
    ①送信元をリゾルバとする
    ICMP echo リクエスト
    (1280 バイト, DF ビットをセット)
    ②ICMP echo リプライ
    (1280バイト)
    ③送信元をリゾルバとする
    ICMP type3, code4 メッセージ
     (MTU を偽装)
    ③のパケットを受け⼊れた場合
    リゾリバとの通信は攻撃者が
    設定したMTUに変更される

    View full-size slide

  22. ϑϥάϝϯτͷِ૷

    View full-size slide

  23. ߈ܸखॱ
    23
    リゾルバ 権威サーバ 攻撃者
    ①偽装した
    第2フラグメントを送信
    ②名前解決要求
    ③⾮再帰問い合わせ
    ④第1フラグメントを送信
    ⑤第2フラグメントを送信 攻撃成功の場合、⑤は
    リアセンブルされない
    ①のパケットとIP-IDが⼀致
    する場合は攻撃成功
    (①と④がリアセンブル)

    View full-size slide

  24. %/4ͱ*1ϑϥάϝϯτ
    w6%1ϔομ΍%/4)FBEFSηΫγϣϯ͸࠷ॳͷϑϥάϝϯτʹؚ·ΕΔՄ
    ೳੑ͕ߴ͍
    ‣ *1ϔομ
    6%1ϔομ
    %/4)FBEFSηΫγϣϯ
    όΠτ
    w൪໨Ҏ߱ͷϑϥάϝϯτΛࠩ͠ସ͑ΔͨΊҎԼͷରࡦ͕ແޮ
    ‣ 6%1ιʔεϙʔτϥϯμϚΠθʔγϣϯ
    ‣ τϥϯβΫγϣϯ*%ϥϯμϚΠθʔγϣϯ
    wϦΞηϯϒϧ࣌ʹ͸*1ϔομɾ6%1ϔομͷ৘ใ͕ख͕͔Γ
    24

    View full-size slide

  25. ϑϥάϝϯτࠩ͠ସ͑ͷ৚݅
    w*1ϔομͷϑΟʔϧυ͕Ұக͢Δ͜ͱ
    ‣ TSD ETU*1ΞυϨε
    ‣ *1*EFOUJpDBUJPO *1*%

    ‣ ϑϥάϝϯτΦϑηοτ
    ‣ ϓϩτίϧφϯόʔ
    wϦΞηϯϒϧޙʹ6%1νΣοΫαϜɾαΠζ͕Ұக͢Δ͜ͱ
    w%/4ϝοηʔδͷ֤ηΫγϣϯͷϨίʔυ਺͕Ұக͢Δ͜ͱ
    25

    View full-size slide

  26. ϑϥάϝϯτࠩ͠ସ͑ͷ৚݅
    w*1ϔομͷϑΟʔϧυ͕Ұக͢Δ͜ͱ
    㾎TSD ETU*1ΞυϨε
    ‣ *1*EFOUJpDBUJPO *1*%

    ‣ ϑϥάϝϯτΦϑηοτ
    㾎ϓϩτίϧφϯόʔ
    wϦΞηϯϒϧޙʹ6%1νΣοΫαϜɾαΠζ͕Ұக͢Δ͜ͱ
    㾎%/4ϝοηʔδͷ֤ηΫγϣϯͷϨίʔυ਺͕Ұக͢Δ͜ͱ
    26

    View full-size slide

  27. 6%1νΣοΫαϜ
    w6%1ٙࣅϔομͱ6%1ϔομɾϖΠϩʔυ͔Βܭࢉ
    wόΠτͣͭՃࢉͯ͠ͷิ਺࿨ͷͷิ਺ΛٻΊΔ
    ‣ ح਺όΠτͷ৔߹͸ͰύσΟϯά
    27
    0 7 8 15 16 23 24 31
    +--------+--------+--------+--------+
    | source address |
    +--------+--------+--------+--------+
    | destination address |
    +--------+--------+--------+--------+
    | zero |protocol| UDP length |
    +--------+--------+--------+--------+
    UDP ٙࣅϔομ

