Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up
for free
ハニーポットの育てかた
Kazuaki Morihisa
September 29, 2018
Technology
0
910
ハニーポットの育てかた
2018年9月29日 第5回 ハニーポッター技術交流会
@morihi_soc #hanipo_tech
https://hanipo-tech.connpass.com/event/97575/
Kazuaki Morihisa
September 29, 2018
Tweet
Share
More Decks by Kazuaki Morihisa
See All by Kazuaki Morihisa
morihi_soc
1
570
morihi_soc
1
1.2k
morihi_soc
2
1.3k
morihi_soc
5
2.5k
morihi_soc
0
690
morihi_soc
0
1.2k
morihi_soc
2
980
morihi_soc
1
920
morihi_soc
4
1.3k
Other Decks in Technology
See All in Technology
kaga
0
190
line_developers
PRO
0
150
satoshirobatofujimoto
0
110
zaki134rp
1
190
helayoty
0
130
nkjzm
1
840
clustervr
0
200
yukitodate
2
330
kekeke_47
0
280
hhiroshell
7
400
hamadakoji
0
1.1k
cygames
1
370
Featured
See All Featured
mthomps
39
2.3k
bkeepers
52
4.1k
pedronauck
652
110k
jensimmons
207
10k
garrettdimon
287
110k
smashingmag
283
47k
orderedlist
PRO
329
35k
productmarketing
5
650
davidbonilla
69
3.5k
swwweet
206
6.8k
chriscoyier
145
19k
colly
66
3k
Transcript
20189݄29 ୈ5ճ ϋχʔϙολʔٕज़ަྲྀձൃදࢿྉ ϋχʔϙοτͷҭ͔ͯͨ @morihi_soc
ϋχʔϙοτͷҭ͔ͯͨ XIPBNJ w ٱত !NPSJIJ@TPD w ຊۀωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ w झຯͰϋχʔϙοτΛӡ༻͢Δϋχʔϙολʔ
