Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up
for free
WordPressのセキュリティについて / gifuwpm20-wordpress-security
Koji Kuno
March 14, 2020
Programming
0
49
WordPressのセキュリティについて / gifuwpm20-wordpress-security
Gifu WordPress Meetup #20 での登壇資料です。
Koji Kuno
March 14, 2020
Tweet
Share
More Decks by Koji Kuno
See All by Koji Kuno
oleindesign
0
30
oleindesign
3
25
oleindesign
0
190
oleindesign
0
280
oleindesign
0
63
oleindesign
1
70
oleindesign
1
170
oleindesign
3
400
oleindesign
0
88
Other Decks in Programming
See All in Programming
hirotokirimaru
1
430
nbkouhou
9
4.7k
kenmaz
1
100
dulltz
0
520
showwin
0
130
mizdra
7
4.9k
nbkouhou
0
930
line_developers_tw2
0
720
line_developers_tw
0
540
ufoo68
1
180
takahi5
0
230
decoc
1
340
Featured
See All Featured
schacon
145
6.6k
reverentgeek
168
7.1k
philhawksworth
190
17k
tanoku
86
8.5k
malarkey
393
60k
hursman
106
9.2k
swwweet
206
6.8k
scottboms
251
11k
robhawkes
52
2.8k
sachag
267
17k
addyosmani
494
110k
zakiwarfel
88
3.3k
Transcript
8PSE1SFTTͷηΩϡϦςΟʹ ͍ͭͯ (JGV8PSE1SFTT.FFUVQ ݄ʢʣʙ
ࣗݾհ w 8FC੍࡞ܥϑϦʔϥϯε w ࠷ۙʮσʔλɾαΠΤϯεʯʹ͍ͭͯڵຯʑ w ग़άϥϑΟοΫσβΠϯɻ8FCશಠֶɻ w ಈը৴ʹखΛग़࢝͠Ίͨɻ
8PSE1SFTTͷηΩϡϦςΟʹ ͍ͭͯ
ใηΩϡϦςΟͷ̏ྨ w ਓతڴҖ ˠใΛ౪Ήɾෆਖ਼ར༻ɾޡૢ࡞ͳͲਓ͕ى͜͢ͷ w ٕज़తڴҖ ˠෆਖ਼ΞΫηεɾվ͟ΜɾΫϥοΩϯά w ཧతڴҖ ˠαʔόʔ͕ཧతʹյΕΔͳͲ
8PSE1SFTTૂΘΕ͍͢ʁ w ʮૂΘΕ͍͢ʯͱࢥ͏ʢݸਓతײʣ w γΣΞ͔Βߟ͑ͯ8PSE1SFTTΛૂ͑खͬऔΓૣ͍ͱߟ ͑Δͷ͕ଥ w ΦʔϓϯιʔεͳͷͰத୭ͰݟΔ͜ͱ͕Ͱ͖Δ
ຊʹ8PSE1SFTT͡Όͳ͍ͱμϝʁ w ͦͷΣϒαΠτ͕8PSE1SFTTͰ͋Δ͖ཧ༝ʁ w ଞͷແྉɾ༗ྉϒϩάαʔϏεͰͩΊʁ w ੩తΣϒαΠτͰྑ͍ͷͰʁ
