Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Satori 系ボットネット観察 Attack from Japan

Kazuaki Morihisa
September 15, 2018

Satori 系ボットネット観察 Attack from Japan

2018年9月15日 IoTSecJP東京 Version4.0
@morihi_soc #IoTSecJP
https://iotsecjp.connpass.com/event/98193/

Kazuaki Morihisa

September 15, 2018
Tweet

More Decks by Kazuaki Morihisa

Other Decks in Technology

Transcript

  1. Satori ܥϘοτωοτ؍࡯ Attack from Japan XIPBNJ w ৿ٱ࿨ত !NPSJIJ@TPD 

    w ຊۀ͸ωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ w ϒϩάˠIUUQTXXXNPSJIJTPDOFU w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ w IUUQTIBOJQPUFDIDPOOQBTTDPN 2 ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ(Ұ෦) ɾ*5,FZT ݱ4FD$BQ  ɾωοτϫʔΫύέοτΛಡΉձ Ծ  ɾ/*4$αΠόʔϋϩ΢Οϯ ɾ*OUFSOFU8FFLɾ)BSEFOJOH ɾTTNKQɾ"*4FDɾ4UVEZ$PEF ɾULULηΩϡϦςΟษڧձ ɾ૯ؔ੢αΠόʔηΩϡϦςΟ-5େձ ɾ08"41/BHPZB ग़൛ͨ͠ຊ΍ٕज़ಉਓࢽ NEW 2018೥8݄ˣ
  2. Satori ܥϘοτωοτ؍࡯ Attack from Japan ࠓ೔ɺ఻͍͑ͨ͜ͱ w ษڧձ͕ऴΘͬͯؼ୐ͨ͠Βɺࣗ୐ͷϧʔλͷ ༷ࢠΛݟ͍ͯ͋͛ͯͩ͘͞ɻ w

    ϩάΠϯͰ͖Δ͔Ͳ͏͔ w ਎ʹ͕֮͑ͳ͍ઃఆ͕͞Ε͍ͯͳ͍͔Ͳ͏͔ w ͦͷଞɺؾʹͳΔ͜ͱ͕ͳ͍͔ 3
  3. Satori ܥϘοτωοτ؍࡯ Attack from Japan ϋχʔϙοτ w ϋχʔϙοτ )POFZQPU ͱ͸ɺ͋͑ͯ߈ܸΛड͚Δ

    ͜ͱΛલఏͱͨ͠γεςϜͰ͢ɻ w ϋχʔϙοτΛӡ༻͢Δਓͷ͜ͱˠϋχʔϙολʔ w 8FCʹಛԽͨ͠ϋχʔϙοτͷϩά͔Β
 4BUPSJϘοτωοτΛ؍࡯ͯ͠Έͨɻ w ˠ͓ߦّ͕ѱ͍ͷͰɺϩάΛऩू͠΍͍͢ɻ w σʔλιʔε͸ࣗ෼͕؅ཧ͍ͯ͠Δϋχʔϙοτͷ ΋ͷΛ࢖͍ͬͯ·͢ɻ 4
  4. Satori ܥϘοτωοτ؍࡯ Attack from Japan ߈ܸ௨৴αϯϓϧ w %-JOLࣾͷ%4-#ͷϧʔλΛૂͬͨ߈ܸɻ w 04ίϚϯυΠϯδΣΫγϣϯͰϑΝΠϧͷμ΢ϯ

    ϩʔυ͓Αͼ࣮ߦΛࢼΈ͍ͯΔɻ w )PTUϔομ͸ɺॳظ͸ϧʔϓόοΫ*1͕ࢦఆɻ w 6TFS"HFOUϔομ͸ɺͨ·ʹมΘΔɻ 5
  5. Satori ܥϘοτωοτ؍࡯ Attack from Japan ߈ܸݩ*1ΞυϨεͷࠃͰूܭ 8 IP ΞυϨεͷҐஔ৘ใ͸ɺMaxMind ͕࡞੒ͨ͠

    GeoLite2 ͷσʔλ(http://www.maxmind.com)Λ࢖༻͠·ͨ͠ɻ ૹ৴ݩͷࠃ ݸ਺ ΤδϓτɾΞϥϒڞ࿨ࠃ   ϕτφϜ  ϩγΞ  ΠλϦΞڞ࿨ࠃ  ϒϥδϧ࿈๜ڞ࿨ࠃ  ೔ຊ  தࠃ  େؖຽࠃ  ΤΫΞυϧڞ࿨ࠃ  ϑϥϯεڞ࿨ࠃ 
  6. Satori ܥϘοτωοτ؍࡯ Attack from Japan ೔ຊ͔Βͷ߈ܸݩ*1ΞυϨεͷ౎ಓ෎ݝͰूܭ 10 IP ΞυϨεͷҐஔ৘ใ͸ɺMaxMind ͕࡞੒ͨ͠

    GeoLite2 ͷσʔλ(http://www.maxmind.com)Λ࢖༻͠·ͨ͠ɻ ૹ৴ݩͷ౎ಓ෎ݝ ݸ਺ ౦ژ౎  ਆಸ઒ݝ  େࡕ෎  ฌݿݝ  Ѫ஌ݝ  ෱Ԭݝ  ઍ༿ݝ  ࡛ۄݝ  ੩Ԭݝ  ෱ౡݝ  ࣛࣇౡݝ 
  7. Satori ܥϘοτωοτ؍࡯ Attack from Japan ·ͱΊ w ϋχʔϙοτͰ4BUPSJϘοτωοτ͔Βͷ߈ܸ͸
 ଟ਺ݕ஌Λ͍ͯ͠Δɻ w

    ੈքతʹ͸Τδϓτ͔Βͷ߈ܸ͕ଟ͍܏޲ʹ͋Δɻ w ೔ຊͷ*1ΞυϨε Ұൠͷ͝Ոఉ ͔Β΋߈ܸ͕
 গͳ͔Βͣདྷ͍ͯΔɻ w ೦ͷҝɺࣗ୐ͷϧʔλͷ༷ࢠΛݟͯΈ͍ͯͩ͘͞ɻ
 ˞ඞͣ͠΋ϧʔλ͕Ϛϧ΢ΣΞײછ͍ͯ͠Δ΋ͷͰ͸ͳ͍ w *P5ػثΛΠϯλʔωοτʹ઀ଓ͢Δͱ͖͸
 े෼͝஫ҙ͍ͩ͘͞ɻ 12