Upgrade to Pro — share decks privately, control downloads, hide ads and more …

WordPressのセキュリティについて / gifuwpm20-wordpress-security

WordPressのセキュリティについて / gifuwpm20-wordpress-security

Gifu WordPress Meetup #20 での登壇資料です。

Koji Kuno

March 14, 2020
Tweet

More Decks by Koji Kuno

Other Decks in Programming

Transcript

  1. 8PSE1SFTTͷηΩϡϦςΟʹ
    ͍ͭͯ
    (JGV8PSE1SFTT.FFUVQ
    ೥݄೔ʢ౔ʣʙ

    View Slide

  2. ࣗݾ঺հ
    w 8FC੍࡞ܥϑϦʔϥϯε
    w ࠷ۙʮσʔλɾαΠΤϯεʯʹ͍ͭͯڵຯ௡ʑ
    w ग़਎͸άϥϑΟοΫσβΠϯɻ8FC͸׬શಠֶɻ
    w ಈը഑৴ʹ΋खΛग़࢝͠Ίͨɻ

    View Slide

  3. 8PSE1SFTTͷηΩϡϦςΟʹ
    ͍ͭͯ

    View Slide

  4. ৘ใηΩϡϦςΟͷ̏෼ྨ
    w ਓతڴҖ

    ˠ৘ใΛ౪Ήɾෆਖ਼ར༻ɾޡૢ࡞ͳͲਓ͕ى͜͢΋ͷ
    w ٕज़తڴҖ

    ˠෆਖ਼ΞΫηεɾվ͟ΜɾΫϥοΩϯά
    w ෺ཧతڴҖ

    ˠαʔόʔ͕෺ཧతʹյΕΔͳͲ

    View Slide

  5. 8PSE1SFTT͸ૂΘΕ΍͍͢ʁ
    w ʮૂΘΕ΍͍͢ʯͱࢥ͏ʢݸਓతײ૝ʣ
    w γΣΞ͔Βߟ͑ͯ8PSE1SFTTΛૂ͑͹खͬऔΓૣ͍ͱߟ
    ͑Δͷ͕ଥ౰
    w ΦʔϓϯιʔεͳͷͰத਎͸୭Ͱ΋ݟΔ͜ͱ͕Ͱ͖Δ

    View Slide

  6. ຊ౰ʹ8PSE1SFTT͡Όͳ͍ͱμϝʁ
    w ͦͷ΢ΣϒαΠτ͕8PSE1SFTTͰ͋Δ΂͖ཧ༝͸ʁ
    w ଞͷແྉɾ༗ྉϒϩάαʔϏεͰ͸ͩΊʁ
    w ੩త΢ΣϒαΠτͰྑ͍ͷͰ͸ʁ

    View Slide

  7. ޮՌ͕ߴ͍ʢͱߟ͑ΒΕΔʣ
    ରࡦ
    ύεϫʔυͷ؅ཧ
    ΞοϓσʔτΛ͢Δ
    ϩάΠϯ63-Λมߋ͢Δ
    44-Խ
    8"'ಋೖ
    ࢖Θͳ͍ςʔϚɾϓϥάΠϯͷແޮԽ࡟আ

    View Slide

  8. ύεϫʔυͷ؅ཧ
    w ೦ͷͨΊॳظύεϫʔυ͔Βมߋ͓ͯ͜͠͏
    w ҆શͳύεϫʔυͱ͸ʁʢ૯຿লࢀরʣ
    ໊લͳͲͷݸਓ৘ใ͔Β͸ਪଌͰ͖ͳ͍͜ͱ
    ӳ୯ޠͳͲΛͦͷ··࢖༻͠ͳ͍͜ͱ
    ΞϧϑΝϕοτͱ਺ࣈ͕ࠞࡏ͍ͯ͠Δ͜ͱ
    ద੾ͳ௕͞ͷจࣈྻͰ͋Δ͜ͱ
    ྨਪ͠΍͍͢ฒͼํ΍ͦͷ༰қͳ૊Έ߹Θͤʹ͠ͳ͍͜ͱ

    View Slide

  9. ύεϫʔυͷ࠷େղಡ࣌ؒ
    https://www.ipa.go.jp/security/txt/2008/10outline.html

    View Slide

  10. ΞοϓσʔτΛ͢Δ
    w 8PSE1SFTTίΞͷߋ৽ʢϚΠφʔ͸ࣗಈʣ
    w ϓϥάΠϯςʔϚͷߋ৽
    w ίΞWFSʹରԠ͍ͯ͠Δ͔֬ೝ͢Δ΂͖

    View Slide

  11. ϓϥάΠϯͷબͼํ

    View Slide

  12. όοΫΞοϓΛऔಘ͠Α͏
    w ΞοϓσʔτΛ࣮ߦͯ͠ը໘͕ਅͬനʹʜ
    w ͦΜͳ࣌ʹ͸ɺόοΫΞοϓσʔλͰ෮ݩ͠·͢
    w "MMJO0OF81.JHSBUJPO͕ʢݸਓతʹ͸ʣ͓͢͢Ί