    View full-size slide

  28. 6%1νΣοΫαϜͷܭࢉ
    w໰͍߹Θͤ͝ͱʹશମͷνΣοΫαϜ͸มԽ
    wԠ౴಺༰ͱϑϥάϝϯτҐஔ͕ෆมͳΒɺ൪໨Ҏ߱ͷϑϥάϝϯτͷϖ
    Πϩʔυ͸ෆม
    wνΣοΫαϜͷܭࢉํ๏͔ΒɺͦΕͧΕͷϑϥάϝϯτ͝ͱʹνΣοΫα
    Ϝ͕Ұக͢Ε͹Α͍
    ‎ ͋Β͔͡Ίਖ਼نԠ౴Λ༻ҙِͯ͠૷ϖΠϩʔυΛௐ੔
    28

    View full-size slide

  29. νΣοΫαϜܭࢉͷྫ
    29
    2 όΠτͣͭՃࢉͨ͠߹ܭ஋: 0x22F5F3 2 όΠτͣͭՃࢉͨ͠߹ܭ஋: 0x3F612
    1 ͷิ਺࿨: 0xF615 1 ͷิ਺࿨: 0xF615
    ਖ਼نԠ౴ͷྫ ِ૷Ԡ౴ͷྫ
    νΣοΫαϜ: 0x09EA νΣοΫαϜ: 0x09EA

    View full-size slide

  30. 6%1νΣοΫαϜͷِ૷
    wܭࢉํ๏͔ΒόΠτ͋Ε͹ௐ੔Մೳ
    wِ૷ͨ͠33ͷ55-Ͱௐ੔
    ‣ όΠτͷϑΟʔϧυ
    w&%/4͕࢖͑Δ৔߹͸&%/4ύσΟϯάΦϓγϣϯ 3'$
    Ͱ΋Մ
    ‣ ϖΠϩʔυ௕΋ௐ੔Մೳ
    30

    View full-size slide

  31. ϑϥάϝϯτࠩ͠ସ͑ͷ৚݅
    w*1ϔομͷϑΟʔϧυ͕Ұக͢Δ͜ͱ
    㾎TSD ETU*1ΞυϨε
    ‣ *1*EFOUJpDBUJPO *1*%

    ‣ ϑϥάϝϯτΦϑηοτ
    㾎ϓϩτίϧφϯόʔ
    㾎ϦΞηϯϒϧޙʹ6%1νΣοΫαϜɾαΠζ͕Ұக͢Δ͜ͱ
    㾎%/4ϝοηʔδͷ֤ηΫγϣϯͷϨίʔυ਺͕Ұக͢Δ͜ͱ
    31

    View full-size slide

  32. ϑϥάϝϯτҐஔͷௐ੔
    w1.56%ʹΑΓ౎߹ͷ͍͍ҐஔͰϑϥάϝϯτ
    ‣ Ϩίʔυ΍ηΫγϣϯͷڥքͳͲ
    w/FYU)PQ.56͸ *1ϔομ
    ͷഒ਺ ϖΠϩʔυ
    Ͱઃఆ
    ‣ ྫ6%1ϔομ͔ΒόΠτͷҐஔͰϑϥάϝϯτ͍ͤͨ͞৔߹ɺ/FYU)PQ.56͸
    όΠτʹઃఆ
    wROBNFͰ͞Βʹඍௐ੔
    ‣ ࠷େΦΫςοτ
    wௐ੔ͨ͠ϑϥάϝϯτҐஔʹج͍ͮͯ*1ϔομͷϑϥάϝϯτΦϑηοτͱϑϥάΛઃఆ
    32

    View full-size slide

  33. ϑϥάϝϯτࠩ͠ସ͑ͷ৚݅
    w*1ϔομͷϑΟʔϧυ͕Ұக͢Δ͜ͱ
    㾎TSD ETU*1ΞυϨε
    ‣ *1*EFOUJpDBUJPO *1*%

