Satori 系ボットネット観察 Attack from Japan

by Kazuaki Morihisa

Slide 1

Slide 1 text

2018೥9݄15೔ IoTSecJP౦ژ Version4.0ൃදࢿྉ Satori ܥϘοτωοτ؍࡯ Attack from Japan @morihi_soc

Slide 2

Slide 2 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan XIPBNJ w ৿ٱ࿨ত !NPSJIJ@TPD w ຊۀ͸ωοτϫʔΫηΩϡϦςΟΤϯδχΞɾΞφϦετ w झຯͰϋχʔϙοτͷӡ༻Λ͢Δϋχʔϙολʔ w ϒϩάˠIUUQTXXXNPSJIJTPDOFU w ϋχʔϙολʔٕज़ަྲྀձओ࠵ऀ w IUUQTIBOJQPUFDIDPOOQBTTDPN 2 ࠓ·Ͱʹ͓ੈ࿩ʹͳͬͨΠϕϯτ(Ұ෦) ɾ*5,FZT ݱ4FD$BQ ɾωοτϫʔΫύέοτΛಡΉձ Ծ ɾ/*4$αΠόʔϋϩ΢Οϯ ɾ*OUFSOFU8FFLɾ)BSEFOJOH ɾTTNKQɾ"*4FDɾ4UVEZ$PEF ɾULULηΩϡϦςΟษڧձ ɾ૯ؔ੢αΠόʔηΩϡϦςΟ-5େձ ɾ08"41/BHPZB ग़൛ͨ͠ຊ΍ٕज़ಉਓࢽ NEW 2018೥8݄ˣ

Slide 3

Slide 3 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan ࠓ೔ɺ఻͍͑ͨ͜ͱ w ษڧձ͕ऴΘͬͯؼ୐ͨ͠Βɺࣗ୐ͷϧʔλͷ ༷ࢠΛݟ͍ͯ͋͛ͯͩ͘͞ɻ w ϩάΠϯͰ͖Δ͔Ͳ͏͔ w ਎ʹ͕֮͑ͳ͍ઃఆ͕͞Ε͍ͯͳ͍͔Ͳ͏͔ w ͦͷଞɺؾʹͳΔ͜ͱ͕ͳ͍͔ 3

Slide 4

Slide 4 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan ϋχʔϙοτ w ϋχʔϙοτ )POFZQPU ͱ͸ɺ͋͑ͯ߈ܸΛड͚Δ ͜ͱΛલఏͱͨ͠γεςϜͰ͢ɻ w ϋχʔϙοτΛӡ༻͢Δਓͷ͜ͱˠϋχʔϙολʔ w 8FCʹಛԽͨ͠ϋχʔϙοτͷϩά͔Β  4BUPSJϘοτωοτΛ؍࡯ͯ͠Έͨɻ w ˠ͓ߦّ͕ѱ͍ͷͰɺϩάΛऩू͠΍͍͢ɻ w σʔλιʔε͸ࣗ෼͕؅ཧ͍ͯ͠Δϋχʔϙοτͷ ΋ͷΛ࢖͍ͬͯ·͢ɻ 4

Slide 5

Slide 5 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan ߈ܸ௨৴αϯϓϧ w %-JOLࣾͷ%4-#ͷϧʔλΛૂͬͨ߈ܸɻ w 04ίϚϯυΠϯδΣΫγϣϯͰϑΝΠϧͷμ΢ϯ ϩʔυ͓Αͼ࣮ߦΛࢼΈ͍ͯΔɻ w )PTUϔομ͸ɺॳظ͸ϧʔϓόοΫ*1͕ࢦఆɻ w 6TFS"HFOUϔομ͸ɺͨ·ʹมΘΔɻ 5

