Slide 1
Slide 1 text
lͬ͘͟Γz͢ "84 *".ͷ
ಛݖঢ֨ͷߟ͑ํͱରࡦ
ϞϒηΩϡϦςΟ ୈճ-5େձ NPC@TFDVSJUZ
"[BSB !B@[BSB@O
Slide 2
Slide 2 text
ࣗݾհ
໊લ"[BSB
5XJUUFS!B@[BSB@O
"CPVU
ηΩϡϦςΟؔͷࣄΛ͍ͯ͠Δ৽ଔΤϯδχΞͰ͢
ηΩϡϦςΟͱ8FCͱΫϥυ "84
͕͖Ͱ͢
࠷ۙ"84440ͱ$POUSPM5PXFSͱٔΕͯ·ͨ͠
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 3
Slide 3 text
༨ஊ
ࠓͷؾ࣋ͪ
• ؇ͦ͘͏ͱࢥͬͯ-5ʹొͨ͠
࣮ࡢ·ͰΕͯͨʜ
͋ͱࢀՃऀଟ͍ʜ
• ϏΫϏΫ͍ͯ͠·͢
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 4
Slide 4 text
ࠓ͢͜ͱ
• "84 *". ͬͯͳʹ
• "84*".ͷಛݖঢ֨
• ͳΜͱͳ͘Θ͔Δఔʹ͢
• ͯ͢ͷݸผࣄྫ͞ͳ͍
• ରࡦͲ͏͢ΜͶΜ
• ূͷอશͲ͏͢ΜͶΜ
"84*".ͷ ಛݖঢ֨ͷߟ͑ํ ରࡦূͷอશ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 5
Slide 5 text
͢༰
• कΔଆ߈ܸऀ͕͢Δ߈ܸͷݪཧΛ
͓ͬͯ͘ͱରࡦ͍͢͠ΑͶͱ͍͏ؾ࣋ͪͰॻ͍ͯ·͢
• ରࡦํ๏ईͷ্͍ؔͰ͕ྃ͢͝ঝΛ
• ݸʑͷࣄʹ͍ͭͯৄ͘͢͠Θ͚Ͱ͋Γ·ͤΜ
• lͳΜͱͳ͘Θ͔ͬͨzͱ͍͏ͱ͜Ζ·Ͱ͠·͢
• ֤αʔϏεͷৄ͍͠ར༻ํ๏ʹؔͯ͠
ެࣜυΩϡϝϯτΛࢀরͯ͠Լ͍͞
• ࠓޙͲ͔͜ͰύϫʔΞοϓ൛Λ͔͢͠Ε·ͤΜ͕
ࠓճ͕͍࣌ؒͷͰ zͬ͘͟Γzόʔδϣϯ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 6
Slide 6 text
ҙࣄ߲
• ߈ܸʹར༻Ͱ͖ΔΛ͠·͢
• ྙཧ؍Λ࣋ͬͯฉ͍ͯ͘ΕΔͱ͏Ε͍͠Ͱ͢
• ຊ൪ڥ࣮ڥʹհͨ͠߈ܸͳͲΛ
ڐՄͳ͘ʹ࣮ߦ͠ͳ͍Ͱ͍ͩ͘͞ɻ
• ࡞ͬͯͨΒ͘ͳͬͯ͠·ͬͨͷͰૣޱ͔͠Ε·ͤΜ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 7
Slide 7 text
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
"84*".ͷ "84 *".ͷ
ಛݖঢ֨ͷߟ͑ํ
ରࡦূͷอશ
Slide 8
Slide 8 text
͢͜ͱ
• "84*".ͱ
• lͬ͘͟ΓzΘ͔Δ "84*".
• *". 1PMJDZ
• *".6TFS
• *".3PMF
• *".(SPVQ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 9
Slide 9 text
"84*".ͱ
˞͜ͷεϥΠυͰ "84*".͕ఏڙ͢Δ6TFS3PMFΛҰׅΓʹ͢Δࡍʹ l"84*".zͱදه͠·͢
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
"84ެࣜͷ *".ͷհϖʔδ ͜ͷεϥΠυͷొਓ
Slide 10
Slide 10 text
lͬ͘͟ΓzΘ͔Δ "84*".
*".1PMJDZ
• *".ͷج൫
• ͜ͷϙϦγʔʹݖݶΛॻ͘
• ར༻Ͱ͖Δ݅ڋ൱ʹ͔͚ؔͯ͠Δ
• ݖݶʹ lzΛ͚ͭΔͱϫΠϧυΧʔυʹͳΔ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
こいつ
͜Μͳײ͡ʹهड़͢Δ Πϝʔδ
Slide 11
Slide 11 text
lͬ͘͟ΓzΘ͔Δ "84*".