w ϒϩάˠIUUQTXXXNPSJIJTPDOFU w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ w IUUQTIBOJQPUFDIDPOOQBTTDPN 2 ࠓ·Ͱʹ͓ੈʹͳͬͨΠϕϯτ(Ұ෦) ɾ*5,FZT ݱ4FD$BQ ɾωοτϫʔΫύέοτΛಡΉձ Ծ ɾ/*4$αΠόʔϋϩΟϯ ɾ*OUFSOFU8FFLɾ)BSEFOJOH ɾTTNKQɾ"*4FDɾ4UVEZ$PEF ɾULULηΩϡϦςΟษڧձ ɾ૯ؔαΠόʔηΩϡϦςΟ-5େձ ɾ08"41/BHPZBɾ*P54FD+1 ग़൛ͨ͠ຊٕज़ಉਓࢽ NEW 20188݄ˣ
ϋχʔϙοτͷҭ͔ͯͨ ͓ॻ͖ w ϋχʔϙοτ͡Ί·ͨ͠ʙͦͷޙʙ w ָ͘͠ӡ༻͢Δํ๏ w QBTUFCJO w υϝΠϯΛׂΓͯΔ
w ৵ೖݕγεςϜ w ·ͱΊ 3
ϋχʔϙοτͷҭ͔ͯͨ ϋχʔϙοτ͡Ί·ͨ͠ʙͦͷޙʙ w ϋχʔϙοτͷڥΛߏங͢Δ͜ͱΛઐ༻ޠͰ ʮϋχʔϙοτΛ২͑Δʯͱ͍͏ɻ w ϋχʔϙοτΛӡ༻͢Δਓϋχʔϙολʔ w ت͍͜͠ͱʹɺϋχʔϙοτΛӡ༻͢Δ ϋχʔϙολʔ͕૿Ճʹ͋Γ·͢ɻ
w ϒϩά4/4ͳͲͰϋχʔϙοτͰಘͨϩάͷ ੳ݁ՌͳͲΛެ։ͯ͘͠Ε͍ͯΔਓ͍Δɻ w ެ։͞ΕͨใࢀߟʹͳΓ·͢ɻ ͋Γ͕ͱ͏͍͟͝·͢ 4
ϋχʔϙοτͷҭ͔ͯͨ w ͜ΜͳΈΛ͓࣋ͪͷํ͕͍Δ͔ʜ w ϋχʔϙοτΛ২͑ͯຬͨ͠ w ϩάऩू͕Βͳ͍ w ͋Δఔɺܾ·ͬͨ߈ܸ͔͠དྷͳ͍ w
Ͳ͏ͬͯੳ͢Ε͍͍͔Θ͔Βͳ͍ w ߈ܸख๏ͷௐํ͕Θ͔Βͳ͍ 5 ϋχʔϙοτ͡Ί·ͨ͠ʙͦͷޙʙ →ͦͯ͠์ஔɾɾɾ
ϋχʔϙοτͷҭ͔ͯͨ ϋχʔϙοτ͡Ί·ͨ͠ʙͦͷޙʙ w ์ஔ͞ΕͨϋχʔϙοτΛઐ༻ޠͰ ʮϋχʔϙοτ͕ރΕΔʯͱ͍͏ɻ w ͔ͤͬ͘ϋχʔϙολʔʹͳͬͨͷͳΒɺ ָ͘͠ӡ༻͍ͨ͠Ͱ͢ΑͶɻ 6
ϋχʔϙοτͷҭ͔ͯͨ ϋχʔϙοτΛָ͘͠ӡ༻͢Δํ๏ w ϩάΛऩू͢Δ্Ͱɺͬͱॏཁͩͱࢥ͏͜ͱ 7 ϋχʔϙοτͷଘࡏએݴ
ϋχʔϙοτͷҭ͔ͯͨ ଘࡏએݴ w Δ͜ͱ؆୯ɻϋχʔϙοτΛ২͑ͨϗετͷ *1ΞυϨευϝΠϯ໊Λग़͚ͩ͢ɻ w ࠓճͭհ͠·͢ɻ w QBTUFCJOʹͨΕࠐΉ w
υϝΠϯΛҭͯΔ 8
ϋχʔϙοτͷҭ͔ͯͨ ଘࡏએݴͦͷɿQBTUFCJO w QBTUFCJOςΩετΛެ։Ͱ͖Δ8FCαΠτ w ͍ํඇৗʹ؆୯ w Ϣʔβొෆཁɻͨͩ͠ޙ͔ΒهࣄΛআͰ͖Δ Α͏ʹొ͓͍ͯͨ͠ํ͕͍͍ɻ w