Slide 6

Slide 6 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan 6TFS"HFOU͍Ζ͍Ζ w Ϙοτωοτͷछྨ΍࣌ظʹΑΓগͣͭ͠ҟͳΔɻ w )BLBJʹࢸͬͯ͸ɺ04ίϚϯυ΋ؚΊ͍ͯΔɻ w 3POJO΍4IJOLBͳͲɺ೔ຊޠಡΈͰ͖Δ΋ͷ༗ɻ 6

Slide 7

Slide 7 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan ߈ܸݕ஌ঢ়گ 7 ूܭظؒ:2018೥6݄15೔-8݄31೔

Slide 8

Slide 8 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan ߈ܸݩ*1ΞυϨεͷࠃͰूܭ 8 IP ΞυϨεͷҐஔ৘ใ͸ɺMaxMind ͕࡞੒ͨ͠ GeoLite2 ͷσʔλ(http://www.maxmind.com)Λ࢖༻͠·ͨ͠ɻ ૹ৴ݩͷࠃ ݸ਺ ΤδϓτɾΞϥϒڞ࿨ࠃ ϕτφϜ ϩγΞ ΠλϦΞڞ࿨ࠃ ϒϥδϧ࿈๜ڞ࿨ࠃ ೔ຊ தࠃ େؖຽࠃ ΤΫΞυϧڞ࿨ࠃ ϑϥϯεڞ࿨ࠃ

Slide 9

Slide 9 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan "UUBDLGSPN+BQBO w΋͔ͨ͠͠Βɺ͋ͳͨͷ਎ۙʹϘοτ  ωοτͷҰ෦͕͍Δ͔΋͠Ε·ͤΜɻ w೔ຊͷૹ৴ݩΛूܭͯ͠Έͨɻ 9

Slide 10

Slide 10 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan ೔ຊ͔Βͷ߈ܸݩ*1ΞυϨεͷ౎ಓ෎ݝͰूܭ 10 IP ΞυϨεͷҐஔ৘ใ͸ɺMaxMind ͕࡞੒ͨ͠ GeoLite2 ͷσʔλ(http://www.maxmind.com)Λ࢖༻͠·ͨ͠ɻ ૹ৴ݩͷ౎ಓ෎ݝ ݸ਺ ౦ژ౎ ਆಸ઒ݝ େࡕ෎ ฌݿݝ Ѫ஌ݝ ෱Ԭݝ ઍ༿ݝ ࡛ۄݝ ੩Ԭݝ ෱ౡݝ ࣛࣇౡݝ

Slide 11

Slide 11 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan ૹ৴ݩͷਖ਼ମ͸ w ϗετ໊ΛٯҾ͖͢ΔͱɺҰൠͷ͝ՈఉΈ͍ͨɻ 11 ձ৔ͷΈެ։

Slide 12

Slide 12 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan ·ͱΊ w ϋχʔϙοτͰ4BUPSJϘοτωοτ͔Βͷ߈ܸ͸  ଟ਺ݕ஌Λ͍ͯ͠Δɻ w ੈքతʹ͸Τδϓτ͔Βͷ߈ܸ͕ଟ͍܏޲ʹ͋Δɻ w ೔ຊͷ*1ΞυϨε Ұൠͷ͝Ոఉ ͔Β΋߈ܸ͕  গͳ͔Βͣདྷ͍ͯΔɻ w ೦ͷҝɺࣗ୐ͷϧʔλͷ༷ࢠΛݟͯΈ͍ͯͩ͘͞ɻ  ˞ඞͣ͠΋ϧʔλ͕Ϛϧ΢ΣΞײછ͍ͯ͠Δ΋ͷͰ͸ͳ͍ w *P5ػثΛΠϯλʔωοτʹ઀ଓ͢Δͱ͖͸  े෼͝஫ҙ͍ͩ͘͞ɻ 12

Slide 13

Slide 13 text

Satori ܥϘοτωοτ؍࡯ Attack from Japan )BQQZ)POFZQPU 13 ←2018೥6݄9೔ ৽॓ޚԓ େԹࣨͰࡱӨ ৯஬২෺Ͱ͸ͳ͍ɻ ͓͠·͍