*".6TFS
• "84Λ࢝ΊΔͱΈΜͳ͏
• ίϯιʔϧʹ$-*ʹରԠ͍ͯ͠Δ
• ࿙ΕΔͱΊΜͲ͍͘͞
• ࿙ΕΔέʔε
• ਓҝతϛεͰ࿙Εͯ͠·͏
• ΫϥΠΞϯτϚγϯ͕৵ೖ͞Ε౪·ΕΔ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
こいつ
Slide 12
Slide 12 text
lͬ͘͟ΓzΘ͔Δ "84*".
*".6TFS
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ϙϦγʔΛΞλονޙड़ͷάϧʔϓʹ
Ճͯ͠ݖݶΛ༩͢Δ
*".6TFSΞΫηεʹؔ͢Δ
ೝূใఏڙ͍ͯ͠·͢
Slide 13
Slide 13 text
lͬ͘͟ΓzΘ͔Δ "84*".
*".3PMF
• Ұ࣌తͳೝূใΛ༩ͯ͘͠ΕΔ
• ผΞΧϯτʹ༩Ͱ͖ΔΑ
ΫϩεΞΧϯτ
• αʔϏεʹΞλον͢Δ͜ͱͰ
ͦͷαʔϏε͔Βͷૢ࡞ʹར༻Ͱ͖Δ
Ұ࣌తͳೝূใΛ͍ग़͢Α
• &$-BNCEBɺ$PEF#VJMEͳͲͳͲ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
こいつ
Slide 14
Slide 14 text
lͬ͘͟ΓzΘ͔Δ "84*".
*".6TFS
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
*".6TFSͷΑ͏ʹQPMJDZΛΞλονͯ͠
ݖݶΛ༩͢Δ
*". 3PMFΛར༻Ͱ͖ΔϦιʔε
ΞΧϯτͳͲʹ৴པؔΛઃఆ͠·͢
&$Ͱ͍͍ͨ࣌͜Μͳײ͡
Πϝʔδ
Slide 15
Slide 15 text
lͬ͘͟ΓzΘ͔Δ "84*".
*".(SPVQ
• *". 6TFSΛ·ͱΊͯ͘ΕΔ
• ͜ΕʹϙϦγʔΛΞλον͢Δͱάϧʔϓʹ
ଐ͍ͯ͠Δ*".6TFS͕ΈΜͳڧ͘ͳΔ
• *".6TFS͕૿͑Δͱׂͱ͏
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
こいつら
Slide 16
Slide 16 text
lͬ͘͟ΓzΘ͔Δ "84*".
*".6TFS
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ϢʔβʔΛՃͯ͠·ͱΊͯ
ϙϦγʔΛ༩Ͱ͖Δ
*".6TFS3PMFಉ༷
ϙϦγʔʹΑΔݖݶΛΞλον͢Δ
Slide 17
Slide 17 text
*".ͷzͬ͘͟Γz·ͱΊ
*".1PMJDZ
• ݖݶΛهड़͢Δ
• 3PMF6TFSɺ(SPVQʹΞλονΛͯ͠ݖݶΛ༩Ͱ͖Δ
*". 6TFS
• 6TFSͷར༻͢ΔೝূใͳͲΛఏڙͰ͖Δ
*". 3PMF
• αʔϏεผΞΧϯτʹҰ࣌తͳݖݶΛ༩Ͱ͖Δ
*". (SPVQ
• *".6TFSΛ·ͱΊͯཧͰ͖Δ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 18
Slide 18 text
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
"84*".ͷ ରࡦূͷอશ
"84*".ͷ
ಛݖঢ֨ͷߟ͑ํ
Slide 19
Slide 19 text
͢͜ͱ
• "84*".ʹ͓͚Δಛݖঢ֨ͱ
• ߈ܸαΠΫϧͷҰ෦ͱͯ͠ͷಛݖঢ֨
• ख๏ʹ͍ͭͯ
• lͬ͘͟Γzख๏Λେผ͢Δͱ
• "84*".ʹతͳมߋૢ࡞Λߦ͏
• طଘͷͷΛѱ༻͢Δ
• FUD
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 20
Slide 20 text
"84*".ʹ͓͚Δಛݖঢ֨ͱ
• "846TFS 3PMF͕ʹ༩͞ΕͨݖݶΛ
ΑΓڧྗ·ͨ༗༻ͳݖݶʹΞοϓάϨʔυ͢Δߦҝ
• ΞοϓάϨʔυͷख๏
• ݖݶͷॻ͖͑มߋ
• ଞͰར༻͞Ε͍ͯΔผͷೝূใͷऔಘ
• *". 3PMFϙϦγʔͷ͛͢ସ͑
