Upgrade to Pro — share decks privately, control downloads, hide ads and more …

ハニーポットのログを国別で傾向分析してみた

 ハニーポットのログを国別で傾向分析してみた

2019年3月9日 第6回 ハニーポッター技術交流会
@morihi_soc #hanipo_tech
https://hanipo-tech.connpass.com/event/120318/

Kazuaki Morihisa

March 09, 2019
Tweet

More Decks by Kazuaki Morihisa

Other Decks in Technology

Transcript

  1. 2019೥3݄9೔ ୈ6ճ ϋχʔϙολʔٕज़ަྲྀձ
    ϋχʔϙοτͷϩάΛࠃผͰ
    ܏޲෼ੳͯ͠Έͨ
    @morihi_soc

    View full-size slide

  2. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ 2
    XIPBNJ
    w ৿ٱ࿨ত !NPSJIJ@TPD

    w ຊۀ͸ωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ
    w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ
    w ϒϩάˠIUUQTXXXNPSJIJTPDOFU
    w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ
    w IUUQTIBOJQPUFDIDPOOQBTTDPN
    ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ(Ұ෦)
    ɾ*5,FZT ݱ4FD$BQ

    ɾωοτϫʔΫύέοτΛಡΉձ Ծ

    ɾ/*4$αΠόʔϋϩ΢Οϯ
    ɾ*OUFSOFU8FFLɾ)BSEFOJOH
    ɾTTNKQɾ"*4FDɾ4UVEZ$PEF
    ɾULULηΩϡϦςΟษڧձ
    ɾ૯ؔ੢αΠόʔηΩϡϦςΟ-5େձ
    ɾ08"41/BHPZBɾ*P54FD+1
    ɾ͢ΈͩηΩϡϦςΟษڧձ
    ग़൛ͨ͠ຊ΍ٕज़ಉਓࢽ NEW 2018೥10݄ˣ

    View full-size slide

  3. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    ͓඼ॻ͖
    w ֓ཁ
    w ஫ҙͱ͓அΓ
    w άϥϑͷݟํ
    w ੬ऑੑҰཡ
    w ࠃผͷ߈ܸݕ஌܏޲
    w ·ͱΊ
    w ͓·͚ 8FCඇެ։

    3

    View full-size slide

  4. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    ֓ཁ
    w .JSBJϘοτωοτͷ୆಄Λ͸͡Ίɺ*P5ػثΛૂͬ
    ͨ߈ܸ͕ઈ͑ͣ࿩୊ʹ্͕͍ͬͯ·͢ɻ
    w ϋχʔϙοτʹؔ͢ΔൃදΛ͍ͯ͠Δͱɺͨ·ʹࠃ
    ผͷ߈ܸݕ஌܏޲Λ஌Γ͍ͨͱ͍͏ཁ๬Λड͚Δ͜
    ͱ͕͋Γ·͢ɻ
    w ϋχʔϙοτͰݕ஌ͨ͠*P5ػثΛૂͬͨ߈ܸͷϩ
    άΛݩʹͯ͠ࠃผͷ܏޲Λௐࠪͯ͠Έ·ͨ͠ɻ
    4

    View full-size slide

  5. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    w ஫ҙ
    w ຊࢿྉ͸ɺݸਓͰ؅ཧ͍ͯ͠ΔϋχʔϙοτͷϩάΛݩʹ࡞੒͠·ͨ͠
    w ϋχʔϙοτ͸ੈքΧࠃʹ෼ࢄͯ͠ઃஔ͍ͯ͠·͢
    w ಛఆͷࠃ΍૊৫ "4΍*41ͳͲ
    Λඇ೉΍ᎏ᎐͢Δ໨తͰ͸͋Γ·ͤΜ
    w ͋͘·Ͱɺաڈͷ߈ܸ܏޲Λࣔ͢ͷΈͰ͢
    w ͓அΓ
    w ࠃͷूܭʹ͸ɺϋχʔϙοτͷϩάͱͯ͠ه࿥͞Ε͍ͯΔૹ৴ݩϗετ
    ͷʮ*1ΞυϨεʯΛج४ͱ͍ͯ͠·͢
    w ૹ৴ݩϗετͷར༻ऀ͕ඞͣ͠΋ѱҙ͋Δ߈ܸऀͱ͸ݶΓ·ͤΜ
    w ͨͱ͑͹ͳΜΒ͔ͷݪҼͰ৐ͬऔΒΕͯ͠·ͬͨϗετΛ౿Έ୆ͱͯ͠
    ୈࡾऀ͕ ѱҙΛ࣋ͬͯ
    ࢖͍ͬͯΔՄೳੑ͕͋Γ·͢
    w ͨͩຊࢿྉͷதͰ͸ɺ௚ײతͳΘ͔Γ΍͢͞Λ༏ઌ͢ΔͨΊʹɺૹ৴ݩ
    Λ߈ܸݩͱදݱ͠·͢
    ஫ҙͱ͓அΓ
    5
    ௐࠪظؒɿ2018೥1݄1೔-2018೥12݄31೔
    ஫ҙ
    ͓அΓ
    IP ΞυϨεͷࠃͷࣝผʹ͸ MaxMind ࣾͷ GeoLite2 Λ࢖༻͠·ͨ͠ɻ