    㾎ϑϥάϝϯτΦϑηοτ
    㾎ϓϩτίϧφϯόʔ 6%1

    㾎ϦΞηϯϒϧޙʹ6%1νΣοΫαϜɾαΠζ͕Ұக͢Δ͜ͱ
    㾎%/4ϝοηʔδͷ֤ηΫγϣϯͷϨίʔυ਺͕Ұக͢Δ͜ͱ
    33

    View full-size slide

  34. *1*EFOUJpDBUJPO
    w*1WͰ͸Ϗοτͷ஋
    wܾఆํ๏͸࣮૷ґଘ
    ‣ ϥϯμϜͩͬͨΓγʔέϯγϟϧͩͬͨΓ
    ‣ ιʔεΞυϨε͝ͱͷΧ΢ϯλΛ࣋ͭ৔߹΋
    w͜ͷ஋Λ༧ଌ͢Δඞཁ͕͋Δ
    34

    View full-size slide

  35. ϦΞηϯϒϧॲཧ
    w*1*%ͱϑϥάϝϯτΦϑηοτɺ.'ϑϥάʹج͍ͮͯ࠶ߏங
    w͢΂ͯͷϑϥάϝϯτΛड৴͢Δ·ͰόοϑΝϦϯά
    wόοϑΝαΠζ͸࣮૷ґଘ
    ‣ -JOVY,FSOFMͷσϑΥϧτ஋͸ɺόοϑΝ࣌ؒ͸ඵ
    ‎ ߈ܸऀ͸όοϑΝ্ݶΪϦΪϦ·Ͱ*1*%ͷΈ͕ҟͳΔϑϥάϝϯτΛ
    ૹ৴Մೳ
    35

    View full-size slide

  36. ϑϥάϝϯτࠩ͠ସ͑৚݅ͷ·ͱΊ
    w6%1νΣοΫαϜ͸Ԡ౴͕ෆมͰ͋Ε͹༧ଌՄೳ
    wϑϥάϝϯτҐஔ΋࣮૷ʹΑΓ1BUI.56%JTDPWFSZROBNFͰௐ੔Մೳ
    w%/4ϝοηʔδͷ֤ηΫγϣϯͷϨίʔυ਺͸૿ݮͰ͖ͳ͍
    wϙʔτϥϯμϚΠζͳͲͷରࡦ͸ແޮ
    w*1*%ͷΈະ஌ͷঢ়ଶ
    ‣ ͲͷΑ͏ʹมԽ͢Δ͔͸༧ଌͰ͖Δ৔߹͕͋Δ
    ‎ *1W؀ڥԼͰ͸*1*%͕׬શʹϥϯμϜͰ΋Τϯτϩϐʔ͸Ϗοτ·Ͱ௿Լ
    36

    View full-size slide

  37. ΞλοΫϕΫλ

    View full-size slide

  38. ΞλοΫϕΫλͷݕ౼
    wηΫγϣϯ͝ͱͷϨίʔυ਺͸มߋͰ͖ͳ͍
    ‣ NBMGPSNFEʹͳΔ
    wͲͷΑ͏ͳԠ౴Λِ૷͢Ε͹Α͍͔ݕ౼͠ͳ͚Ε͹͍͚ͳ͍
    ‣ ҕৡݩͱҕৡઌͷͲͪΒΛλʔήοτʹ͢Δ͔
    ‣ ൱ఆԠ౴ͱҕৡԠ౴ͷͲͪΒΛ༻͍Δ͔
    ‣ %0Ϗοτͷঢ়ଶ
    w࣮૷΍߈ܸલͷΩϟογϡͷঢ়ଶʹ΋ґଘ
    38

    View full-size slide

  39. ࢀߟ
    3BOLJOHEBUB
    w3'$TFDUJPO
    wԠ౴ͷ৴པ౓ΛॱҐ͚ͮͨ͠΋ͷ
    wओͳϥϯΩϯά͸ҎԼͷ௨Γ
    39
    ݖҖ͋ΔԠ౴ͷ"OTXFSηΫγϣϯʹؚ·ΕΔݖҖ͋Δσʔλ
    ݖҖ͋ΔԠ౴ͷ"VUIPSJUZηΫγϣϯʹؚ·ΕΔσʔλ
    ݖҖͷͳ͍Ԡ౴ͷ"OTXFSηΫγϣϯͷσʔλ
    ݖҖ͋ΔԠ౴ͷ"OTXFSηΫγϣϯʹؚ·ΕΔݖҖͷͳ͍σʔλ
    ݖҖ͋ΔԠ౴ͷ"EEJUJPOBMηΫγϣϯͷσʔλ
    ݖҖͷͳ͍Ԡ౴ͷ"VUIPSJUZηΫγϣϯͷσʔλ
    ݖҖͷͳ͍Ԡ౴ͷ"EEJUJPOBMηΫγϣϯͷσʔλ
    ৴པ౓
    ߴ
    ௿