ޮՌ͕ߴ͍ʢͱߟ͑ΒΕΔʣ ରࡦ ύεϫʔυͷཧ ΞοϓσʔτΛ͢Δ ϩάΠϯ63-Λมߋ͢Δ 44-Խ 8"'ಋೖ Θͳ͍ςʔϚɾϓϥάΠϯͷແޮԽআ
ύεϫʔυͷཧ w ೦ͷͨΊॳظύεϫʔυ͔Βมߋ͓ͯ͜͠͏ w ҆શͳύεϫʔυͱʁʢ૯লࢀরʣ ໊લͳͲͷݸਓใ͔ΒਪଌͰ͖ͳ͍͜ͱ ӳ୯ޠͳͲΛͦͷ··༻͠ͳ͍͜ͱ ΞϧϑΝϕοτͱࣈ͕ࠞࡏ͍ͯ͠Δ͜ͱ దͳ͞ͷจࣈྻͰ͋Δ͜ͱ ྨਪ͍͢͠ฒͼํͦͷ༰қͳΈ߹Θͤʹ͠ͳ͍͜ͱ
ύεϫʔυͷ࠷େղಡ࣌ؒ https://www.ipa.go.jp/security/txt/2008/10outline.html
ΞοϓσʔτΛ͢Δ w 8PSE1SFTTίΞͷߋ৽ʢϚΠφʔࣗಈʣ w ϓϥάΠϯςʔϚͷߋ৽ w ίΞWFSʹରԠ͍ͯ͠Δ͔֬ೝ͢Δ͖
ϓϥάΠϯͷબͼํ
όοΫΞοϓΛऔಘ͠Α͏ w ΞοϓσʔτΛ࣮ߦͯ͠ը໘͕ਅͬനʹʜ w ͦΜͳ࣌ʹɺόοΫΞοϓσʔλͰ෮ݩ͠·͢ w "MMJO0OF81.JHSBUJPO͕ʢݸਓతʹʣ͓͢͢Ί ˠόοΫΞοϓऔಘͱ෮ݩ͕؆୯ w ීஈ͔ΒఆظతͳόοΫΞοϓΛεέδϡʔϧԽ͢Δ
ϩάΠϯ63-Λมߋ͢Δ IUUQTTBNQMFDPNXQMPHJOQIQ
ϩάΠϯ63-Λมߋ͢Δ w खಈͰରԠՄೳ ˠϋʔυϧ͕ߴ͍ͷͰϓϥάΠϯͰػೳՃ͕Φεεϝ w 4JUF(VBSE811MVHJO w ʲҙʳ༗ޮԽͨ͠Βඪ४ઃఆͰϩάΠϯ63-͕มߋ ͞Εͯ͠·͏ͷͰѻ͍ʹҙ w
Ճ͑ͯϩάΠϯը໘ʹ#"4*$ೝূΛ͚Δͱ͍͏ख
44-Խ w 4FDVSF4PDLFUT-BZFSͷུ w ΣϒαΠτͱσόΠεʢ1$ͳͲʣͱͷؒͰΓऔΓ͢ ΔσʔλΛ҉߸Խͯ͠౪Έʹ͘͘͢ΔΈ w IUUQTʙͰΞΫηεͰ͖ΔΣϒαΠτରԠࡁΈ w (PPHMF$ISPNFͳͲͰରԠ͍ͯ͠ͳ͍ͱʮอޢ͞Εͯ
͍ͳ͍௨৴ʯͱදࣔ͞ΕͨΓ͢Δ
44-Խͷํ๏ w ར༻͍ͯ͠ΔαʔϏεαʔόʔʹΑ༷ͬͯʑͳͷͰҰ ֓ʹํ๏ΛఏࣔͰ͖ͳ͍ w طଘΣϒαΠτΛରԠ͢Δ߹ɺαΠτʹઃஔ͞Ε ͍ͯΔϦϯΫશ͕ͯIUUQTʙʹͳ͍ͬͯͳ͍ͱશͳ 44-ԽʹͳΒͳ͍ʢNJYFEDPOUFOUʣ w దʹΒͣʹ༗ࣝऀʹ૬ஊ͢Δ͜ͱΛ͓קΊ͠·͢
8"'ಋೖ w 8FC"QQMJDBUJPO'JSFXBMMͷུ w αʔόʔଆPSϓϥάΠϯͰͷಋೖ͕Ұൠత w 9TFSWFSϩϦϙTBLVSBར༻Մೳ w 8PSEGFODF4FDVSJUZ'JSFXBMM.BMXBSF4DBOͳͲ w
81ɾϓϥάΠϯͷػೳʹΑΔΞΫηεΛޡͬͯःஅͯ͠ ͠·͏͜ͱ͕͋Δˠνϡʔχϯά͕ඞཁͳ߹͋Δ
Θͳ͍ςʔϚɾϓϥάΠϯͷ ແޮԽআ w ඪ४Ͱ5XFOUZʙςʔϚ͕ෳΠϯετʔϧ͞Ε͍ͯΔ͕ ෆཁͳΒআʢఆظతʹߋ৽͍ͯ͠Ε0,ʣ w Θͳ͍PSݹ͍ϓϥάΠϯɺআPSΓ͑ʢஔ͖ ͑ʣΛݕ౼͢Δ w ఆظతʹ֬ೝ͢Δश׳Λ࣋ͭͱϕλʔ
·ͱΊ w *%ͱ18ΦϦδφϦςΟΛ࣋ͭ w ߋ৽͠ͳ͍ͳΒ8PSE1SFTTΘͳ͍ʢ͘Β͍ͷؾ࣋ͪͰʣ w όοΫΞοϓඞਢʢ෮ݩ࿅शͯ͠ΈΑ͏ʣ w ϩάΠϯ63-Λมߋͯ͠#"4*$ೝূซͤΔͱ٢ w
44-ԽࠓৗࣝʢඞਢʣϨϕϧ