    View full-size slide

  6. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    άϥϑͷݟํ
    w ੬ऑੑ͝ͱʹͭͷάϥϑΛܝࡌ͍ͯ͠·͢ɻ
    6
    ߈ܸݩͷࠃผ
    ԁάϥϑ
    ϋχʔϙοτͷࠃผ
    Ϩʔμʔνϟʔτ
    Ͳ͜ͷࠃͷ IP ͔Β߈ܸ͕
    ଟ͔ͬͨͷ͔ΛಡΈऔΕΔɻ
    ϘοτωοτԽͨ͠ϗετͷ

    ଘࡏ਺(܏޲)ͷࢦඪʹͳΔɻ
    (ϢχʔΫ IP ͷࠃ Top 10)
    Ͳ͜ͷࠃͰ২͑ͨϋχʔϙοτ
    ͕߈ܸΛड͚΍͔ͬͨ͢ͷ͔Λ
    ಡΈऔΕΔ(ͨͩ͠ฏۉ஋)ɻ
    ߈ܸର৅ʹͳͬͨ৔߹ͷ

    ߈ܸͷड͚΍͢͞ͷࢦඪʹͳΔɻ
    ※IP ΞυϨε͝ͱͷճ਺͸ߟྀ͠·ͤΜ

    View full-size slide

  7. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    ੬ऑੑҰཡ

    "75&$)*1$BNFSB/73%73σόΠε

    %-JOLػثͷDPNNBOEQIQ

    %-JOLػثͷ)/"140"1"DUJPO

    %-JOL%4-#

    &O(FOJVT&O4IBSF*P5(JHBCJU$MPVE4FSWJDF

    (10/ϧʔλ

    )VBXFJ3PVUFS)(

    -JOLTZT&TFSJFT

    3FBMUFL4%,.JOJJHE61O140"1

    ;ZYFMϧʔλ
    7
    ※࣮ࡍͷ߈ܸ௨৴͸লུɻ௨৴ͷࢀߟ৘ใ↓
    https://www.paloaltonetworks.jp/company/in-the-news/2018/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns
    https://www.paloaltonetworks.jp/company/in-the-news/2018/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall

    View full-size slide

  8. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    "75&$)*1$BNFSB/73%73σόΠε
    8
    •ΪϦγϟͱΠϯυωγΞ͔Βͷ߈ܸ͕ଟ͔ͬͨ
    ࠨ:GR:ΪϦγϟ, ID:ΠϯυωγΞ, US:ΞϝϦΧ, CN:தࠃ, VN:ϕτφϜ, DE:υΠπ, DO:υϛχΧڞ࿨ࠃ, RU:ϩγΞ, MX:ϝΩγί, IT:ΠλϦΞ
    ӈ:US:ΞϝϦΧ, CA:Χφμ, AU:ΦʔετϥϦΞ, DE:υΠπ, FR:ϑϥϯε, IN:Πϯυ, NL:Φϥϯμ, SG:γϯΨϙʔϧ, UK:ΠΪϦε
    ΪϦγϟͷ
    153ݸͷ
    IP͔Β߈ܸ
    ΦʔετϥϦΞʹ২͑ͨ
    ϋχʔϙοτͰ͸1୆͋ͨΓ
    ฏۉ45ճͷ߈ܸΛड͚ͨ

    View full-size slide

  9. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    %-JOLػثͷDPNNBOEQIQ
    9
    •ϒϥδϧ͔Βͷ߈ܸ͕΄ͱΜͲͩͬͨ
    ࠨ:BR:ϒϥδϧ, DK:σϯϚʔΫ, US:ΞϝϦΧ, TR:τϧί, KR:ؖࠃ, JP:೔ຊ, IT:ΠλϦΞ, CN:தࠃ, CA:Χφμ, CO:ίϩϯϏΞ
    ӈ:US:ΞϝϦΧ, CA:Χφμ, AU:ΦʔετϥϦΞ, DE:υΠπ, FR:ϑϥϯε, IN:Πϯυ, NL:Φϥϯμ, SG:γϯΨϙʔϧ, UK:ΠΪϦε
    ࢀߟɿ2018೥ͷ IoT Ϙοτ؍ଌঢ়گͱ࠷ۙͷಈ޲
    https://sect.iij.ad.jp/d/2019/01/288147.html