    View full-size slide

  40. ΞλοΫϕΫλͷྫ
    w൱ఆԠ౴
    ‣ /4&$
    334*(ϨίʔυΛஔ׵
    wҕৡԠ౴
    ‣ /4Ϩίʔυ΍""""" HMVF
    ϨίʔυΛஔ׵
    wϫΠϧυΧʔυ͕ઃఆ͞Εͨκʔϯ
    ‣ /4Ϩίʔυ΍""""" HMVF
    ϨίʔυΛஔ׵
    40

    View full-size slide

  41. ΞλοΫϕΫλͷྫ
    w595Ϩίʔυ
    ‣ 41'ϨίʔυͳͲ
    wTJCMJOHυϝΠϯͷ/4 """""Ϩίʔυ
    ‣ ྫ$ dig cname.small-is-beautiful.jp @a.dns.jp
    w6%1νΣοΫαϜ͕Ұக͠ͳ͍Ԡ౴Λੜ੒
    ‣ %P4߈ܸʹͳΔ
    41

    View full-size slide

  42. ൱ఆԠ౴ࠩ͠ସ͑߈ܸ
    wॺ໊κʔϯ΁%0ϏοτΛΦϯʹͯ͠໰͍߹ΘͤΔ৔߹Λ૝ఆ
    wॺ໊ະݕূͷϦκϧόͰ͸υϝΠϯϋΠδϟοΫ͕Մೳ
    wݕূ͍ͯͯ͠΋/4&$0QU0VUͰ͋Δ৔߹͸αϒυϝΠϯΠϯδΣΫγϣϯͰ͖ΔՄೳੑ
    w൱ఆԠ౴ͷ"VUIPSJUZηΫγϣϯʹؚ·ΕΔ334*(ϨίʔυΛ/4Ϩίʔυʹࠩ͠ସ͑
    wݖҖԠ౴ͷ"VUIPSJUZηΫγϣϯͱͯ͠Ωϟογϡ͍ͯ͠ΔϨίʔυͳΒஔ͖͔͑ΒΕΔՄೳ

    w࿈ଓ߈ܸ͕Մೳ
    ‣ ωΨςΟϒΩϟογϡ͕ଘࡏ͠ͳ͍υϝΠϯ໊͸ඞͣݖҖαʔό΁ͷ໰͍߹Θ͕ͤൃੜ
    42

    View full-size slide

  43. ൱ఆԠ౴ࠩ͠ସ͑߈ܸ
    43
    正規応答
    差し替え対象のレコード

    View full-size slide

  44. ൱ఆԠ౴ࠩ͠ସ͑߈ܸ
    44
    偽装応答
    差し替え後のレコード
    EDNS パディングオプションによる
    メッセージサイズとチェックサムの調整

    View full-size slide

  45. ൱ఆԠ౴ࠩ͠ସ͑߈ܸ
    w3BOLJOHEBUBͱ3'$Ͱྫࣔ͞Ε͍ͯΔ൱ఆԠ౴ͷܗࣜΛड͚ೖΕΔ
    ࣮૷ͰӨڹ
    ‣ ϝδϟʔͳ࣮૷Ͱ͸6OCPVOEҎԼɺ1PXFS%/4YҎԼͰӨڹ͋Γ
    ‣ ˠमਖ਼ࡁΈ
    wROBNFͷܾఆํ๏
    ‣ /4&$334*(Ϩίʔυͷ਺͕มԽ͠ͳ͍Α͏ʹ
    ‣ ϥϕϧͷ௕͞͸ݻఆ
    45