ͱΓ͑͋͑ͣ*1ΞυϨεΛ ॻ͍͓͚ͯͩ͘ͰޮՌ͋Γ 9 IUUQTQBTUFCJODPN
ϋχʔϙοτͷҭ͔ͯͨ ϋχʔϙολʔͷใࠂྫ 10 Ҿ༻ݩɿAWS Security JAWS ܦࡁతʹϋχʔϙοτͷϩάੳΛ͢ΔͨΊͷϕετϓϥΫςΟεʁ https://www.slideshare.net/MasamitsuMaehara/aws-security-jaws
ϋχʔϙοτͷҭ͔ͯͨ QBTUFCJOΛ͏ͱ͖ͷҙ w ςΩετΛެ։͢ΔͱɺΞΫηεͯ͘͠Δਓ͕݁ߏ ͍Δɻ ΫϩʔϦϯάͷ߹͋Δ ˠςετͨ͠ͱ͖࣌ؒʹਓఔӾཡ͞Εɺ ਓΞΫηε͠ʹ͖ͨɻ w
ϩάऩूՄೳͳঢ়ଶͰॻ͖ࠐΜͩํ͕ྑ͍ w ϋχʔϙοτͷӡ༻Λऴྃͨ͠ͱ͖ͷͨΊʹ QBTUFCJOͷهࣄΛআͰ͖ΔΑ͏ʹ͓ͯ͘͜͠ͱɻ ˠϋχʔϙοτͷ*1ΞυϨε͕ɺࣗͷཧ͔Β ์Εͯใ͕͍ͬͯΔͷΑ͘ͳ͍ɻ 11
ϋχʔϙοτͷҭ͔ͯͨ ଘࡏએݴͦͷɿυϝΠϯΛҭͯΔ w ࣾձਓϋχʔϙολʔͳΒɺαʔόͷϨϯλϧͩ ͚Ͱͳ͘ɺυϝΠϯΛܖͯ͠ϋχʔϙοτͷ*1 ΞυϨεʹඥ͚ͮͯӡ༻͍ͯ͠Δͣɻ w ͔ͤͬ͘ͳͷͰɺඥ͚ͮͨυϝΠϯΛҭͯͯΈΑ͏ɻ w جຊతͳߟ͑ํ4&0ͱಉ͡ɻ͔͠͠ϋχʔϙο
τͦ͜·Ͱྗ͠ͳͯ͘ྑ͍ɻ 12
ϋχʔϙοτͷҭ͔ͯͨ Ϙοτ͕ߟ͑ͯͦ͏ͳ͜ͱ w ݕࡧαΠτͰɺݕࡧͯ͠ग़ͯ͘Δ8FCαΠτ߈ܸ ͢ΔՁ͕͋Γͦ͏ɻ͔ͩΒ߈ܸ͢Δᶃ w ݕࡧͨ͠αΠτ͔ΒϦϯΫ͞ΕͨαΠτɺ߈ܸ͢ ΔՁ͕͋Γͦ͏ɻ͍ͭͰʹ߈ܸ͢Δᶄ w ߈ܸͷ༏ઌॱҐᶃᶄ
w ϋχʔϙολʔͷࢹͰߟ͑Δͱ w ᶃΛϋχʔϙοτͰӡ༻͢Δͷେมɻ ͦ͜Ͱී௨ͷ8FCαΠτͱͯ͠ӡ༻͢Δɻ w ᶄΛϋχʔϙοτͱͯ͠ӡ༻͢Δͷ؆୯ɻ ᶃ͔ΒϦϯΫ͓͚͑ͯ͞͠ྑ͍ɻ 13
ϋχʔϙοτͷҭ͔ͯͨ ͷ࣮ફه 14 ձݶΓ NO PHOTO ձݶఆ
ϋχʔϙοτͷҭ͔ͯͨ ͷ࣮ફه 15 ձݶΓ NO PHOTO ձݶఆ
ϋχʔϙοτͷҭ͔ͯͨ υϝΠϯΛҭͯΔͱ͖ͷҙ w ͘ӡ༻͢Δ΄Ͳ߈ܸΛऩू͘͢͠ͳΔ͕ɺ ϋχʔϙοτͱݟഁΒΕͯ͠·͏Մೳੑ͋Δɻ w ϋχʔϙοτͷαʔόۚʹՃ͑ͯɺυϝΠϯͷҡ ࣋අ͕͔͞Ήɻ w ͠ͷ͜ͱΛߟ͑ͯɺϋχʔϙοτ͕εύϜϝʔ
ϧͷ౿Έʹ͞Εͳ͍Α͏ʹ%/4ͷTQGϨίʔυ ͰʮBMMʯΛࢦఆ͓ͯ͘͠ͱ҆৺Ͱ͖Δɻ 16 ʢࢀߟʣ SPF Ϩίʔυඌͷ ”~all” ͱ ”-all” ͷҧ͍ https://www.nisc.go.jp/conference/suishin/adviser/dai5/pdf/sankou.pdf