    View full-size slide

  10. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    %-JOLػثͷ)/"140"1"DUJPO
    10
    •ΤδϓτͱϕτφϜ͔Βͷ߈ܸ͕ଟ͔ͬͨ
    ࠨ:EG:Τδϓτ, VN:ϕτφϜ, BR:ϒϥδϧ, RU:ϩγΞ, IT:ΠλϦΞ, CN:தࠃ, FR:ϑϥϯε, NG:φΠδΣϦΞ, KR:ؖࠃ, KZ:Χβϑελϯ
    ӈ:US:ΞϝϦΧ, CA:Χφμ, AU:ΦʔετϥϦΞ, DE:υΠπ, FR:ϑϥϯε, IN:Πϯυ, NL:Φϥϯμ, SG:γϯΨϙʔϧ, UK:ΠΪϦε
    ࢀߟɿJSOC INSIGHT vol.22
    https://www.lac.co.jp/lacwatch/pdf/20190206_jsoc_f001w.pdf

    View full-size slide

  11. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    %-JOL%4-#
    11
    •ΤδϓτͱϕτφϜ͔Βͷ߈ܸ͕ଟ͔ͬͨ
    ࠨ:EG:Τδϓτ, VN:ϕτφϜ, RU:ϩγΞ, IT:ΠλϦΞ, BR:ϒϥδϧ, JP:೔ຊ, CN:தࠃ, KR:ؖࠃ, US:ΞϝϦΧ, FR:ϑϥϯε
    ӈ:US:ΞϝϦΧ, CA:Χφμ, AU:ΦʔετϥϦΞ, DE:υΠπ, FR:ϑϥϯε, IN:Πϯυ, NL:Φϥϯμ, SG:γϯΨϙʔϧ, UK:ΠΪϦε
    ࢀߟɿʲΤόϯδΣϦετɾϘΠεʳIoTϚϧ΢ΣΞʹΑΔ߈ܸ͸ର؛ͷՐࣄͩͱࢥ͍ͬͯ·ͤΜ͔ʁ
    https://www.idnet.co.jp/column/page_020.html

    View full-size slide

  12. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    &O(FOJVT&O4IBSF*P5(JHBCJU$MPVE4FSWJDF
    12
    •ΞϝϦΧɺγϯΨϙʔϧɺ୆࿷͔Βͷ߈ܸ͕ଟ͔ͬͨ
    ࠨ:US:ΞϝϦΧ, SG:γϯΨϙʔϧ, TW:୆࿷, CA:Χφμ, HK:߳ߓ, KR:ؖࠃ, SE:ε΢Σʔσϯ, CZ:νΣί, MY:ϚϨʔγΞ, UK:ΠΪϦε
    ӈ:US:ΞϝϦΧ, CA:Χφμ, AU:ΦʔετϥϦΞ, DE:υΠπ, FR:ϑϥϯε, IN:Πϯυ, NL:Φϥϯμ, SG:γϯΨϙʔϧ, UK:ΠΪϦε

    View full-size slide

  13. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    (10/ϧʔλ
    13
    •ϝΩγί͔Βͷ߈ܸ͕ଟ͔ͬͨ
    ࠨ:MX:ϝΩγί, EC:ΤΫΞυϧ, EG:Τδϓτ, GE:δϣʔδΞ, IR:Πϥϯ, VN:ϕτφϜ, CN:தࠃ, BR:ϒϥδϧ, AM:ΞϧϝχΞ, DE:υΠπ
    ӈ:US:ΞϝϦΧ, CA:Χφμ, AU:ΦʔετϥϦΞ, DE:υΠπ, FR:ϑϥϯε, IN:Πϯυ, NL:Φϥϯμ, SG:γϯΨϙʔϧ, UK:ΠΪϦε
    ࢀߟɿՈఉ༻ GPON ϧʔλͷ੬ऑੑΛૂ͏ʮMiraiʯͷѥछɺϝΩγίൃͷωοτϫʔΫεΩϟϯ׆ಈͰ֬ೝ
    https://blog.trendmicro.co.jp/archives/17453

    View full-size slide

  14. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    )VBXFJ3PVUFS)(
    14
    •Φϥϯμʹ২͑ͨϋχʔϙοτʹର͢Δ߈ܸ͕ଟ͔ͬͨ
    ࠨ:RU:ϩγΞ, CN:தࠃ, VN:ϕτφϜ, JP:೔ຊ, US:ΞϝϦΧ, ID:ΠϯυωγΞ, GR:ΪϦγϟ, KR:ؖࠃ, EC:ΤΫΞυϧ, BR:ϒϥδϧ
    ӈ:US:ΞϝϦΧ, CA:Χφμ, AU:ΦʔετϥϦΞ, DE:υΠπ, FR:ϑϥϯε, IN:Πϯυ, NL:Φϥϯμ, SG:γϯΨϙʔϧ, UK:ΠΪϦε
    ࢀߟɿMiraiͷϫʔϜܕѥछͷ׆ಈ͕׆ൃԽ
    https://www.fortinet.co.jp/blog/threat-research/rise-of-one-more-mirai-worm-variant.html