    View full-size slide

  46. ҕৡԠ౴ࠩ͠ସ͑߈ܸ
    wॺ໊κʔϯ͔Βະॺ໊κʔϯ΁ͷҕৡԠ౴Λ߈ܸ
    ‣ ॺ໊ݕূͷ༗ແʹΑΒͣ߈ܸՄೳ
    ҕৡݩͷ/4"""""ʹ͸334*(͕ଘࡏ͠ͳ͍
    ‣ ॺ໊ݕূ͍ͯ͠ͳ͍ͳΒॺ໊κʔϯ΁ͷҕৡ΋߈ܸՄ
    wԠ౴͕Ωϟογϡʹଘࡏ͠ͳ͍৔߹ʹ༗ޮ
    wେྔͷ/4Λ࣋ͭ৔߹΍/4ͷϥϕϧ͕௕͍৔߹͸ةݥ
    ‣ /4&$334*(͕ͳͯ͘΋ϑϥάϝϯτͤ͞ΒΕΔ
    46

    View full-size slide

  47. ҕৡԠ౴ࠩ͠ସ͑߈ܸ
    47
    差し替え対象のレコード

    View full-size slide

  48. ҕৡԠ౴ࠩ͠ସ͑߈ܸ
    48
    正規応答 偽装応答
    TTLによる
    チェックサムの調整 IPアドレスの置きかえ
    差し替え後のレコード

    View full-size slide

  49. TJCMJOHυϝΠϯʹΑΔ߈ܸ
    w߈ܸऀ͕߈ܸ༻ͷυϝΠϯ໊Λ༻ҙ
    49
    $ dig +norec +nocookie cname.small-is-beautiful.jp @a.dns.jp
    (snip)
    ;; AUTHORITY SECTION:
    small-is-beautiful.jp. 86400 IN NS d01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp.
    small-is-beautiful.jp. 86400 IN NS g01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp.
    small-is-beautiful.jp. 86400 IN NS a01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp.
    small-is-beautiful.jp. 86400 IN NS ns.small-is-beautiful.jp.
    small-is-beautiful.jp. 86400 IN NS c01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp.
    small-is-beautiful.jp. 86400 IN NS e01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp.
    small-is-beautiful.jp. 86400 IN NS f01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp.
    small-is-beautiful.jp. 86400 IN NS nsa.dns.jp.
    small-is-beautiful.jp. 86400 IN NS b01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp.
    ;; ADDITIONAL SECTION:
    ns.small-is-beautiful.jp. 86400 IN A 150.42.6.4
    nsa.dns.jp. 86400 IN A 203.119.1.4
    a01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp. 86400 IN A 150.42.6.4
    b01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp. 86400 IN A 150.42.6.4
    c01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp. 86400 IN A 150.42.6.4
    d01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp. 86400 IN A 150.42.6.4
    e01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp. 86400 IN A 150.42.6.4
    f01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp. 86400 IN A 150.42.6.4
    g01234567890123456789012345678901234567890123456789012345678901.small-is-beautiful.jp. 86400 IN A 150.42.6.4
    nsa.dns.jp. 86400 IN AAAA 2001:dc4::4
    ;; Query time: 17 msec
    ;; SERVER: 203.119.1.1#53(203.119.1.1)
    ;; WHEN: 火 9 03 22:37:49 JST 2019
    ;; MSG SIZE rcvd: 813
    dns.jp. の権威サーバ
    Linux ならフラグメントさせられる
    メッセージサイズ

    View full-size slide

  50. TJCMJOHυϝΠϯʹΑΔ߈ܸ
    w/4ϨίʔυͷҰ෦Λܑఋκʔϯͷ/4ʹ޲͚ɺHMVF"""""ϨίʔυΛِ૷
    ‣ TJCMJOHHMVFΛड͚ೖΕΔ࣮૷͸ةݥ
    ‣ ΩϟογϡΛ্ॻ͖͢Δ࣮૷ͳΒdns.jp.Λ৐ͬऔΕͦ͏
    wHMVFϨίʔυͷΩϟογϡ͕ઌʹଘࡏ͢Δ৔߹ʹ্ॻ͖Ͱ͖Δ͔͸࣮૷ґଘ
    wະରࡦͷݖҖαʔόͰӡ༻͞Ε͍ͯΔ৔߹͹ϑϥάϝϯτͤ͞ΒΕΔ
    ‣ /4Ϩίʔυͷ3%"5"෦෼ͷυϝΠϯ໊͸߈ܸऀࣗ਎Ͱௐ੔
    w਌κʔϯͷ/4ͷHMVF"""""Λ্ॻ͖Ͱ͖Δ͔͸ෆ໌ ະݕূ

