$30 off During Our Annual Pro Sale. View Details »

あなたの"履歴"を狙う攻撃たち / Eyes on Your Browsing History

あなたの"履歴"を狙う攻撃たち / Eyes on Your Browsing History

「第22回 ゼロから始めるセキュリティ入門 勉強会」で使った LT 資料です。
フルバージョンはこちら: https://diary.shift-js.info/browsing-history-sniffing/

Takashi Yoneuchi

December 07, 2018
Tweet

More Decks by Takashi Yoneuchi

Other Decks in Technology

Transcript

  1. ୈճθϩ͔Β࢝ΊΔηΩϡϦςΟೖ໳ษڧձ
    PO:PVS#SPXTJOH)JTUPSZ
    ͋ͳͨͷཤྺΛૂ͏߈ܸͨͪ
    !MNU@TXBMMPX
    BLB!ZOVDIZIUUQTTIJGUKTJOGP

    View Slide

  2. © 2018 shift-js.info All Rights Reserved.


    ‣ BLB!ZOVDIZ
    ‣ 6OEFSHSBEVBUFBU6OJWPG5PLZP
    ‣ ὑ8FC4FDVSJUZBOE)PLLBJEP
    ‣ 4UB⒎BU4&$$0/#FHJOOFST
    ‣ 4UB⒎BU4FDVSJUZ$BNQ
    ‣ 4FFIUUQTTIJGUKTJOGP

    !MNU@TXBMMPX

    View Slide

  3. © 2018 shift-js.info All Rights Reserved.
    /05&

    ஫ҙ
    ‣ ࠓճ͸ ຊ೔ެ։ͨ͠
    ࣍ͷϒϩάهࣄͷ಺༰ͷ঺հͰ͢
    ‣ #SPXTJOH)JTUPSZ4OJ⒏OH࠷લઢ͋ͳͨͷϒϥ΢βཤྺΛૂ͏
    ߈ܸͨͪ

    IUUQTEJBSZTIJGUKTJOGPCSPXTJOHIJTUPSZTOJ⒏OH
    ‣ ࠓճͷωλͷഎܠ
    ‣ 64&/*9ͷ4NJUIFUBM ͸ ݱ୅ͷ8FCϒϥ΢β๊͕͑Δ໰
    ୊ΛݟͭΊ௚͖͔͚ͬ͢ͱͯ͠ ͱͯ΋Ξπ͍
    ‣ ΦϑϨίΦϑϨί


    View Slide

  4. ϒϥ΢βཤྺͱ

    ϢʔβʔɾϓϥΠόγʔ

    View Slide

  5. © 2018 shift-js.info All Rights Reserved.
    #SPXTJOH)JTUPSZ

    ϒϥ΢βཤྺͷॏཁੑ
    ‣ ϒϥ΢βཤྺ #SPXTJOH)JTUPSZ
    ͸͋ΔݸਓΛΑ͘ද͢
    ‣ ࣍ͷ࿦จ͸#SPXTJOH)JTUPSZͷߴ͍VOJRVFOFTT͓Αͼ
    pOHFSQSJOUJOH΁ͷ༗ޮੑΛओு͍ͯ͠Δ
    ‣ -0MFKOJL $$BTUFMMVDDJB BOE"+BOD l8IZKPIOOZDBO`U
    CSPXTFJOQFBDF0OUIFVOJRVFOFTTPGXFCCSPXTJOHIJTUPSZ
    QBUUFSOT zJOUI8PSLTIPQPO)PU5PQJDTJO1SJWBDZ&OIBODJOH
    5FDIOPMPHJFT )PU1&5T

    ‣ ϒϥ΢βཤྺ #SPXTJOH)JTUPSZ
    ͸ݸਓͷଞͱͷؔ܎ੑ΋ද͢
    ‣ FH4/4Ͱͷ͋ΔਓͷϓϩϑΟʔϧͷӾཡཤྺ


    View Slide

  6. © 2018 shift-js.info All Rights Reserved.
    5XP$MBTTJDBM"UUBDLT

    7JTJUFEMJOL"UUBDLͱ$BDIFCBTFE"UUBDL
    ‣ ݱ୅ͷ)JTUPSZ4OJ⒏OHͷख๏͸ ֓Ͷ࣍ͷͭͷΧςΰϦʹ෼
    ྨ͢Δ͜ͱ͕Ͱ͖Δ
    ‣ 7JTJUFEMJOL"UUBDL
    ‣ WJTJUFEηϨΫλʹΑΔελΠϧͷมԽΛ ௚઀తcؒ઀త
    ʹ؍ଌ͢Δ
    λΠϓͷ)JTUPSZ4OJ⒏OH
    ‣ $BDIFCBTFE"UUBDL
    ‣ ϒϥ΢βͷ࠷దԽ 0QUJNJ[BUJPO
    ػߏ ͱΓΘ͚Ωϟογϡػߏͷڍಈ
    Λ؍ଌ͢ΔλΠϓͷ)JTUPSZ4OJ⒏OH