    View full-size slide

  15. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    -JOLTZT&TFSJFT
    15
    •ϒϥδϧͱϕτφϜ͔Βͷ߈ܸ͕ଟ͔ͬͨ
    ࠨ:BR:ϒϥδϧ, VN:ϕτφϜ, CN:தࠃ, US:ΞϝϦΧ, RU:ϩγΞ, IN:Πϯυ, AR:Ξϧθϯνϯ,UA:΢ΫϥΠφ, NG:φΠδΣϦΞ, IT:ΠλϦΞ
    ӈ:US:ΞϝϦΧ, CA:Χφμ, AU:ΦʔετϥϦΞ, DE:υΠπ, FR:ϑϥϯε, IN:Πϯυ, NL:Φϥϯμ, SG:γϯΨϙʔϧ, UK:ΠΪϦε

    View full-size slide

  16. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    3FBMUFL4%,.JOJJHE61O140"1
    16
    •Τδϓτͱ೔ຊ͔Βͷ߈ܸ͕ଟ͔ͬͨ
    ࠨ:EG:Τδϓτ, JP:೔ຊ, IT:ΠλϦΞ, CN:தࠃ, RU:ϩγΞ, US:ΞϝϦΧ, FR:ϑϥϯε, GE:δϣʔδΞ, NL:Φϥϯμ, TW:୆࿷
    ӈ:US:ΞϝϦΧ, CA:Χφμ, AU:ΦʔετϥϦΞ, DE:υΠπ, FR:ϑϥϯε, IN:Πϯυ, NL:Φϥϯμ, SG:γϯΨϙʔϧ, UK:ΠΪϦε

    View full-size slide

  17. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    ;ZYFMϧʔλ
    17
    •೔ຊ͔Βͷ߈ܸ͕ଟ͔ͬͨ
    ࢀߟɿSatori ܥϘοτωοτ؍࡯ Attack from Japan
    https://speakerdeck.com/morihi_soc/satori-xi-hotutonetutoguan-cha-attack-from-japan
    ࠨ:JP:೔ຊ, FR:ϑϥϯε, IT:ΠλϦΞ, US:ΞϝϦΧ, KR:ؖࠃ, CN:தࠃ, VE:ϕτφϜ, RO:ϧʔϚχΞ,RE:ϨϢχΦϯ, GR:ΪϦγϟ, GF:ΪΞφ, DE: υΠπ
    ӈ:US:ΞϝϦΧ, CA:Χφμ, AU:ΦʔετϥϦΞ, DE:υΠπ, FR:ϑϥϯε, IN:Πϯυ, NL:Φϥϯμ, SG:γϯΨϙʔϧ, UK:ΠΪϦε

    View full-size slide

  18. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ
    ·ͱΊ
    w *P5ͷ੬ऑੑΛૂͬͨ߈ܸΛݸऔΓ্͛ͯɺࠃผ
    ͷ߈ܸ܏޲ͱϋχʔϙοτʹର͢Δ߈ܸͷ܏޲Λௐ
    ࠪ͠ɺ঺հͨ͠ɻ
    18

    View full-size slide

  19. ϋχʔϙοτͷϩάΛࠃผͰ܏޲෼ੳͯ͠Έͨ 19
    )BQQZ)POFZQPU
    ↑2018೥10݄21೔
    ौ୩۠;Ε͍͋২෺ηϯλʔͰࡱӨ
    ͓͠·͍

    View full-size slide

  20. ⬛⬛⬛⬛Λड͚͍ͯΔࠃ͔ΒͷΞΫηε
    ͓Αͼ
    ⬛อ༗ࠃ͔ΒͷΞΫηε
    ձ৔ͷΈެ։

    View full-size slide

  21. ո෺ͱಆ͏ऀ͸ɺͦͷաఔͰࣗΒ͕ո෺ͱԽ͞͵Α͏৺ͤΑɻ
    ͓·͕͑௕͘ਂ෵Λ೷͘ͳΒ͹ɺ
    ਂ෵΋·ͨ౳͓͘͠·͑Λݟฦ͢ͷͩɻ
    (߈ܸऀ)
    (߈ܸऀ)
    (ϋχʔϙοτ)
    (ϋχʔϙολʔ)

    View full-size slide