    50

    View full-size slide

  51. TJCMJOHυϝΠϯʹΑΔ߈ܸ
    wϥ΢ϯυϩϏϯ͍ͯ͠Δ৔߹͸೉қ౓্͕͕Δ
    ‣ ϝοηʔδѹॖͷϙΠϯλ͕มԽ
    ‣ ௕͞΍Ϩίʔυ਺Λௐ੔Ͱ͖Ε͹ແࢹͰ͖Δ͸ͣ
    51

    View full-size slide

  52. ϫΠϧυΧʔυΛ༻͍ͨ߈ܸ
    wϫΠϧυΧʔυ͕ઃఆ͞ΕͨϨίʔυΛ໰͍߹Θͤ
    w෇ਵ͢Δ/4"""""ϨίʔυΛࠩ͠ସ͑
    w࿈ଓ߈ܸ͕Մೳ
    ‣ Ωϟογϡ͕ଘࡏ͠ͳ͚Ε͹ݖҖαʔό΁໰͍߹ΘͤΔ
    ‣ ಉ͡Ԡ౴͕ฦͬͯ͘Δ
    52

    View full-size slide

  53. ࠜຊతͳରࡦ Ϧκϧόଆ

    w&%/4όοϑΝαΠζΛখ͘͢͞Δ
    ‣ େ͖͍Ԡ౴͸5$ϏοτΛཱͯͯ5$1ϑΥʔϧόοΫͤ͞Δ
    ‣ όΠτͩͱैདྷͷ%/4ͱಉ͡ڍಈʹ
    ਪ঑஋͸ٞ࿦͋Γ ޙड़

    ‣ -FUT&ODSZQU $MPVEqBSFͰ΋ରࡦࡁΈ
    wϑϥάϝϯτύέοτΛϑΝΠΞ΢ΥʔϧͰυϩοϓ
    wॺ໊ݕূ͠ͳ͍৔߹͸%0ϏοτΛΦϑʹ
    54

    *1Wͷ࠷খ.56͸όΠτͰ͋Γɺ&%/4όοϑΝαΠζͷมߋͱ
    %0ϏοτΦϑͰ͸๷͛ͳ͍έʔε΋͋ΔͨΊగਖ਼͠·͢ɻ

    View full-size slide

  54. ࠜຊతͳରࡦ ݖҖଆ

    w&%/4όοϑΝαΠζΛখ͘͢͞Δ
    w1.56Λແࢹ͢Δ
    ‣ -JOVYͷ৔߹͸,FSOFMҎ্ͰIP_PMTUDISC_OMITιέοτΦϓγϣϯΛ༻
    ͍Δ
    ‣ 'SFF#4%ͷ৔߹͸Өڹͳ͠
    ‣ ϝδϟʔͳ࣮૷Ͱ͸ରࡦࡁΈ
    IUUQTHJTUHJUIVCDPNIEBJTFEGCBDFDFG
    55

    *1Wͷ࠷খ.56͸όΠτͰ͋Γɺ&%/4όοϑΝαΠζͷมߋͱ
    IP_PMTUDISC_OMIT Ͱ͸๷͛ͳ͍έʔε΋͋ΔͨΊగਖ਼͠·͢ɻ

    View full-size slide

  55. ͦͷଞͷରࡦ
    wϦκϧόଆͰ"VUIPSJUZηΫγϣϯͷ/4ϨίʔυΛແࢹ
    ‣ ϝδϟʔͳ࣮૷Ͱ͸ରࡦࡁΈ
    6OCPVOE͸Ҏ্ɺ1PXFS%/43FDVSTPS͸Ҏ্ʹΞοϓσʔτΛ
    w2/".&NJOJNJTBUJPO
    w֤κʔϯͷ/4"""""ϨίʔυΛ"VUIPSJUBUJWF"OTXFSͱͯ͠Ωϟογϡ
    ‣ 6OCPVOEͷharden-referral-path: yesͱಉ༷ͷڍಈ
    w%/44&$΁ͷ׬શͳରԠ
    56

