Tweet
Tweet

Slide 1

Slide 1 text

੬ऑੑใ঑੍ۚ౓ͱͷ ෇͖߹͍ํ YAPC::Fukuoka LT

Slide 2

Slide 2 text

ࣗݾ঺հ ߴࢁ @edvakf ϐΫγϒגࣜձࣾ CTO ݉ ෱ԬΦϑΟε্ཱͪ͛୲౰

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

ຊεϥΠυͰ͸BugBounty.jpʹ͍ͭͯଟ͘ݴٴ͠ ͍ͯ·͕͢ɺ୯ͳΔ1Ϣʔβʔͱͯ͠ͷҙݟͰ͋ ΓɺͦΕҎ্ͷར֐ؔ܎͸·ͬͨ͋͘Γ·ͤΜ

Slide 5

Slide 5 text

Τϥ͍ਓ ʮηΩϡϦςΟϦεΫͱ͔ා͍͠ɺ ଟগख͔͚ؒͯ΋͍͍͔Βઈର҆શʹ΍ͬͯͶʯ

Slide 6

Slide 6 text

ηΩϡϦςΟϦεΫΛݮΒ͍ͨ͠ ܦӦऀ΋ݱ৔΋ɺηΩϡϦςΟΛܰࢹ͍ͨ͠ͱ͸ ࢥͬͯͳ͍ ηΩϡϦςΟʹ͔͚Δ΂͖ద੾ͳίετ͕Θ͔Βͳ ͍ 100%Λ໨ࢦͦ͏ͱ͢Δͱແݶʹίετ͕͔͔Δ ։ൃ଎౓Λ٘ਜ਼ʹͨ͘͠ͳ͍

Slide 7

Slide 7 text

ԑ͋ͬͯɺpixivͰ͸ BugBounty.jpΛར༻͢Δ͜ͱʹͳΓ·ͨ͠

Slide 8

Slide 8 text

BugBounty.jpͳΒͰ͸ͷར఺

Slide 9

Slide 9 text

ಋೖίετ͕ݶΓͳ͘௿͍ ੬ऑੑใࠂ૭ޱͳͲͷγεςϜΛ࡞Βͳͯ͘ྑ͍ ηΩϡϦςΟ୲౰ऀ΍ઐ೚νʔϜΛ࡞Βͳͯ͘΋ ࢝ΊΒΕΔ ʢཁ߲΋΄΅ؙ౤͛ͯ͠࡞ͬͯ΋Βͬͨʣ

Slide 10

Slide 10 text

ৼΓࠐΈ·ΘΓΛؙ౤͛Ͱ͖Δ ϖʔύʔϫʔΫͱ͔ ւ֎ૹۚͱ͔ د෇ۚʹ·ͭΘΔ๏཯ͱ͔ →ߟ͑ͨ͘ͳ͍ʂʂ

Slide 11

Slide 11 text

੬ऑੑใ঑ۚӡ༻৬ਓͷ ͓࢓ࣄ

Slide 12

Slide 12 text

ใࠂͷਫ਼ࠪ ࠶ݱ͢Δ͔ ߈ܸ͸༰қ͔ Өڹൣғ͸Ͳͷ͙Β͍͔ ཁ߲Λຬ͍ͨͯ͠Δ͔ աڈͷใࠂͱॏෳͰͳ͍͔ मਖ਼ͷํ਑ΛཱͯͯissueԽ ؆୯ͳΒͦͷ৔Ͱमਖ਼ લճཱͯͨissueͰٞ࿦͕ਐΜͰ͍ Ε͹ࢀՃ ใ঑ֹۚͷܾఆʢޙड़ʣ ใ঑ֹۚදͷߋ৽ ಺෦Ͱͬ͘͟ΓܾΊ͍ͯΔ ຊ౰͸ެ։ͨ͠΄͏͕ྑ͍ͱࢥ͏ ج४ͷमਖ਼ ੬ऑੑͰͳ͍΋ͷ͸ج४Ͱ໌֬Խ ͨ͠΄͏͕਌੾ ͳ͔ͳ͔Ͱ͖͍ͯͳ͍

Slide 13

Slide 13 text

ͦΕͳΓʹߴ౓ͳ൑அ͕ඞཁ

Slide 14

Slide 14 text

ݱࡏ͸୲౰ऀ2ਓʢCTOͱϦʔυΤϯδχΞʣͰ
 िʹ1࣌ؒఔ౓Λׂ͍͍ͯΔ ଞνʔϜʹमਖ਼Λཁٻ͍ͯ͘͠ύϫʔ΋ඞཁ ͜ΕҎ্ͷใࠂΛॲཧ͢Δʹ͸ࣾ಺ͷମ੍Λ΋͏ ͪΐͬͱ੔͑ͳ͍ͱ͍͚ͳ͍͔ͳͱ͍͏ॴײ →࠷ॳద౰ʹܾΊͨใ঑͕ۚͩͬͨɺใࠂΛ૿΍ ͨ͢ΊʹҰ౓Ҿ্͖͛ͨ