    ˠόοΫΞοϓऔಘͱ෮ݩ͕؆୯
    w ීஈ͔ΒఆظతͳόοΫΞοϓΛεέδϡʔϧԽ͢Δ

    View Slide

  13. ϩάΠϯ63-Λมߋ͢Δ
    IUUQTTBNQMFDPNXQMPHJOQIQ

    View Slide

  14. ϩάΠϯ63-Λมߋ͢Δ
    w खಈͰରԠ΋Մೳ

    ˠϋʔυϧ͕ߴ͍ͷͰϓϥάΠϯͰػೳ௥Ճ͕Φεεϝ
    w 4JUF(VBSE811MVHJO
    w ʲ஫ҙʳ༗ޮԽͨ͠Βඪ४ઃఆͰϩάΠϯ63-͕มߋ
    ͞Εͯ͠·͏ͷͰѻ͍ʹ஫ҙ
    w Ճ͑ͯϩάΠϯը໘ʹ#"4*$ೝূΛ෇͚Δͱ͍͏ख΋

    View Slide

  15. 44-Խ
    w 4FDVSF4PDLFUT-BZFSͷུ
    w ΢ΣϒαΠτͱσόΠεʢ1$ͳͲʣͱͷؒͰ΍ΓऔΓ͢
    ΔσʔλΛ҉߸Խͯ͠౪Έʹ͘͘͢Δ࢓૊Έ
    w IUUQTʙͰΞΫηεͰ͖Δ΢ΣϒαΠτ͸ରԠࡁΈ
    w (PPHMF$ISPNFͳͲͰ͸ରԠ͍ͯ͠ͳ͍ͱʮอޢ͞Εͯ
    ͍ͳ͍௨৴ʯͱදࣔ͞ΕͨΓ͢Δ

    View Slide

  16. 44-Խͷํ๏
    w ར༻͍ͯ͠ΔαʔϏε΍αʔόʔʹΑ༷ͬͯʑͳͷͰҰ
    ֓ʹํ๏ΛఏࣔͰ͖ͳ͍
    w طଘ΢ΣϒαΠτΛରԠ͢Δ৔߹ɺαΠτ಺ʹઃஔ͞Ε
    ͍ͯΔϦϯΫશ͕ͯIUUQTʙʹͳ͍ͬͯͳ͍ͱ׬શͳ
    44-Խʹ͸ͳΒͳ͍ʢNJYFEDPOUFOUʣ
    w ద౰ʹ΍Βͣʹ༗ࣝऀʹ૬ஊ͢Δ͜ͱΛ͓קΊ͠·͢

    View Slide

  17. 8"'ಋೖ
    w 8FC"QQMJDBUJPO'JSFXBMMͷུ
    w αʔόʔଆPSϓϥάΠϯͰͷಋೖ͕Ұൠత
    w 9TFSWFSϩϦϙTBLVSB͸ར༻Մೳ
    w 8PSEGFODF4FDVSJUZ'JSFXBMM.BMXBSF4DBOͳͲ
    w 81ɾϓϥάΠϯͷػೳʹΑΔΞΫηεΛޡͬͯःஅͯ͠
    ͠·͏͜ͱ͕͋Δˠνϡʔχϯά͕ඞཁͳ৔߹΋͋Δ

    View Slide

  18. ࢖Θͳ͍ςʔϚɾϓϥάΠϯͷ
    ແޮԽ࡟আ
    w ඪ४Ͱ5XFOUZʙςʔϚ͕ෳ਺Πϯετʔϧ͞Ε͍ͯΔ͕
    ෆཁͳΒ࡟আʢఆظతʹߋ৽͍ͯ͠Ε͹0,ʣ
    w ࢖Θͳ͍PSݹ͍ϓϥάΠϯ͸ɺ࡟আPS৐Γ׵͑ʢஔ͖׵
    ͑ʣΛݕ౼͢Δ
    w ఆظతʹ֬ೝ͢Δश׳Λ࣋ͭͱϕλʔ

    View Slide

  19. ·ͱΊ
    w *%ͱ18͸ΦϦδφϦςΟΛ࣋ͭ
    w ߋ৽͠ͳ͍ͳΒ8PSE1SFTT࢖Θͳ͍ʢ͘Β͍ͷؾ࣋ͪͰʣ
    w όοΫΞοϓ͸ඞਢʢ෮ݩ΋࿅शͯ͠ΈΑ͏ʣ
    w ϩάΠϯ63-Λมߋͯ͠#"4*$ೝূ΋ซͤΔͱ٢
    w 44-Խ͸ࠓ΍ৗࣝʢඞਢʣϨϕϧ

    View Slide