• FUD
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 21
Slide 21 text
߈ܸαΠΫϧͷҰ෦ͱͯ͠ͷಛݖঢ֨
• ߈ܸऀ͕ "84Λૂ͏ཧ༝
• ଞਓͷ&$Ϧιʔε͍͍ͨͥ
• 3%4ͱ͔ͷใൈ͖औΓ͍ͨͥ
• SPPUݖݶऔͬͯΈ͍ͨͥ
• FUD ʜ
• ͱ͔͘ѱ༻ͷͨΊʹ
͍ΖΜͳ͜ͱΛͯ͘͠Δ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ೝূใΛऔಘ
ͲͷΑ͏ͳݖݶ͕
༩͞Ε͍ͯΔ͔
୳ࡧ
ಛݖঢ֨
ѱ༻
͋͘·Ͱ
Πϝʔδ
Slide 22
Slide 22 text
lͬ͘͟Γz ख๏Λେผ͢Δ
• "84*". ʹతͳมߋૢ࡞Λߦ͏
• ྫ
• *".QPMJDZͷతͳมߋ
• *".3PMFͷϙϦγʔΞλον
• ϦιʔεΛܦ༝ͯ͠طଘͷ*".3PMF͔Βऔಘ
• ྫ
• -BNCEBͷίʔυΛมߋ͠ɺFOW͔ΒೝূใΛൈ͘
• ϋΠϒϦοτ
• ྫ
• *". 3PMFΛ৽͘͠࡞Γ &$ʹΞλον
• ͦͷଞ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 23
Slide 23 text
lͬ͘͟Γz ख๏Λେผ͢Δ
• "84*". ʹతͳมߋૢ࡞Λߦ͏ ܰ͘৮Ε·͢
• ྫ
• *".QPMJDZͷతͳมߋ
• *".3PMFͷϙϦγʔΞλον
• ϦιʔεΛܦ༝ͯ͠طଘͷ*".3PMF͔Βऔಘ ͬͪ͜Λ͠·͢
• ྫ
• -BNCEBͷίʔυΛมߋ͠ɺFOW͔ΒೝূใΛൈ͘
• ϋΠϒϦοτ
• ྫ
• *". 3PMFΛ৽͘͠࡞Γ &$ʹΞλον
• ͦͷଞ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 24
Slide 24 text
"84*". ʹతͳมߋૢ࡞Λߦ͏
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
ͲͷΑ͏ͳͷͷ͜ͱΛࢦ͢ͷ͔
• *".6TFSͷ࡞
• طଘͷ*".6TFS͔ΒݤΛ࡞
• *". 1PMJDZͷ࡞มߋ
• *".3PMFʹ*".1PMJDZͷΞλον
ͳͲ
༩͞Εͨ "84*".ͷݖݶΛར༻͠
ࣗͷཉ͍ͯ͠ΔݖݶΛऔಘઃఆ͢Δ
Slide 25
Slide 25 text
ϦιʔεΛܦ༝ͯ͠
طଘͷ*".3PMF͔Βऔಘ
ͲͷΑ͏ͳͷͷ͜ͱΛࢦ͢ͷ͔
• طଘͷ-BNCEBͷίʔυΛมߋ
• $MPVE'PSNBUJPOʹ*". 3PMFΛ༩
• &$ʹ*".3PMFΛ༩
ͳͲ
Ϧιʔεʹ༩͞ΕΔҰ࣌తͳೝূใΛ
ͳΜΒ͔ͷख๏Ͱऔಘ͠ར༻͢Δ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
例: Lambdaから取得する場合の
⼤体のイメージ
Slide 26
Slide 26 text
ϦιʔεΛܦ༝ͯ͠
طଘͷ*".3PMF͔Βऔಘ
ొ͢Δ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
˞ ຊղઆʹ͓͍ͯ߈ܸऀࣄલʹ*".3PMF໊ΛѲ͍ͯ͠Δલఏͱ͢Δ
Slide 27
Slide 27 text
ϦιʔεΛܦ༝ͯ͠
طଘͷ*".3PMF͔Βऔಘ
طଘͷϦιʔεΛ࣮ߦ͢Δ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 28
Slide 28 text
ϦιʔεΛܦ༝ͯ͠
طଘͷ*".3PMF͔Βऔಘ
طଘͷϦιʔεΛߋ৽͢Δ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 29
Slide 29 text
ϦιʔεΛܦ༝ͯ͠
طଘͷ*".3PMF͔Βऔಘ
৽نͰϦιʔεΛ্ཱͪ͛3PMFΛड͚͢
