Satori 系ボットネット観察 Attack from Japan

292a5fc0722cc2ddabf2b088a8f12793?s=47 Kazuaki Morihisa
September 15, 2018

Satori 系ボットネット観察 Attack from Japan

2018年9月15日 IoTSecJP東京 Version4.0
@morihi_soc #IoTSecJP
https://iotsecjp.connpass.com/event/98193/

292a5fc0722cc2ddabf2b088a8f12793?s=128

Kazuaki Morihisa

September 15, 2018
Tweet

Transcript

  1. 2018೥9݄15೔ IoTSecJP౦ژ Version4.0ൃදࢿྉ Satori ܥϘοτωοτ؍࡯ Attack from Japan @morihi_soc

  2. Satori ܥϘοτωοτ؍࡯ Attack from Japan XIPBNJ w ৿ٱ࿨ত !NPSJIJ@TPD 

    w ຊۀ͸ωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ w ϒϩάˠIUUQTXXXNPSJIJTPDOFU w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ w IUUQTIBOJQPUFDIDPOOQBTTDPN 2 ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ(Ұ෦) ɾ*5,FZT ݱ4FD$BQ  ɾωοτϫʔΫύέοτΛಡΉձ Ծ  ɾ/*4$αΠόʔϋϩ΢Οϯ ɾ*OUFSOFU8FFLɾ)BSEFOJOH ɾTTNKQɾ"*4FDɾ4UVEZ$PEF ɾULULηΩϡϦςΟษڧձ ɾ૯ؔ੢αΠόʔηΩϡϦςΟ-5େձ ɾ08"41/BHPZB ग़൛ͨ͠ຊ΍ٕज़ಉਓࢽ NEW 2018೥8݄ˣ
  3. Satori ܥϘοτωοτ؍࡯ Attack from Japan ࠓ೔ɺ఻͍͑ͨ͜ͱ w ษڧձ͕ऴΘͬͯؼ୐ͨ͠Βɺࣗ୐ͷϧʔλͷ ༷ࢠΛݟ͍ͯ͋͛ͯͩ͘͞ɻ w

    ϩάΠϯͰ͖Δ͔Ͳ͏͔ w ਎ʹ͕֮͑ͳ͍ઃఆ͕͞Ε͍ͯͳ͍͔Ͳ͏͔ w ͦͷଞɺؾʹͳΔ͜ͱ͕ͳ͍͔ 3
  4. Satori ܥϘοτωοτ؍࡯ Attack from Japan ϋχʔϙοτ w ϋχʔϙοτ )POFZQPU ͱ͸ɺ͋͑ͯ߈ܸΛड͚Δ

    ͜ͱΛલఏͱͨ͠γεςϜͰ͢ɻ w ϋχʔϙοτΛӡ༻͢Δਓͷ͜ͱˠϋχʔϙολʔ w 8FCʹಛԽͨ͠ϋχʔϙοτͷϩά͔Β
 4BUPSJϘοτωοτΛ؍࡯ͯ͠Έͨɻ w ˠ͓ߦّ͕ѱ͍ͷͰɺϩάΛऩू͠΍͍͢ɻ w σʔλιʔε͸ࣗ෼͕؅ཧ͍ͯ͠Δϋχʔϙοτͷ ΋ͷΛ࢖͍ͬͯ·͢ɻ 4
  5. Satori ܥϘοτωοτ؍࡯ Attack from Japan ߈ܸ௨৴αϯϓϧ w %-JOLࣾͷ%4-#ͷϧʔλΛૂͬͨ߈ܸɻ w 04ίϚϯυΠϯδΣΫγϣϯͰϑΝΠϧͷμ΢ϯ

    ϩʔυ͓Αͼ࣮ߦΛࢼΈ͍ͯΔɻ w )PTUϔομ͸ɺॳظ͸ϧʔϓόοΫ*1͕ࢦఆɻ w 6TFS"HFOUϔομ͸ɺͨ·ʹมΘΔɻ 5
  6. Satori ܥϘοτωοτ؍࡯ Attack from Japan 6TFS"HFOU͍Ζ͍Ζ w Ϙοτωοτͷछྨ΍࣌ظʹΑΓগͣͭ͠ҟͳΔɻ w )BLBJʹࢸͬͯ͸ɺ04ίϚϯυ΋ؚΊ͍ͯΔɻ

    w 3POJO΍4IJOLBͳͲɺ೔ຊޠಡΈͰ͖Δ΋ͷ༗ɻ 6
  7. Satori ܥϘοτωοτ؍࡯ Attack from Japan ߈ܸݕ஌ঢ়گ 7 ूܭظؒ:2018೥6݄15೔-8݄31೔