    View full-size slide

  56. 2/".&NJOJNJTBUJPO
    w3'$
    wඞཁ࠷খݶͷROBNFʹ୹ॖͯ͠ݖҖαʔόʹ໰͍߹Θͤ
    57
    . (root)
    a.dns.jp.
    ns.example.jp.
    Q: jp. IN NS
    A: jp. IN NS a.dns.jp.
    Q: example.jp. IN NS
    A: example.jp. IN NS ns.example.jp.
    Q: www.example.jp. IN A
    A: www.example.jp. IN A 192.0.2.1
    Q: www.example.jp. IN A
    A: www.example.jp. IN A 192.0.2.1

    View full-size slide

  57. %/44&$΁ͷ׬શͳରԠ
    w׬શͳରԠ
    ‣ ͢΂ͯͷκʔϯʹ͓͍ͯॺ໊
    /4&$0QU0VU΋ͳ͠
    ‣ ͢΂ͯͷϑϧϦκϧόͰॺ໊ݕূ
    wݱ࣮తͰ͸ͳ͍
    ‣ αʔόෛՙͷ্ঢɺӡ༻໘ͷ՝୊
    ‣ ීٴ཰
    58

    View full-size slide

  58. &%/4CV⒎FSTJ[F໰୊

    View full-size slide

  59. &%/4CV⒎FSTJ[F໰୊
    wCV⒎FSTJ[FΛখ͘͢͞Δ͜ͱͰ6%1ʹ͓͚ΔϝοηʔδαΠζΛ੍ݶ
    ‣ େ͖͍Ԡ౴͸5$1Ͱ
    wαΠζΛ͍ͭ͘ʹ͢Δͷ͕Α͍͔
    ‣ ύϑΥʔϚϯεͱϑϥάϝϯςʔγϣϯ཈੍ͷόϥϯε
    60

    View full-size slide

  60. &%/4CV⒎FSTJ[F͋Ε͜Ε
    w
    ‣ ैདྷͱಉ͡αΠζ
    ‣ චऀΒͷਪ঑஋
    w
    ‣ ܭࢉํ๏͸ෆ໌ ͔Β੾Γࣺͯ

    ‣ %/44&$Ͱ.645TVQQPSUͱ͞ΕΔ
    ࠷খ஋ 3'$TFDUJPO

    w
    ‣ *1W)FBEFS
    6%1
    )FBEFS
    *1W"UPNJD
    'SBHNFOU

    w

    w
    ‣ ଟ͘ͷ࣮૷ͷσϑΥϧτ஋
    61

    View full-size slide

  61. &%/4CV⒎FSTJ[Fਪ঑஋
    w͔͕༗ྗ
    ‣ %/44&$ͷύϑΥʔϚϯεΛߟྀ
    ‣ IP_PMTUDISC_OMITΛ࢖͍ͬͯͳ͍࣮૷Ͱ͸ϑϥάϝϯτͤ͞ΒΕΔ
    wͳΒଟ͘ͷ৔߹େৎ෉ͦ͏
    ‣ ύϑΥʔϚϯε͸௿Լ͢Δ
    ‣ CV⒎FSTJ[FΛແࢹ͢ΔݖҖαʔό࣮૷͕ଘࡏ͢Δ
    62

    View full-size slide

  62. ·ͱΊ
    wୈҰϑϥάϝϯτศ৐߈ܸ͸ϑϥάϝϯτύέοτͷϦΞηϯϒϧॲཧΛѱ༻
    ͨ͠߈ܸ
    w৚͕݅߹͑͹ΩϟογϡϙΠζχϯάՄೳ
    wରࡦɾ؇࿨ࡦ͋Γ
    ‣ ࠷৽ͷόʔδϣϯʹΞοϓσʔτΛ
    ‣ &%/4CV⒎FSTJ[F΋খ͘͞ઃఆ
    w&%/4CV⒎FSTJ[Fʹ͍ͭͯ͸͍͔ͭ͘ީิ͋Γ
    64

    View full-size slide