ϋχʔϙοτͷҭ͔ͯͨ ϩάੳͷ w QBTUFCJOυϝΠϯΛҭͯΔ͜ͱͰɺ߈ܸΛऩू͠ ͘͢ͳΓ·͢ɻ w ͦ͏͢Δͱɺࠓ·Ͱݟͨ͜ͱͳ͍߈ܸࠞͬͯ͟ ͖·͢ɻ w ͜͏͍͏ͱ͖ʮ৵ೖݕγεςϜʯͷྗΛआΓΔ
ͱָ͘͠ͳΓ·͢ɻ 17
ϋχʔϙοτͷҭ͔ͯͨ ৵ೖݕγεςϜ w ৵ೖݕγεςϜ*%4 *OUSVTJPO%FUFDUJPO4ZTUFN ɺ߈ܸͷಛΛγάωνϟͱͯ͠ఆ͓͖ٛͯ͠ɺ ࢹରͷωοτϫʔΫʹྲྀΕΔ௨৴ͱҰகͨ͠ͱ ͖ʹΞϥʔτΛग़͢γεςϜɻ w ΦʔϓϯιʔειϑτΣΞͩͱ4OPSU͕༗໊
w 51PUΛӡ༻͍ͯ͠Δਓ4VSJDBUB͕͓ೃછΈ 18 Snort https://snort.org/ Suricata https://suricata-ids.org/
ϋχʔϙοτͷҭ͔ͯͨ ͰݟͯΘ͔Γ͘͢ w *%4ૉΒ͍͠ɻ߈ܸΛݟ͚ͭͯ͘ΕΔɻ w ͔͠͠ɺΞϥʔτਓؒͷʹ༏͘͠ͳ͍ ɻ w *%4ͷΞϥʔτΛՄࢹԽ͢ΔγεςϜ͕ཉ͍͠ɻ 19
* ͨͩ͠ύέοτ͖ͳਓআ͘ɻ
ϋχʔϙοτͷҭ͔ͯͨ 4OPSCZ w 4OPSU4VSJDBUBͷϩάΛՄࢹԽͯ͘͠ΕΔγες ϜͰ4OPSCZ͕Φεεϝɻ 20 Snorby https://github.com/Snorby/snorby
ϋχʔϙοτͷҭ͔ͯͨ 4OPSCZʹ͓͚Δϩάͷݟ͑ํ 21
ϋχʔϙοτͷҭ͔ͯͨ ͨͱ͑ɺ͜Μͳࢹڥ͍͔͕ w ߈ܸΛड͚Δ w ϋχʔϙοτ 808)POFZQPU w ߈ܸΛࢹ͢Δ
w *%4 4OPSU w 4OPSUͷϩάΛసૹ͢Δ w #BSOZBSE w ߈ܸͷϩάΛՄࢹԽ͢Δ w 4OPSCZ 22 Snorby ɺ Snort ͷϩά ΛݟΕͳ͍ɻͦ͜ͰBarnyard2 Ͱ Snort ͷϩάΛ Snorby ༻ͷ σʔλϕʔεసૹΛ͢Δɻ Snorby σʔλϕʔεͷϩά ΛՄࢹԽͯ͠ɺϒϥβ͔Β ϩάΛ֬ೝ͢Δ͜ͱ͕Ͱ͖Δɻ
ϋχʔϙοτͷҭ͔ͯͨ ࢹڥུ֓ਤ 23
ϋχʔϙοτͷҭ͔ͯͨ σϞ ձݶఆ 24
ϋχʔϙοτͷҭ͔ͯͨ ·ͱΊ w ϋχʔϙοτΛ͡Ίͨਓϩάऩूͱϩάੳʹ ࠔΔ͔͠Εͳ͍ɻ w ϋχʔϙοτͷଘࡏએݴେɻ w QBTUFCJOΛͬͨΓɺϋχʔϙοτʹׂΓ͍ͯͯ ΔυϝΠϯΛҭͯΔͱ߈ܸΛूΊ͍͢ɻ
w ϋχʔϙοτͱ*%4ΛฒߦՔಈͤ͞Δ͜ͱͰɺҧͬ ͨϩάͷݟ͑ํ͕Ͱ͖Δɻ w ඟᰈɺࣗͷ͖ͳελΠϧͰָ͠Ί͍͍ͱࢥ͏ɻ 25
ϋχʔϙοτͷҭ͔ͯͨ )BQQZ)POFZQPU 26 ←20186݄9 ৽॓ޚԓ େԹࣨͰࡱӨ ৯২Ͱͳ͍ɻ ͓͠·͍