    View Slide

  7. © 2018 shift-js.info All Rights Reserved.
    WJTJUFE JO$44

    WJTJUFEηϨΫλ
    ‣ $44ʹ͸๚Εͨ͜ͱʹ͋Δ ϒϥ΢βཤྺதʹ͋Δ
    ϦϯΫʹର
    ͯ͠ͷΈ WJTJUFEͱݺ͹ΕΔٖࣅΫϥε QTFVEPDMBTT
    Λ༻͍
    ͯ ಛผͳελΠϧΛࢦఆ͢Δ͜ͱ͕Ͱ͖Δ
    ‣ ্͸๚Εͨ͜ͱͷ͋ΔϦϯΫΛ྘৭Ͱදࣔ͢Δ৔߹ͷྫ


    a:visited {
    color: green;
    }

    View Slide

  8. © 2018 shift-js.info All Rights Reserved.
    %JSFDU"CVTFPGWJTJUFE

    ௚઀ѱ༻͢Δ͜ͱ͸Ͱ͖Δ͔
    ‣ ݱࡏ ࣗ໌ͳѱ༻ํ๏͸๷͕Ε͍ͯΔ
    ‣ ੲ͸XJOEPXHFU$PNQVUFE4UZMF΍ͦͷ୅ସͨΓ͑Δ΋ͷʹΑ
    Γ WJTJUFEঢ়ଶͰ͋Δ͜ͱΛײ஌Ͱ͖͕ͨ ࠓ͸μϝ
    ‣ ͦ΋ͦ΋ࠓ͸WJTJUFEͷதͰࢦఆͰ͖ΔελΠϧ੍͕ݶ͞Ε͍ͯΔ
    ‣ FHCBDLHSPVOEJNHVSM
    Ͱ͖ͳ͍
    ‣ ΑΓৄ͘͠͸ҎԼΛҰಡͷ͜ͱ
    ‣ 1SJWBDZBOEUIFWJTJUFETFMFDUPS

    IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC$44
    1SJWBDZ@BOE@UIF@WJTJUFE@TFMFDUPS


    View Slide

  9. © 2018 shift-js.info All Rights Reserved.
    5IF&SBPG*OEJSFDU"CVTF
    ؒ઀తͳ߈ܸख๏΁
    ‣ ͦ͜Ͱؒ઀తͳѱ༻ํ๏͕໛ࡧ͞ΕΔΑ͏ʹͳ͖ͬͯͨ
    ‣ WJTJUFEηϨΫλΛར༻͢Δख๏
    ‣ WJTJUFEʹΑΓى͜ΔมԽ͕ٴ΅͢෭࡞༻Λ؍ଌ͢Δ
    ‣ αΠυνϟωϧ߈ܸతͳख๏Ͱ͋Δ
    ‣ WJTJUFEηϨΫλΛར༻͠ͳ͍ख๏
    ‣ ϒϥ΢βͷΩϟογϡػߏͷڍಈΛར༻ͨ͠΋ͷ
    ‣ )454Λར༻ͨ͠΋ͷ
    ‣ FH4OJ⒐ZIUUQEJSBDEFMUBTHJUIVCJPTOJ⒐Z
    ‣ ৄ͘͠͸ϒϩά΁

    IUUQTEJBSZTIJGUKTJOGPCSPXTJOHIJTUPSZTOJ⒏OH


    View Slide

  10. ࠓޙ

    *OUIF'VUVSF

    View Slide

  11. © 2018 shift-js.info All Rights Reserved.
    ෳࡶԽ͢Δ8FC

    5BOHMFE8PSMEPG8FC5FDIOPMPHZ
    ‣ 8FCٕज़ͷ$PNQMFYJUZ͸೔ʑ૿͍ͯ͠Δ
    ‣ ͦΕͧΕ͕ࣗ༝ͳਐԽΛ਱͛ ෳࡶʹབྷΈ߹͍ͬͯΔ
    ‣ ηΩϡϦςΟҙࣝͷͳ͍Ұ෦ͷ࢓༷΍࣮૷͕ શମͷ҆શʹ΄͜ΖͼΛ
    ࡞͍ͬͯΔͱ͍͏έʔε͕ ͜ͷෳࡶ͞ͷதʹӅΕ͍ͯΔ
    ‣ ͜ͷ$PNQMFYJUZͱͷ͏·͍޲͖߹͍ํΛಘ͍ͯ͘ඞཁ͕͋Δ
    ‣ /05&೥͸ҎԼͷΑ͏ͳൃද΋ͨ͠ͷͰڵຯ͕͋Ε͹ੋඇ
    ‣ 5BOHMFE8PSMEPG8FC5FDIOPMPHZ

    IUUQTTQFBLFSEFDLDPNMNU@TXBMMPXUBOHMFEXPSMEPGXFC
    UFDIOPMPHZBSFXFTBGF


    View Slide

  12. "OZ2VFTUJPOT
    5BLBTIJ:POFVDIJ
    KB!MNU@TXBMMPX FO!ZOVDIZ
    IUUQTTIJGUKTJOGP

    View Slide