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 30
Slide 30 text
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
"84*".ͷ
"84 *".ͷ
ಛݖঢ֨ͷߟ͑ํ
ରࡦূͷอશ
Slide 31
Slide 31 text
ରࡦ
• औಘΛ·્ͣࢭ͢Δ
• HJUTFDSFUͷಋೖͰ HJUͷೝূใࠞೖΛ͙
• ͨΒʹೝূใΛڞ༗͠ͳ͍૿͞ͳ͍
• FUD
• ࠷খݖݶͷݪଇΛकΓ *".ͷϙϦγʔΛ࡞
• Θ͔Βͳ͍߹*"."DDFTT"OBMZ[FSͳͲΛ༻͍Δ
• ݖݶ͚ͩͰͳ͘ར༻Ͱ͖ΔϦιʔεͳͲΛ੍ݶ͢Δ
• 4FDVSJUZ)VCΛ༻͍ͯΞΧϯτͷڴҖใΛऩू
• ΞΧϯτͰར༻͠ͳ͍ݖݶ
4$1 4FSWJDF$POUSPM1PMJDZ
Ͱ੍ݶ͢Δ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 32
Slide 32 text
ূͷऔಘͱอશ
ূͷऔಘ
• $MPVE5SBJMͳͲΛ"1*ͷར༻ϩάΛऔಘ
• ΞϓϦέʔγϣϯͷϩάͳͲ$MPVE 8BUDI-PHTΛ༻͍ͯऔಘ
ূͷอଘ
• 4ΫϩεΞΧϯτઌͷ4ʹอଘ
ূͷอશ
• আͤ͞ͳ͍ͨΊʹ
• 4ͷόʔδϣχϯάΛ༗ޮԽ
• .'" EFMFUFͷ༗ޮԽ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 33
Slide 33 text
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
·ͱΊ
"84*".ͷ
"84 *".ͷ
ಛݖঢ֨ͷߟ͑ํ
ରࡦূڌͷอશ
Slide 34
Slide 34 text
·ͱΊ
͜ͷ-5Ͱͬ͘͟Γͱͨ͠ݖݶঢ֨ͷϑϩʔʹ͍ͭͯ৮Ε·ͨ͠
• "84*". ʹతͳมߋͳͲʹΑΓѱ༻͢Δͷ
• طଘͷͷΛѱ༻͢Δͷ
• ೋͭΛ߹ΘͤͨϋΠϒϦοτ
"84ͳͲͷΫϥυαʔϏεʹରͯ͠ɺ߈ܸऀৗʹΛޫΒͤ
͍ͯ·͢ɻ
ར༻ऀͱͯ͠ɺࢲͨͪͰ͖ΔݶΓͷରࡦͱূڌΛूΊམͪண͍ͨ
ΫϥυϥΠϑΛա͝͠·͠ΐ͏ɻ
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 35
Slide 35 text
͓͠·͍
4QFDJBMUIBOLT*$000/.0/0
IUUQTJDPPPONPOPDPN
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 36
Slide 36 text
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
͓·͚
ֶशʹ͍ͭͯ
Slide 37
Slide 37 text
ֶशؔ࿈
• "84ެࣜυΩϡϝϯτͱᛀΊͬ͜
• ࣮ڥͰࢼͯ͠ΈΔ
• ࠷ॳ GMBXTDMPVE ͱ͔Ͱ͍͍͔
• 4FSWFSMFTTपΓͩͱಈ͘ͷগͳ͍
• ҰԠհ
• 08"41%74"
• 08"414FSWFSMFTT(PBU
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 38
Slide 38 text
ֶशؔ࿈
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
Slide 39
Slide 39 text
ֶशؔ࿈
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
https://github.com/RhinoSecurityLabs/cloudgoat
Slide 40
Slide 40 text
ֶशؔ࿈
!B@[BSB@ONPC@TFDVSJUZϞϒηΩϡϦςΟ
https://rhinosecuritylabs.com/blog/?category=cloud-security