  8. Satori ܥϘοτωοτ؍࡯ Attack from Japan ߈ܸݩ*1ΞυϨεͷࠃͰूܭ 8 IP ΞυϨεͷҐஔ৘ใ͸ɺMaxMind ͕࡞੒ͨ͠

    GeoLite2 ͷσʔλ(http://www.maxmind.com)Λ࢖༻͠·ͨ͠ɻ ૹ৴ݩͷࠃ ݸ਺ ΤδϓτɾΞϥϒڞ࿨ࠃ   ϕτφϜ  ϩγΞ  ΠλϦΞڞ࿨ࠃ  ϒϥδϧ࿈๜ڞ࿨ࠃ  ೔ຊ  தࠃ  େؖຽࠃ  ΤΫΞυϧڞ࿨ࠃ  ϑϥϯεڞ࿨ࠃ 
  9. Satori ܥϘοτωοτ؍࡯ Attack from Japan "UUBDLGSPN+BQBO w΋͔ͨ͠͠Βɺ͋ͳͨͷ਎ۙʹϘοτ
 ωοτͷҰ෦͕͍Δ͔΋͠Ε·ͤΜɻ w೔ຊͷૹ৴ݩΛूܭͯ͠Έͨɻ 9

  10. Satori ܥϘοτωοτ؍࡯ Attack from Japan ೔ຊ͔Βͷ߈ܸݩ*1ΞυϨεͷ౎ಓ෎ݝͰूܭ 10 IP ΞυϨεͷҐஔ৘ใ͸ɺMaxMind ͕࡞੒ͨ͠

    GeoLite2 ͷσʔλ(http://www.maxmind.com)Λ࢖༻͠·ͨ͠ɻ ૹ৴ݩͷ౎ಓ෎ݝ ݸ਺ ౦ژ౎  ਆಸ઒ݝ  େࡕ෎  ฌݿݝ  Ѫ஌ݝ  ෱Ԭݝ  ઍ༿ݝ  ࡛ۄݝ  ੩Ԭݝ  ෱ౡݝ  ࣛࣇౡݝ 
  11. Satori ܥϘοτωοτ؍࡯ Attack from Japan ૹ৴ݩͷਖ਼ମ͸ w ϗετ໊ΛٯҾ͖͢ΔͱɺҰൠͷ͝ՈఉΈ͍ͨɻ 11 ձ৔ͷΈެ։

  12. Satori ܥϘοτωοτ؍࡯ Attack from Japan ·ͱΊ w ϋχʔϙοτͰ4BUPSJϘοτωοτ͔Βͷ߈ܸ͸
 ଟ਺ݕ஌Λ͍ͯ͠Δɻ w

    ੈքతʹ͸Τδϓτ͔Βͷ߈ܸ͕ଟ͍܏޲ʹ͋Δɻ w ೔ຊͷ*1ΞυϨε Ұൠͷ͝Ոఉ ͔Β΋߈ܸ͕
 গͳ͔Βͣདྷ͍ͯΔɻ w ೦ͷҝɺࣗ୐ͷϧʔλͷ༷ࢠΛݟͯΈ͍ͯͩ͘͞ɻ
 ˞ඞͣ͠΋ϧʔλ͕Ϛϧ΢ΣΞײછ͍ͯ͠Δ΋ͷͰ͸ͳ͍ w *P5ػثΛΠϯλʔωοτʹ઀ଓ͢Δͱ͖͸
 े෼͝஫ҙ͍ͩ͘͞ɻ 12
  13. Satori ܥϘοτωοτ؍࡯ Attack from Japan )BQQZ)POFZQPU 13 ←2018೥6݄9೔ ৽॓ޚԓ େԹࣨͰࡱӨ

    ৯஬২෺Ͱ͸ͳ͍ɻ ͓͠·͍