Slide 15

Slide 15 text

ద੾ͳใ঑ֹۚΛܾΊΔ

Slide 16

Slide 16 text

ʮ߈ܸ͢ΔΑΓใࠂͨ͠΄͏͕ ཧʹ͔ͳ͏ఔ౓ʯ

Slide 17

Slide 17 text

͸ແཧے

Slide 18

Slide 18 text

ϐΫγϒͰ͸

Slide 19

Slide 19 text

ձࣾͱͯ͠ద੾ͱࢥ͏ൣғͰ্ݶઃఆ͢Ε͹ྑ͍ ηΩϡϦςΟϦεΫ͸اۀͷϒϥϯυ΍ѻ͍ͬͯΔ σʔλʹΑ༷ͬͯʑͳͷͰ ։ൃମ੍ͷதͰରԠ͍͚ͯ͠Δͪΐ͏Ͳྑ͍ྔͷใ ࠂ͕དྷΔΑ͏ʹɺधཁͱڙڅͷόϥϯεΛऔΔ िʹ਺݅ ࣾ಺᜛ٞͱͯ͠͸ɺʮຖ݄͍͍ͩͨ͜ͷ͙Β͍ͷۚ ֹͰ΍Γ·͢ʯͱ͍͏಺༰ʹͳ͍ͬͯΔ

Slide 20

Slide 20 text

಺෦తͳʮ͓͓Αͦͷج४ʯΛܾΊͯɺͦΕͱͷ
 ૬ରతͳൺֱͰใ঑ֹۚΛܾఆ͍ͯ͠Δ ج४Λެ։͠ɺߋ৽͍ͯͬͨ͠΄͏͕ใࠂऀʹ਌੾ ʢͰ͖ͯͳ͍ʣ CVSSΛࢀߟʹͯ͠΋Α͍ʢͯ͠ͳ͍ʣ https://www.ipa.go.jp/security/vuln/CVSSv3.html

Slide 21

Slide 21 text

ଞͷྫʢGoogleʣ https://www.google.com/about/appsecurity/reward-program/

Slide 22

Slide 22 text

ใࠂͷ಺༁

Slide 23

Slide 23 text

શใࠂͷ͏ͪɺ60ʙ70%Λ੬ऑੑೝఆ͠ɺͦͷ಺༁ʢॴײʣ͸ ϩάΠϯ΍ηογϣϯʹ·ͭΘΔ࢓༷ͷෆඋɿ20% ΦʔϓϯϦμΠϨΫλ΍ΫϦοΫδϟοΩϯάͷΑ͏ͳɺϑΟο γϯάʹܨ͕Δ੬ऑੑʢʁʣɿ20% HTTPϔομʔͷෆඋ౳ɿ20% ϑϨʔϜϫʔΫ౳ͷط஌ͷ੬ऑੑɿ10% XSSͳͲɿ10% ͦͷଞɿ20%

Slide 24

Slide 24 text

ਖ਼௚໘౗ͳέʔε΋͋Δ

Slide 25

Slide 25 text

ݒ೦΋ແ͘͸ͳ͍

Slide 26

Slide 26 text

ࣾ಺ͷਓ͕ಗ໊Ͱ੬ऑੑใࠂ͖ͯͨ͠Β… γεςϜతʹ͸๷͛ͳͦ͞͏

Slide 27

Slide 27 text

ͱ͸͍͑ɺ ͱͯ΋ࢀߟʹͳΔใࠂ΋

Slide 28

Slide 28 text

1೥΍͖ͬͯͯɺ࠷ߴֹۚΛ෷ͬͨͷ͸4ճ pngʹِ૷ͨ͠psϑΝΠϧΛʢ͝ʹΐ͝ʹΐʣ ಛఆͷURLΛ։͔ͤΔ͚ͩͰʢ΋͝΋͝ʣ ଞਓͷอଘͨ͠σʔλΛʢ͛;Μ͛;Μʣ Flash༻ͷݹ͍APIͰʢ͋ʔ͏ʔʣ

Slide 29

Slide 29 text

ใࠂऀ΁ͷଚܟ͸ॏཁ

Slide 30

Slide 30 text

·ͨใࠂ͍ͨ͠ɺͱࢥͬͯ΋Β͏ͨΊʹ ͳΔ΂͘ૣͯ͘త֬ͳฦ৴Λ৺͕͚Δ ੬ऑੑͰ͸ͳ͍ͱ൑அͨ͠ΓɺॏෳͰ͋ͬͯ΋ɺ ࢀߟʹͳͬͨ৔߹͸ੵۃతʹใ঑ۚΛࢧ෷͏ ࣦྱʹͳΒͳ͍ݴ༿ݣ͍ ใࠂͷ൒෼͙Β͍͸ӳޠͳͷͰɺӳޠͰͷద੾ ͳදݱʹ໎͏͜ͱ͕͋Δ

Slide 31

Slide 31 text

·ͱΊ

Slide 32

Slide 32 text

BugBounty.jpΛ࢖ͬͯॳظίετΛ཈͑ͯ੬ऑੑใ঑ ੍ۚ౓Λ࢝Ί·ͨ͠ ӡ༻ͷखؒ͸ͦΕͳΓʹ͔͔͍ͬͯΔ ͱݴͬͯ΋ਫ਼͕ࠪि1࣌ؒఔ౓+मਖ਼ίετ͙Β͍ ใ঑ֹۚ͸ɺग़ͤΔൣғ+ॲཧͰ͖ΔൣғͰ΍Δͷ͕ ྑ͍ͷͰ͸ ใࠂऀͷํʑʹ͸େมײँ͍ͯ͠·͢